Analysis

  • max time kernel
    163s
  • max time network
    186s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    05/06/2024, 09:22

General

  • Target
    97bb0da84c21fb1d4cf3db17ef4f7355_JaffaCakes118.apk
  • Size 19.8MB
  • Sample240605-lccc7scf72
  • SHA256 76235c8876fc40f85932cefb19b73bc097ea2e800201deb82436fd2ba8c5d761
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.video.newqu
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4263
    • /system/bin/sh -c getprop
      2⤵
        PID:4441
      • getprop
        2⤵
          PID:4441
      • com.video.newqu:xinqu_process
        1⤵
        • Queries information about running processes on the device
        • Queries information about active data network
        • Registers a broadcast receiver at runtime (usually for listening for system events)
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:4305
        • cat /sys/class/net/wlan0/address
          2⤵
            PID:4517

        Network

              MITRE ATT&CK Mobile v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              1002

              • Path /data/data/com.video.newqu/app_crashrecord/1002
              • Size 225B
              • SHA256 7f57d1ecba139efb0fcd53481c9c32888fb82b02cafb25de56391ac7cfcf7925
              • MD5 SHA1 SHA512

              1002

              • Path /data/data/com.video.newqu/app_crashrecord/1002
              • Size 58B
              • SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
              • MD5 SHA1 SHA512

              1004

              • Path /data/data/com.video.newqu/app_crashrecord/1004
              • Size 225B
              • SHA256 87594ac3215b35694a01f0f67861cd1b3ab4e902fc2a3d92c3a4385ff117781f
              • MD5 SHA1 SHA512

              1004

              • Path /data/data/com.video.newqu/app_crashrecord/1004
              • Size 132B
              • SHA256 9a255709538874f4c9ca3ba8385b6716abe7c66baf6f77dc0ae1124b4f89df6d
              • MD5 SHA1 SHA512

              gdt_plugin.jar

              • Path /data/data/com.video.newqu/app_e_qq_com_plugin/gdt_plugin.jar
              • Size 241KB
              • SHA256 2f92b98f55c7d4417dff3fc2af9245c66aad3ab8be65177954ed7a4f13bae20d
              • MD5 SHA1 SHA512 SSDEEP

              gdt_plugin.jar.sig

              • Path /data/data/com.video.newqu/app_e_qq_com_plugin/gdt_plugin.jar.sig
              • Size 180B
              • SHA256 c472a28f62581d5fb4bfe8958289e9b4c42b4bc1593241a251356028bfc4fe26
              • MD5 SHA1 SHA512

              update_lc

              • Path /data/data/com.video.newqu/app_e_qq_com_plugin/update_lc
              • Size 4B
              • SHA256 0c030586945fe504b604ecc2e875c38ede400cd5cd73da9730302162e6b02c6f
              • MD5 SHA1 SHA512

              update_lc

              • Path /data/data/com.video.newqu/app_e_qq_com_plugin/update_lc
              • Size 2B
              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
              • MD5 SHA1 SHA512

              ua.db

              • Path /data/data/com.video.newqu/databases/.ua/ua.db
              • Size 4KB
              • SHA256 2a3c863e8a1f47e7ae69c9e55dcd8d1d9da7e80426006e640422ffa71daba29c
              • MD5 SHA1 SHA512

              ua.db-journal

              • Path /data/data/com.video.newqu/databases/.ua/ua.db-journal
              • Size 512B
              • SHA256 59bf7359093916fcd1deee4d572d9b5f50ca6c0324fbac412d455be0c4a810d7
              • MD5 SHA1 SHA512

              ua.db-wal

              • Path /data/data/com.video.newqu/databases/.ua/ua.db-wal
              • Size 16KB
              • SHA256 0520f43a34b85b943856044ee879f13e20b070c92fb8aa2433a2152025c042f3
              • MD5 SHA1 SHA512 SSDEEP

              ThrowalbeLog.db-journal

              • Path /data/data/com.video.newqu/databases/ThrowalbeLog.db-journal
              • Size 512B
              • SHA256 253c4fda64fa4b022341153dd04020939e1bc6a49f1eeb552f0d5518bbeb7b43
              • MD5 SHA1 SHA512

              ThrowalbeLog.db-shm

              • Path /data/data/com.video.newqu/databases/ThrowalbeLog.db-shm
              • Size 32KB
              • SHA256 533dfb438c8c73c184ce78a20af4691ddcba507c52d42a9c250e58968323f1c2
              • MD5 SHA1 SHA512 SSDEEP

              ThrowalbeLog.db-wal

              • Path /data/data/com.video.newqu/databases/ThrowalbeLog.db-wal
              • Size 32KB
              • SHA256 acaca91e44d43b6287b632982c09a276a2928edbc5783c5d005c89298b30adb2
              • MD5 SHA1 SHA512 SSDEEP

              bugly_db_

              • Path /data/data/com.video.newqu/databases/bugly_db_
              • Size 4KB
              • SHA256 1c372ccb20b32c66faee752c59f1f2914c4eca85acb396832cc40883109f9c84
              • MD5 SHA1 SHA512

              bugly_db_-journal

              • Path /data/data/com.video.newqu/databases/bugly_db_-journal
              • Size 512B
              • SHA256 658043a0e325568e9093b4db7e5a105ff35bd24ac7b5b498c0aad4b803b1f0c0
              • MD5 SHA1 SHA512

              bugly_db_-shm

              • Path /data/data/com.video.newqu/databases/bugly_db_-shm
              • Size 28KB
              • SHA256 f7a93a3faeecca2398b5ebc189914f935e5f56980d03b0bcac8f1ddbe7c52e0a
              • MD5 SHA1 SHA512 SSDEEP

              bugly_db_-wal

              • Path /data/data/com.video.newqu/databases/bugly_db_-wal
              • Size 72KB
              • SHA256 3c1dcbef2874be6f41aba33da5a437d29cf9ecd8eea798231ce0f30142b1b77d
              • MD5 SHA1 SHA512 SSDEEP

              cc.db

              • Path /data/data/com.video.newqu/databases/cc/cc.db
              • Size 36KB
              • SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
              • MD5 SHA1 SHA512 SSDEEP

              cc.db-journal

              • Path /data/data/com.video.newqu/databases/cc/cc.db-journal
              • Size 512B
              • SHA256 90e83156b348d5f0edd87846ef684c389b37bd680dd90d137663db0be13cface
              • MD5 SHA1 SHA512

              cc.db-shm

              • Path /data/data/com.video.newqu/databases/cc/cc.db-shm
              • Size 28KB
              • SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
              • MD5 SHA1 SHA512 SSDEEP

              cc.db-wal

              • Path /data/data/com.video.newqu/databases/cc/cc.db-wal
              • Size 48KB
              • SHA256 eda41041108f30aa7e45099bfe8e3d25736bac78c4def01b1726981ea330222b
              • MD5 SHA1 SHA512 SSDEEP

              xinqu_data.db

              • Path /data/data/com.video.newqu/databases/xinqu_data.db
              • Size 4KB
              • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
              • MD5 SHA1 SHA512

              xinqu_data.db-journal

              • Path /data/data/com.video.newqu/databases/xinqu_data.db-journal
              • Size 512B
              • SHA256 227df12149daefe4733da52116fcde6bd23327c2c1e0f729b1cfa055192f55e1
              • MD5 SHA1 SHA512

              xinqu_data.db-shm

              • Path /data/data/com.video.newqu/databases/xinqu_data.db-shm
              • Size 32KB
              • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
              • MD5 SHA1 SHA512 SSDEEP

              xinqu_data.db-wal

              • Path /data/data/com.video.newqu/databases/xinqu_data.db-wal
              • Size 56KB
              • SHA256 e34c4801c11cfa902eb9a301ab65e7d3546167c64b2ba9b275fa7c9c3f7f19c6
              • MD5 SHA1 SHA512 SSDEEP

              jpush_stat_cache.json

              • Path /data/data/com.video.newqu/files/jpush_stat_cache.json
              • Size 146B
              • SHA256 325d06938b4e19b0d956e9d96f6e183081f863234fd892bd824b769b567701cb
              • MD5 SHA1 SHA512

              .mn_410185822

              • Path /storage/emulated/0/Android/data/.mn_410185822
              • Size 82B
              • SHA256 97f36bba6fac1a853fc47a62ed426b46325a58a209d20a7c232641ffba4e44f4
              • MD5 SHA1 SHA512

              .di

              • Path /storage/emulated/0/Mob/comm/.di
              • Size 57B
              • SHA256 499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f
              • MD5 SHA1 SHA512

              .push_deviceid

              • Path /storage/emulated/0/data/.push_deviceid
              • Size 32B
              • SHA256 b14466aaf94bcf8e5cec27b99407da0863ec865caefa947f29dd20c81861f750
              • MD5 SHA1 SHA512