ffaaad4a8b9b5e94f940bc3ecf1f89eacf46cc31c42070a28b7f3d779a99e6ef

Analysis

max time kernel
153s
max time network
180s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
05/06/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96fad71c238431b987542105e3e18328_JaffaCakes118.apk
Size 15.1MB
Sample240605-cmaspabc7s
SHA256 ffaaad4a8b9b5e94f940bc3ecf1f89eacf46cc31c42070a28b7f3d779a99e6ef
MD5 96fad71c238431b987542105e3e18328
SHA1 cccf995cf40064f0f7ee10af45452f925feb9547
SHA512 2b58fcffdb787f73971f0cbedb877f5bd876ed202d25f4671d5fc07afb986c2899894bda44eafd24094f01406676f1653fb81241fe53315cb2062499ed5f20af
SSDEEP 393216:heUCVzw0805YwgSfZ7R6jyh74tHJpuxsM6gIKD:heVT75YwgwZrqYj
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.yiwyxb.qp19074
/system/bin/su	com.yiwyxb.qp19074
/system/xbin/su	com.yiwyxb.qp19074

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yiwyxb.qp19074
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yiwyxb.qp19074:pushcore

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.yiwyxb.qp19074

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.yiwyxb.qp19074

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yiwyxb.qp19074

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yiwyxb.qp19074

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.yiwyxb.qp19074

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.yiwyxb.qp19074

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yiwyxb.qp19074

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yiwyxb.qp19074

com.yiwyxb.qp19074
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4277
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
  2⤵
  PID:4464
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
  2⤵
  PID:4487

com.yiwyxb.qp19074:pushcore
1⤵
- Queries information about running processes on the device
PID:4307

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

RKStorage

Path /data/data/com.yiwyxb.qp19074/databases/RKStorage
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

RKStorage-journal

Path /data/data/com.yiwyxb.qp19074/databases/RKStorage-journal
Size 512B
SHA256 99f04eb3095b903e1ac2e6deeadf8e411275e78e7ba02ef0da8413b97b936967
MD5 4fc42e62d259d3836b06871c67773e4d
SHA1 c979dbb6f2176975e834dbdad49d7649e9ae6b26
SHA512 9b7a88224e184f6b70c34066e8d13b183629624f82bb35093148f3f341fa227ed2f3e25f89bcddc52afd80f3e4df8ac8cf5edd46f77ee623fff7aa25781ce9f7
MD5 SHA1 SHA512

Submit Download

RKStorage-wal

Path /data/data/com.yiwyxb.qp19074/databases/RKStorage-wal
Size 72KB
SHA256 83ae3ed5d91912574d9529a3ff32d6e1a04b1406bd7c4812ea919f40180223b0
MD5 19d48c18fbc6e1de5822284e661b8fc7
SHA1 2e2456945fe395c8269950b7768261f45b88d3da
SHA512 f7a0b181eaa55e312ca845230199dccd8977d5804304b2cea27efa123508dc289202fac1172a2595dcb2fed8193782ed880bfeabd9cc195fd1b1781e8a40c7b9
SSDEEP 48:BzNSP/Z59YiG75WxSP/rR+XZ89IHSEjoXf7jITxdjeZJfifdjULZW:V0PhHwPTnEM7IdQfudYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db

Path /data/data/com.yiwyxb.qp19074/databases/ua.db
Size 36KB
SHA256 1e17860bba2bb4e3e92df3890aa6dddc973d6602c71519a15556d37bb69de2a1
MD5 0adda9c85a5e4808f5b1b74c0a8591a5
SHA1 5048107883ab1e345af9cf2e6849ce46e0e612bf
SHA512 646061d3d5849772511bd94e36ca2d775a9a672851629d1812942ec0f0f925714eb7d4ebac44889911320cb6710a2f586014f6b1e126739cab653c4f8deef2d1
SSDEEP 12:TC+/ZapgPBuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPb8FOwIQQQ:TpoiD4PPvP/BlmqygGSgIQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db

Path /data/data/com.yiwyxb.qp19074/databases/ua.db
Size 24KB
SHA256 93a31d99c6a16068546aaf1dbfa7291a42fb32b084e1d2ff0ffd6a68c97e0125
MD5 fbf6c440208f6f0d4b23b7b39ccfd643
SHA1 9af104408377256374b9aa5e3d3f45e0c0973604
SHA512 c531c6f8dda373c5fe83b57a8b0bb6e68fac11a836c8b14e834dd6db59c085adc820e5306ed0f7679f5ac037e414d3fc58096317ab93a0fff44f93b595079b10
SSDEEP 3:pqAt/r4l/mgPv9WyTSQqi9sq5kt/+cqPv9Wyvl/qqW1leGn:pqAjo+gP8ymQqi9sCktWcqP8yF0Pn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.yiwyxb.qp19074/databases/ua.db-journal
Size 512B
SHA256 0d6faa23415b39a2ef4e6f8a4e1982ba820d31a54489966f3dbf582ca3964d2f
MD5 90df2203a2d26a06fdbe89a6e156723c
SHA1 15f789126551e09831f681ed275571946522a27f
SHA512 2e555aba0a201e63a81608148d6fe60df1ee3224bfb1d99f2e2961425d71a58735f8a73b1160dd69f48d87bac9c9bcb562d5043e9af8cac279fc913d2e56474a
MD5 SHA1 SHA512

Submit Download

ua.db-shm

Path /data/data/com.yiwyxb.qp19074/databases/ua.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-wal

Path /data/data/com.yiwyxb.qp19074/databases/ua.db-wal
Size 48KB
SHA256 4f9896fe9e6cfd0c2a1929273e8bf50257fd4d5e227d47eb06dcc6791003115f
MD5 74e78944cff72e09948db452043f1e87
SHA1 fabb1d633f41aea20597a1c27130085512b2f000
SHA512 5e8dc7ad277352a0c0ce61915894f1767031dfa9bbadfe6aaec09919fca58b42db8c3bcce5dcdb3e6ab8821af15ce2686c3337359401d7ae61b1b94ed3fe0dd5
SSDEEP 24:K+L4zyGSP/LsQy2V7OpoiD4PPvP/BlmqygGSP/9EE:1L4zNSP/Lsv+KWvf8SP/7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-wal

Path /data/data/com.yiwyxb.qp19074/databases/ua.db-wal
Size 12KB
SHA256 0e02faf8e6dd187279dcfdf9b1b51c841d4f531c7a6bba141aad695270e739c6
MD5 36226d7909b9f07ca3df90b0eed81b23
SHA1 8a29bf00c2b59b8f781465353ef77881ab00f6f3
SHA512 96acfb4efaab762a44e0a8d4fae1a417b233fadfe09d28e05656fe2ea035652316aa48efe3a61c8a8cd7e07339d039c90338bed6032d48ac3fddc34ecbb7647d
SSDEEP 6:K5Fdzjo+gP8ymQqi/+Ru3vCktWcqP8yil2hWaPn:Kl/o+fNyD3qzclt2h/Pn
MD5 SHA1 SHA512 SSDEEP

Submit Download

a==7.5.3&&1.0.0_1717553492063_envelope.log

Path /data/data/com.yiwyxb.qp19074/files/.envelope/a==7.5.3&&1.0.0_1717553492063_envelope.log
Size 1KB
SHA256 f94dbcca6cb0926c35c335bea856db2ebd7d1fa461f861c7f505911a3ec06526
MD5 2bccfc2508456a9f3ae5c5d1f945f4f2
SHA1 22b229e62ead79e235a599ff939fe5a3af7a6184
SHA512 0dbebab3e006aa3ad08e96b0c705b062d8c4d244f8bf0795c801f6cadd78e7e8ec39fccd092ac580929c8147a392d96ec72c58db7a54c09ab7a6ce58c6dcd729
MD5 SHA1 SHA512

Submit Download

i==1.2.0&&1.0.0_1717553493230_envelope.log

Path /data/data/com.yiwyxb.qp19074/files/.envelope/i==1.2.0&&1.0.0_1717553493230_envelope.log
Size 2KB
SHA256 801e5fb49c587da412b74a5a8c4e155e87a70b08fe5f27af23bd25b3655e02e0
MD5 f347ec5e5eade45a9e45c1129f8e0b17
SHA1 5427d66cc7a2fc4e950a10b488930bfde7566b64
SHA512 7d608c7c14e2d8360dc468df12faf19d7ac7da4fff6decbd5aae331309f8352a69d3bee057fe4471b7c121b89cf6443a5580698f1f07c984c4ad9560382ea1f4
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.yiwyxb.qp19074/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 881bbcb9d8f9271c168596faa088949e14bd198594f6d7bbe46a02cf6581414d
MD5 7e27dea64c538b6a7d76d973c9cabd88
SHA1 c63a7fa6f9c836dbcd47af8cb4f8e8fae675875f
SHA512 ed11f6838c334d7c926574a8c9e2305000a1d8a6c27a251cf10ad120b42823e336d90430c5c0ffee38e85acf02086d600323cd7bfdd9114a32c6daca586ddda9
MD5 SHA1 SHA512

Submit Download

exid.dat

Path /data/data/com.yiwyxb.qp19074/files/exid.dat
Size 67B
SHA256 cf6ec37d328ad55dfaf46158e91c214b7a95e9e16e1f737cebbb170e22912b56
MD5 28a399fbcb3803049b321140a060ab48
SHA1 60d433134a45720f37d8ae8530081fc7168e1a83
SHA512 08bbce85e9c647f8b2c65157a223c0671889234b1848febfe18c2a2bf50a7f2b034a57cabca0f9679d292e980d7b08784b43a846f70d3d734bbdd1e2bb9e12c6
MD5 SHA1 SHA512

Submit Download

dW1weF9pbnRlcm5hbF8xNzE3NTUzNDkwNjY4

Path /data/data/com.yiwyxb.qp19074/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE3NTUzNDkwNjY4
Size 1KB
SHA256 6c0f7fdb658783990af45aa722cad06c0f886c40b97b9f7760731fc09053e46c
MD5 614e664f5b0ae166be6d01bccc2f552d
SHA1 cb01ac9ec6e58d2bdc70a41022733e553ef48078
SHA512 77dfde27945f085166c08f5b4b528d5140f0e2e681bdd79ff6a7552274660f1c7ef6863d856658b8be002bfffeb405fa31352dd811f3f9beaf0b560664d0ba99
MD5 SHA1 SHA512

Submit Download

dW1weF9pbnRlcm5hbF8xNzE3NTUzNTIxMTk4

Path /data/data/com.yiwyxb.qp19074/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE3NTUzNTIxMTk4
Size 1KB
SHA256 8bbce6b30cf1009a5d647ef02d5f43cfe12ba8262eb331e528302911af728989
MD5 4044569dff98143080963e34886bc8fb
SHA1 ab4ce897bc31d5bcd0ae16a835f5edab4d708134
SHA512 b5045e04201038301b6ca218db6a5cfe7b395df24456cfd7968bbd9a389a1a0d58f3625020dd3e525091ec1b3a8d5fa3548b11cbdef6043a010ab4405af26689
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.yiwyxb.qp19074/files/umeng_it.cache
Size 415B
SHA256 9e4c89e5bd91972d75acea100a471bab5e8b4dff41e05a29b6d0152e49ecaa63
MD5 6448bc638d67dbd9c38265a86d43b53d
SHA1 5c077c1c4f44b2b2271c1d418ebc7406f884bb9a
SHA512 2c3b18b4d0a5d1392af7c67c7f15fc4822e6d548202d41ab636440b588780c86bd59e26539724cfa7ee47bea878e16128594058bda77e36d380c8c7242e7ff0e
MD5 SHA1 SHA512

Submit Download

dso_deps

Path /data/data/com.yiwyxb.qp19074/lib-main/dso_deps
Size 144B
SHA256 e0ed7ca7cbb4c376759b04a024cba51b97b7c2392626e492e67dd3aa32765990
MD5 6acf6efb9216815ac918347fede17d62
SHA1 7920f527b7f2ac2ab327b732f6f22759e69e8be2
SHA512 6c58392180514461a2feff11fe798bfdebca04e1c8714d6ffe3aa031e5e7382c35f9e9dc3337079ce7a9490401d947bb9db709f3fe156c7ada0fe12a6ccc0fb3
MD5 SHA1 SHA512

Submit Download

dso_manifest

Path /data/data/com.yiwyxb.qp19074/lib-main/dso_manifest
Size 5B
SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
MD5 c06857e9ea338f3f3a24bb78f8fbdf6f
SHA1 c5a0a2529d2deb60fec041b4fbd722a2ebe31702
SHA512 29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1
MD5 SHA1 SHA512

Submit Download

dso_state

Path /data/data/com.yiwyxb.qp19074/lib-main/dso_state
Size 9B
SHA256 1082d20ff43ce9c14b76f4975471aab4bf15ab6ba7cc9d408fde4ac1135aecb4
MD5 33445f78093dfc1305bcea16d842bb13
SHA1 f561b1bf42b618784c779c75cad63d4b23eefecf
SHA512 3bc1a71724465bb6a44d3005a2db205ee0394d1ca7f6b66ceb86864b0a31d26f357043102b9671e6dd7e10a62ce61919740ade99575db6e8ef8c926b82c05bb4
MD5 SHA1 SHA512

Submit Download

dso_state

Path /data/data/com.yiwyxb.qp19074/lib-main/dso_state
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads