bdc6e9d37bc799fca8627b2ca5972a8893536c6e0f5016604befced404e3d974

Analysis

max time kernel
4s
max time network
190s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
05/06/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9968402d6281de3e9cfc1109dd416762_JaffaCakes118.apk
Size 15.0MB
Sample240605-2ertnsag8t
SHA256 bdc6e9d37bc799fca8627b2ca5972a8893536c6e0f5016604befced404e3d974
MD5 9968402d6281de3e9cfc1109dd416762
SHA1 b6568bafdb88a1a7e35ca9488847683d1b861022
SHA512 28834bece738c0b2c8ef44f923cc68503f3308eea8048c282ac5fca05852c7670cc16ea9877b151745d49f2c9953891f2dbdd4ce84e5476091a609616f0f678c
SSDEEP 393216:6c+U2DX/URLEEHtH5ymUqtS4HfStoVgbRbnpVRnbz0Qx2xSgfX:pj0qEWtH5y+HKtZJRnbO/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.huadu.reader

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.huadu.reader

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.huadu.reader

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.huadu.reader

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.huadu.reader

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.huadu.reader

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.huadu.reader

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.huadu.reader

com.huadu.reader
1⤵
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4988

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

MessageStore.db

Path /data/data/com.huadu.reader/databases/MessageStore.db
Size 36KB
SHA256 ecb0e8c93a782292a1dfe20a90e204d1c1c804e2773f1831c9ca34826aa62071
MD5 15669eb47bb19111cb64fa7508b227d7
SHA1 c7585424afeb0fc7051697b771eb3d81e0e3aae3
SHA512 13c2cb45912090ba0b670b36050eab5954e22d57b79e141d2236035dc1ea2000960d93ebc544fc4dee48765335a3d52baeb5d31c8a40407224c624fffebbc11b
SSDEEP 12:TLGPi/W7X2EkamDfVcsg1jWuQUmKiayaA9HlApc2o/0XyNTSFbyc34wyACumRmBH:TLGPi/UPzmD6ZWaJyZ4M0yAN9GSgGQe
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db-journal

Path /data/data/com.huadu.reader/databases/MessageStore.db-journal
Size 512B
SHA256 969d42a01481b43e9b84aa71e4299a218e741003a71625af7017206d03e93ac5
MD5 be76917c2b333b8c63d78a0fa1f76454
SHA1 6143734c950f5384f260a6733688cbf964b38671
SHA512 2001eb807ca7cf88c3a43968d2dde12bbcb09075bc0df4940eead0534135dae7b0a09244943ee01b089da8c3c4d736eb4545865eb9c1a5560d512c724bd20db8
MD5 SHA1 SHA512

Submit Download

MessageStore.db-journal

Path /data/data/com.huadu.reader/databases/MessageStore.db-journal
Size 8KB
SHA256 0d70975d0fbba2b4467de7ddf882420c9ff627a621be25154eb5e7d8ae6a79f3
MD5 628e0528762306da11b5b6fb05514439
SHA1 7c0436a96e06c8f2747afd4669b6fdf7a92c8b9f
SHA512 11947b76f7e2c83bde707d2504606a525ec76ff73b8f935344a32f04ab24178ae7b173c563168c7fbd987bbaa1cf5bf7dbd53613fe262a4698d01457a2361558
SSDEEP 6:7+/l9dR4n1VRg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK0p:7+tpSRqLiuWdwRmBEyPbtp
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db-journal

Path /data/data/com.huadu.reader/databases/MessageStore.db-journal
Size 8KB
SHA256 d6efc32d331981f4cdcc8e8ee05a15aaaa2b952faba006bcb09763787473d859
MD5 8a38fe5725ff9e0c1e1dc8438614bef0
SHA1 28223ac92e9a42b11d8c3beb8e9865d5b4ebcb9e
SHA512 cf4ad503e51701b5fc96887c900fd5d445f43a3d2afc3b4f6eba97f55e13892c842c84527224e116e2c26e621f979cae3f7fbb548e0e3b30fb9a97f87d7abd21
SSDEEP 6:7+/l9Lii4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKwJs//B:7+tpipqLJdTRmBEyPbz+B
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db

Path /data/data/com.huadu.reader/databases/MsgLogStore.db
Size 56KB
SHA256 05be88f05e9bfd4d6496caab584a704e7956fb87036529a0c8028f1e2bda309c
MD5 9cec591e3ef91ae568f4cb6e7c2a8745
SHA1 ccf756b6b465ad9ad7ff6bfbeb4e8345ba3f6ff7
SHA512 f824b3268338787275c184bb740d152d53c1d8e57a044f587530735ef04d021a2671cc2aebb17ae3b497a0ad171060da484a565bfa62d32ed334ae5ffb538f51
SSDEEP 24:TLsji+931pd6O+Rn0H46Dgn8tN8X48XeqS8XRu8XM8XMWlsl4qSlXmlIl18f8Dqo:TUF33QO+t070OCJfhF8GIUWZw3RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db-journal

Path /data/data/com.huadu.reader/databases/MsgLogStore.db-journal
Size 512B
SHA256 0932bbeb2fe210e92dac1bb2b9776035018ac7bf0ea85e6559be103d77a55a73
MD5 f03686abb0dacdc908cce9cb8bc60e05
SHA1 96bdf5f196370529ce4f67eb62ba74dd97a5d738
SHA512 47101458ad825291d954ba7a4ba00d8545613d2b7492649adbf0022f3428c1acc7f67d26eee29b080d4de3edd5a0f9b92d98354a00ef771afa3f159a929c43b4
MD5 SHA1 SHA512

Submit Download

MsgLogStore.db-journal

Path /data/data/com.huadu.reader/databases/MsgLogStore.db-journal
Size 8KB
SHA256 a4dff46028612e1b926b11c52fd60b20745e659921fdf68a838baad6335b1fca
MD5 209a90e2f7618c3b64bb9b89c4debc3e
SHA1 2de2e9e737000aa6ca21ff102754d78d68bd5141
SHA512 1ac3da5d5ebf2630fc55ff3b2ca771df3b01f472a1409d457e8138ddf32ab08bd0aaa441b5c3846c680335a3629aba06ac552a904692376c3191ffd8303630c3
SSDEEP 6:7+/l9nJ/lgn1zllng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK8J:7+tFx0pqLiuWdwRmBEyPbf
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db-journal

Path /data/data/com.huadu.reader/databases/MsgLogStore.db-journal
Size 8KB
SHA256 fd79d527835ff22c85cb17f4ea22e6f1a070a404bfd79881b8efd48d30aa1367
MD5 1d14b1739afa5b03d0844002c4016850
SHA1 bad064c1ba264f6c8e8dbe1a064a19a860040020
SHA512 9c7b020785697c8b09b9d1ff24b50d2d8d413da39df901149a55e370cac5426763e7494613abdb95d82ada889e62428e885703d8c513cc72b4df058a6758cff9
SSDEEP 6:7+/l97WPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKg1RC/b:7+tZKqLJdTRmBEyPbTRSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

accs.db

Path /data/data/com.huadu.reader/databases/accs.db
Size 20KB
SHA256 58e0eeb309805e54342d5ccb3f9006751543d5a1306898dad2c09048b294153c
MD5 d95e1280cc553509d7b5b7851398db12
SHA1 121eb76ea37f3407d0f3b56392f6f67893fbe649
SHA512 f52c432894144ad581d36d447ed61ac50485dbc931ddd9b2ba5ce399642dcb361502e6492f28e05dc7cdbd5f19126bbc6cc09e62586b73bf449da950a6de1284
SSDEEP 12:TLgm//UyNTSFbyBh43R90Ef7c7VDERmBEyPbAVOwG:TLgoBqj0W7yVD/GSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

accs.db-journal

Path /data/data/com.huadu.reader/databases/accs.db-journal
Size 512B
SHA256 f1b7bd68f482abc84c1a7312ff9007494f125f5aabcb496c8677d026a9709652
MD5 279811d5d29b4dced32db95d7450c506
SHA1 642326855d31b38b2ddc8127f5b2c210751c60ee
SHA512 770baf967c4eef034a714b06b3238444e6efbf33df224a72562a5caecdb399d7d66e38fc9282caa6fbb08bae9b5c119ee748be92793d9ae9dc30b9297df110c8
MD5 SHA1 SHA512

Submit Download

accs.db-journal

Path /data/data/com.huadu.reader/databases/accs.db-journal
Size 8KB
SHA256 1212fa46306624e4b405774382df2d1ec88f925bc3652a37fd35ef4aa1a52e6b
MD5 83d803e3237b3344d986548347e8a593
SHA1 bcc76f10acd6397fa137ff1a06e5692616d0f73b
SHA512 c57a5777d35903abdd83dae26cae3e7524803f35260a4cbdb863824ee3a1106ae26a25724739c668c8c580f2e6d6662ddeb2dd556f5d1585726614221316d466
SSDEEP 6:7+/l91iFn1Rg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK+:7+t/i9qLiuWdwRmBEyPbl
MD5 SHA1 SHA512 SSDEEP

Submit Download

accs.db-journal

Path /data/data/com.huadu.reader/databases/accs.db-journal
Size 8KB
SHA256 134400641d6bc3d9e5f91b5889071d8e45173ec8d3ef28f06d9279179816068c
MD5 52051dbb21d84cd87baa132f260153af
SHA1 28c5545c0f62023bd163c0bc317a2d841e6ada4f
SHA512 1c5b34cdb7ee86a5c2e0cf387401941aca17eb5560379b91f749eec38c8a5d31a065ea1ea1cdb3d8208576847253cc9deb2f0610593d4793aeaa53051c336558
SSDEEP 6:7+/l97llGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKW/y//dR:7+t3wqLJdTRmBEyPbNyXdR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 3d95bf8131caf558975ea22d6edfb76859b7c944346309ff6fa1d18aa7d168f1
MD5 3c864a43035bd51051462d23c1d33394
SHA1 8e042d3b0d92df5ba44f05aa06e00d88b2a8bccd
SHA512 f7448cfa75d7ad532cbe36d4ada07ba6590f2a8b423b3c4e5abc0a74f191672d5f2d659a6a6e5e829d25a6830874abac6f8cad3c17f09eb8b98ec3d0d03970ff
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 213B
SHA256 3421c2c47f0c60f4a45e60b19814faf02ccf4a4b4a1a44323a3b77f042e48c95
MD5 73394f5a3605add0b78d8f7e221d7257
SHA1 99446bcb5e387b3d2d76f36a3ce563e9b80669d9
SHA512 b119da1b4d294ba867050cff112776ec5ece5989be12e3461f30d4fa0d531f9118fefc825698d6e17882852474a7dc6f3b309bb9ff64152d73615bd85ba0f4bc
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 558ccc7256af4ab0eebf085675046357eff11effed004ef8415d863279988b88
MD5 e51fe88bd5f61b1797ef4cf6a0ef6b69
SHA1 a04912e1b13aed77da35e946eb68dac1ef806fb1
SHA512 3afa53b61d8fabf1d7b68a7a952d1c1d88f6b4b9e5d900d0dd33fe4ce351e1de0547a10bed7d5d05e522c464d0b360fa2e62b018bde9f3dd3c9759db7be54e03
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 167B
SHA256 883c564b990d2254cc6bd95b5b6bd1751471e4e8fb98cae2a15e83ae03af0288
MD5 9a37477d1ee9cf2e2a45c7456bfb1fdf
SHA1 0a65c52cc12f1942ed6ea586eb13e11639da3b80
SHA512 9961f4e54e7997641f63cef3d1906e6442a4ea5806d5f3cd79c3e7ab8f073c23a61f32ea746073776548f891783f985d315c848dcf5c7769cbe907ef75fbd90b
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads