Overview

overview

8

Static

static

6

972c84cc73...18.apk

android-9-x86

8

972c84cc73...18.apk

android-10-x64

8

dmss_v2.apk

android-9-x86

dmss_v2.apk

android-10-x64

dmss_v2.apk

android-11-x64

dump.apk

android-9-x86

1

dump.apk

android-10-x64

1

dump.apk

android-11-x64

1

dynamic.apk

android-9-x86

dynamic.apk

android-10-x64

dynamic.apk

android-11-x64

Analysis

  • max time kernel
    171s
  • max time network
    190s
  • platform
    android_x64
  • resource
    android-x64-20240603-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
  • submitted
    05/06/2024, 04:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    972c84cc7340c69520148f5b453be0f7_JaffaCakes118.apk
  • Size 6.7MB
  • Sample240605-evb2tsdh3t
  • SHA256 d643112f70de2223d525d6f353495dea07fb03cfbd0ab9a19d8a4f84f048d682
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bankercollectiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    evasion
  • Checks known Qemu files. 1 TTPs 6 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

    evasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Requests cell location 1 TTPs 2 IoCs

    Uses Android APIs to to get current cell information.

    collectiondiscovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about active data network 1 TTPs 2 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
    impact
  • Checks CPU information 2 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.qihoo.appstore
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5056
  • com.qihoo.daemon
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:5120
  • com.qihoo.appstore:critical
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5395

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        360appstoreInstallHistory.db
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db
        • Size 28KB
        • SHA256 c48a18c175de831a21353fb0bdf0d3e43b83ba7655982152df5cf0100b2bf37b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360appstoreInstallHistory.db
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db
        • Size 28KB
        • SHA256 442847f7a12c988f83a674323cd5da163d5ec79152b658abe27baafbf70935c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360appstoreInstallHistory.db-journal
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
        • Size 512B
        • SHA256 748e593c651dd62b10d27b1e5835368e09baa01910b9fdaf390476bcecbe69a5
        • MD5 SHA1 SHA512
        Submit Download

        360appstoreInstallHistory.db-journal
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
        • Size 8KB
        • SHA256 a1b8ba10bb509aa05c19c9411c3098dda7e980ad2f1d4709622d8202a18c5a60
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360appstoreInstallHistory.db-journal
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
        • Size 8KB
        • SHA256 22c085b167eddfd50f91d192dae66b4ec933acb5417e27b86448a63095dd64b0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360appstoreInstallHistory.db-journal
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
        • Size 12KB
        • SHA256 8f97cfc030d51028f36e4058412d3feff0ebecda8262f6db426eb0958a367bf9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ire
        • Path /data/data/com.qihoo.appstore/databases/_ire
        • Size 12KB
        • SHA256 a9b2f6227429fd83edc4db9e62c5e3f8c45b55598f7b10c3132d6b339283c8d2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ire-journal
        • Path /data/data/com.qihoo.appstore/databases/_ire-journal
        • Size 512B
        • SHA256 32374981d221bd213de743631203191cf8f5cf120faac59c5b56aec8ac21057e
        • MD5 SHA1 SHA512
        Submit Download

        _ire-journal
        • Path /data/data/com.qihoo.appstore/databases/_ire-journal
        • Size 8KB
        • SHA256 4c4d5a58cbea0340e61a2285fd2f9740a2cd57f4f29c6dea80323cc14df64b83
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ire-journal
        • Path /data/data/com.qihoo.appstore/databases/_ire-journal
        • Size 4KB
        • SHA256 90ec1d31ab0055478da9e659414a036f62ca6c2c97d0000496dae7d46df0cf83
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        account.db
        • Path /data/data/com.qihoo.appstore/databases/account.db
        • Size 28KB
        • SHA256 ae606221ff789289e1c69cd9f79ee035d1c587a96d556ad8ac6ee91fe6741041
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        account.db-journal
        • Path /data/data/com.qihoo.appstore/databases/account.db-journal
        • Size 512B
        • SHA256 b217c69248aaffe76fb8335f5bb1a24c8066e838f447c465316c28fe9c201f95
        • MD5 SHA1 SHA512
        Submit Download

        account.db-journal
        • Path /data/data/com.qihoo.appstore/databases/account.db-journal
        • Size 8KB
        • SHA256 21e19fc56e2bb355ec8b86efff6d47f08fa0df4256ccf89ff02cb45ee94f9030
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        account.db-journal
        • Path /data/data/com.qihoo.appstore/databases/account.db-journal
        • Size 8KB
        • SHA256 996a10f0936cd7c5a285ebb4af589294400646672c306f2e81064b84353e4907
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        download5.db
        • Path /data/data/com.qihoo.appstore/databases/download5.db
        • Size 20KB
        • SHA256 d3ac468ba80900c4780701925d0a9b119be2317ba08a41b5c7084965195d56ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        download5.db-journal
        • Path /data/data/com.qihoo.appstore/databases/download5.db-journal
        • Size 512B
        • SHA256 2ea7c88bd1f5dd749cb96dc5a875e4f8e378143c9357868dbba43528a7a54696
        • MD5 SHA1 SHA512
        Submit Download

        download5.db-journal
        • Path /data/data/com.qihoo.appstore/databases/download5.db-journal
        • Size 8KB
        • SHA256 7b34ed1ddc307465f70840966942880db99fccc5d4cf428818a7bb46ff1f6fec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        download5.db-journal
        • Path /data/data/com.qihoo.appstore/databases/download5.db-journal
        • Size 8KB
        • SHA256 f492ed90e376cbef185996e3141a8cb42120ce44afad0e2f1c00289a7343d025
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        filelist.db
        • Path /data/data/com.qihoo.appstore/databases/filelist.db
        • Size 20KB
        • SHA256 805f1b0b48abb9672155ac88aa619597c1b6065b8588908d2144dcdffbce75fb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        filelist.db-journal
        • Path /data/data/com.qihoo.appstore/databases/filelist.db-journal
        • Size 8KB
        • SHA256 cd34c195205d53a85d079022372836719e852a39303cc23201ffa91bfacd3986
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        filelist.db-journal
        • Path /data/data/com.qihoo.appstore/databases/filelist.db-journal
        • Size 512B
        • SHA256 148b7543ef8a834f56cdbc0d7fa5511480785e3893439fc64d5a0cdddcad5bac
        • MD5 SHA1 SHA512
        Submit Download

        filelist.db-journal
        • Path /data/data/com.qihoo.appstore/databases/filelist.db-journal
        • Size 8KB
        • SHA256 280d2daaadbff8f3e75b93d0ec73a3d618ce4184595b7c9a7e52a9414b12b08f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
        • Size 12KB
        • SHA256 885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
        • Size 20KB
        • SHA256 ec21c5db01d91ef738a7d990bcd11337bae4b475d9127eb5675657c68e881676
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
        • Size 16KB
        • SHA256 c7f6ba4fe586c85516bbefb4e5702ce81e8b5b573f413fc5304f38f2dab69c3f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db-journal
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
        • Size 512B
        • SHA256 fe374586da0b0a0359bc00c17ef6f6aebfe8aa5415397700120094422394875b
        • MD5 SHA1 SHA512
        Submit Download

        ignoreupdate_appinfo.db-journal
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
        • Size 8KB
        • SHA256 2444615a61cdad73440911664f7ca921726a59128007813d4b04e7ab38393a20
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db-journal
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
        • Size 8KB
        • SHA256 1265ee7c9c5fc43d54a4952712904ece020b5220369830447045f5d20218e807
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db-journal
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
        • Size 4KB
        • SHA256 520fa540f54cd525636c2e2b13f99720d566c8dce9950820de2007a51e50d24b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db-journal
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
        • Size 8KB
        • SHA256 a6d70275652f8f03d2528624098e7e0807a6d19811cebda89441dc1b32f502c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        new_downloads.db-journal
        • Path /data/data/com.qihoo.appstore/databases/new_downloads.db-journal
        • Size 512B
        • SHA256 7d557db6837ce2242d44283e788861c0c53d6171e6cf4b30f39195f6ef53b256
        • MD5 SHA1 SHA512
        Submit Download

        new_downloads.db-journal
        • Path /data/data/com.qihoo.appstore/databases/new_downloads.db-journal
        • Size 8KB
        • SHA256 03bf03163030d39cff2a1332f82c183c644e2163812f3a5153936d9559587d94
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        update_history.db
        • Path /data/data/com.qihoo.appstore/databases/update_history.db
        • Size 20KB
        • SHA256 fc8213a10a4907987570701d47828767ffd9517ac55111519fb6c909b015ec7f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        update_history.db-journal
        • Path /data/data/com.qihoo.appstore/databases/update_history.db-journal
        • Size 512B
        • SHA256 f384c62370a4c81dc3c0c9e0f77750157a6036ed820bf7c508cf366c3270c236
        • MD5 SHA1 SHA512
        Submit Download

        update_history.db-journal
        • Path /data/data/com.qihoo.appstore/databases/update_history.db-journal
        • Size 8KB
        • SHA256 7ac699324b8f83a565599b683afe54663740bc64ebadaf96f4b358c2ad421d1c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        update_history.db-journal
        • Path /data/data/com.qihoo.appstore/databases/update_history.db-journal
        • Size 8KB
        • SHA256 96775794ca921863ecb2f439f9eb34dae3aa6b85304fe232acf11d532c6662e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 508B
        • SHA256 c89940fe489ea92bcd8e6b62a4458480af486368bf2a83113f6150e92a07d540
        • MD5 SHA1 SHA512
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 520B
        • SHA256 20d380e1c6e4f286bb9c013bbf806e3cb4d2fab47693f503dce85aa36c0576bf
        • MD5 SHA1 SHA512
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 544B
        • SHA256 cf1db2d42939298a1331ff5387cfedc0abcac5863055ff7d97fb9d04c724cc66
        • MD5 SHA1 SHA512
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 1013B
        • SHA256 4ffa186c5d75dac252fe345881632ea4309b06a3fb221d0ab354d10c4742fe5b
        • MD5 SHA1 SHA512
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 1KB
        • SHA256 dd644a5adfdfbf8c9572f49302fcdf097aef66f2016e4c77d74b053ee718b093
        • MD5 SHA1 SHA512
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 1KB
        • SHA256 e51d98a268b06dffd81d594f6c84c6fbbf3d65e4b7cb4b2cdde793a3002a0f8e
        • MD5 SHA1 SHA512
        Submit Download

        log1717560962832
        • Path /data/data/com.qihoo.appstore/files/sllak/logcache/log1717560962832
        • Size 2KB
        • SHA256 1c866991986c4157e5ea87ac2ffb18069a33fbaf105ba9e938f4d1c0d871801f
        • MD5 SHA1 SHA512
        Submit Download

        log1717560963221
        • Path /data/data/com.qihoo.appstore/files/sllak/logcache/log1717560963221
        • Size 596B
        • SHA256 3bd7b7bfe1132b7e311a61bf5d8ed40402b41a9c2472ebcf079b69fd91fd7647
        • MD5 SHA1 SHA512
        Submit Download

        finalcore.jar
        • Path /data/data/com.qihoo.appstore/files/sllak/opt/5056/finalcore.jar
        • Size 77KB
        • SHA256 a9707dddcbc66a678700e085fae5f9a1e6707eca3b2696da69ab810af9551e49
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        finalcore.jar.tmp
        • Path /data/data/com.qihoo.appstore/files/sllak/opt/5056/finalcore.jar.tmp
        • Size 77KB
        • SHA256 82fecb66917adc4250ff1ffe98859f64a41a21ec6a5ae04cb7b6b21679525a7c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        finalcore.jar.cur.prof
        • Path /data/data/com.qihoo.appstore/files/sllak/opt/5056/oat/finalcore.jar.cur.prof
        • Size 512B
        • SHA256 0b845dec37de9926614c28e54383baaacc9315a7ec8006a27163c2ec0a2941f2
        • MD5 SHA1 SHA512
        Submit Download

        localApkInfo.json
        • Path /data/data/com.qihoo.appstore/localApkInfo.json
        • Size 94KB
        • SHA256 006ae8c37507cfb28d542a981c002bedbed28f980f30ea64be6372ec46ffbe43
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        finalcore.jar
        • Path /data/user/0/com.qihoo.appstore/files/sllak/opt/5056/finalcore.jar
        • Size 176KB
        • SHA256 536678202267f95d80480f15065e784d7ec609922a0963d935e9c5a4b0f62bef
        • MD5 SHA1 SHA512 SSDEEP
        Download

        .sfp
        • Path /storage/emulated/0/.sfp/.sfp
        • Size 83B
        • SHA256 9df1b10a8872855524b119062bdce2d7626e3718400f773ed1018ea380a37bcc
        • MD5 SHA1 SHA512
        Submit Download