Analysis
- max time kernel
163s - max time network
186s - platform
android_x86 - resource
android-x86-arm-20240603-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system - submitted
05/06/2024, 09:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
97bb0da84c21fb1d4cf3db17ef4f7355_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
gdtadv2.apk
Resource
android-x86-arm-20240603-en
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
gdtadv2.apk
Resource
android-x64-20240603-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
gdtadv2.apk
Resource
android-x64-arm64-20240603-en
0 signatures
150 seconds
General
- Target 97bb0da84c21fb1d4cf3db17ef4f7355_JaffaCakes118.apk
- Size 19.8MB
- Sample240605-lccc7scf72
- SHA256 76235c8876fc40f85932cefb19b73bc097ea2e800201deb82436fd2ba8c5d761
- MD5 97bb0da84c21fb1d4cf3db17ef4f7355
- SHA1 3a95c6ef79392d8d923edf015f5764c7ba603cce
- SHA512 a5ff45dd656005805903edb2fcb8df9a62ec2fbf6778320316980574d8ce1d6c662e8a80ddb60b1c179d9f40e57110f7732ad51f34579d6fe5dd9d780c716fbb
- SSDEEP 393216:ovn2Ji6oWLGhuvWsGorIhpDnQTkfZ9LQuRV0GIsgL6mO9qjBAQgU3D:o/X6oWLdWiunXfZlLAt6xthU3D
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 1 IoCs
ioc Process /system/app/Superuser.apk com.video.newqu - Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.video.newqu Framework service call android.app.IActivityManager.getRunningAppProcesses com.video.newqu:xinqu_process - Queries information about active data network 1 TTPs 2 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.video.newqu Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.video.newqu:xinqu_process - Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.video.newqu Framework service call android.app.IActivityManager.registerReceiver com.video.newqu:xinqu_process - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.video.newqu Framework API call javax.crypto.Cipher.doFinal com.video.newqu:xinqu_process - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.video.newqu
Processes
-
com.video.newqu1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4263 -
/system/bin/sh -c getprop2⤵PID:4441
-
-
getprop2⤵PID:4441
-
-
com.video.newqu:xinqu_process1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4305 -
cat /sys/class/net/wlan0/address2⤵PID:4517
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.video.newqu/app_crashrecord/1002
- Size 225B
- SHA256 7f57d1ecba139efb0fcd53481c9c32888fb82b02cafb25de56391ac7cfcf7925
- MD5 7fd990dcc102a7bbfa1c44140d33a00c
- SHA1 7147e094eafb8f2257dcd5de8b98e54da69de0aa
- SHA512 074189211b84a8d9020631ea6707e8f12b00a877e2f197e4336af96342a21e52a41fb873634b60e182dc508b14bdc04fd660d94c5b282bff53537161c123d905
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/app_crashrecord/1002
- Size 58B
- SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
- MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
- SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
- SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/app_crashrecord/1004
- Size 225B
- SHA256 87594ac3215b35694a01f0f67861cd1b3ab4e902fc2a3d92c3a4385ff117781f
- MD5 8c6f2e1b65af11c10780c2fba230f18f
- SHA1 ca6db5bd38fc6f40952dcabd3d16763459110c80
- SHA512 f77b5c78b086fdfc5466450299fdd88dacb007aa4d91d218a46eb27077947480ce8d0865bf570b3108346807591e69bd934a33606a582f421584119091f47f39
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/app_crashrecord/1004
- Size 132B
- SHA256 9a255709538874f4c9ca3ba8385b6716abe7c66baf6f77dc0ae1124b4f89df6d
- MD5 6ea1e144eba76d0978ea6e771dce9e8e
- SHA1 46a9bb90145f9213c0483b4b6b11c7b26adb0613
- SHA512 388e2a1e9e4badcc40d890e5925ee0c94fd4b570341c8446b2f449d53adbeef9a426304716cc0dc9ce9c20f545e38fcb8993dff0a286f8a3025f3557415dd357
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/app_e_qq_com_plugin/gdt_plugin.jar
- Size 241KB
- SHA256 2f92b98f55c7d4417dff3fc2af9245c66aad3ab8be65177954ed7a4f13bae20d
- MD5 b95166c2f63e536b6fc4b5b811444dec
- SHA1 45fc74323bb2e66f4c2a493b65b70e0de2aeb77c
- SHA512 65eb813d39270d83e6d43956ec139f04779dbea58e517da1727a0f4fad9de32bb4cd49bed1dc1fec31b95a95b1c653c22b327aa38cba1645330c9d256d94c087
- SSDEEP 6144:KRKhU/uUwjTCpnUjgWkiCBliWLvghUhSj4qj80Gq7JqBGK:KoUmUgenUjwBl1jgVjJ57IBl
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.video.newqu/app_e_qq_com_plugin/gdt_plugin.jar.sig
- Size 180B
- SHA256 c472a28f62581d5fb4bfe8958289e9b4c42b4bc1593241a251356028bfc4fe26
- MD5 c5c4b74691644a01ebb80730b13b8c53
- SHA1 fc00f77182e7fc0741ea567d807b5c80fe7201e6
- SHA512 8bf43c7ec5fcd6c3241644c091ab3f062cc704339408ca9fa3b9159cc17a60b872407aa74f93c8eaea944561c12ac0599f1b4bd2ad0bf41cd298d0293cafdbe9
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/app_e_qq_com_plugin/update_lc
- Size 4B
- SHA256 0c030586945fe504b604ecc2e875c38ede400cd5cd73da9730302162e6b02c6f
- MD5 dce7c4174ce9323904a934a486c41288
- SHA1 e117797422d35ce52f036963c7e9603e9955b5c7
- SHA512 d570ab6a8f4a7b54d426b0481219074b5277ace37d88438d87ab97eb387938eca1cf7b09fa42d596c56ada860710d2a7385d2a96e1cedff58ad6ed8900f1b143
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/app_e_qq_com_plugin/update_lc
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/databases/.ua/ua.db
- Size 4KB
- SHA256 2a3c863e8a1f47e7ae69c9e55dcd8d1d9da7e80426006e640422ffa71daba29c
- MD5 cee2339dcc8f4d5491592cf12d0f6d32
- SHA1 b0916e9d01428447bf9d5b9fc064c6c4e32f4ac7
- SHA512 033f54bd837d90de0aa9c9b195fb7ae1f9aabf92da72fa527439b131b45b1dbff585ef37d7087cf69122904d3d27d9b3f96be4e39d06893687ab51d9b2bd343a
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/databases/.ua/ua.db-journal
- Size 512B
- SHA256 59bf7359093916fcd1deee4d572d9b5f50ca6c0324fbac412d455be0c4a810d7
- MD5 b2328e144600f2866e87258e40221ba2
- SHA1 aff2b281ebd52709423868dd2aee8e58f7544b41
- SHA512 0f7c757f94a14df0641a48215027d600c0e92489bed726cbbbe4fb818b5ca2d33d1182c44375b56475133ba5a15b0a7a1344b3c5944b456a6bc3e20f7959c325
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/databases/.ua/ua.db-wal
- Size 16KB
- SHA256 0520f43a34b85b943856044ee879f13e20b070c92fb8aa2433a2152025c042f3
- MD5 3c64b3e506875cbb6357cc55607ee764
- SHA1 d4c7e022ac98dac9e93a680a6a62afbad86f7c5e
- SHA512 adc7236e6f0899e762b26a31b6068717a6e0b65a6c954d27d18174df7a10343506a02b68e418a53452cffb3a58c5ddea65cd513f1337d63d5f1878ad37db0cc4
- SSDEEP 12:K2TonBITzdTRmBEyPbP/gfkL2XrMrAwjM2Ow2:K2TonBuzyGSP/gfbMrAWMU2
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.video.newqu/databases/ThrowalbeLog.db-journal
- Size 512B
- SHA256 253c4fda64fa4b022341153dd04020939e1bc6a49f1eeb552f0d5518bbeb7b43
- MD5 a1773c84fa3f8da36e22884fdba791a2
- SHA1 bb7335fd5d8cf16e9855c5cf2e8b9b04f2c368a1
- SHA512 a09db660620e06d418cdb79c8ed660509eeedccc2306f86186fe87e40c4fa46b4819662f069ac1d6797629fc520e1e0eaa74befc9cb7e43fe2b4247d820133de
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/databases/ThrowalbeLog.db-shm
- Size 32KB
- SHA256 533dfb438c8c73c184ce78a20af4691ddcba507c52d42a9c250e58968323f1c2
- MD5 3110862775ba892f4615f54e7120fcc3
- SHA1 30768c918ee2c854e7ffb1065e203e82e0b5a20f
- SHA512 f240f45a54dee2afa28e5264f9e660b0ff1baa9b50b78fc96d4901163fac6d67ca882ae3ab64a8d597be593fa2f6f7d731ac8de37a33681db49bf2afaad4c5b9
- SSDEEP 3:FttTt+J17xF/1dgvAqBIrHOpqikwT3wg:XtRkxFIvAeEikwjh
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.video.newqu/databases/ThrowalbeLog.db-wal
- Size 32KB
- SHA256 acaca91e44d43b6287b632982c09a276a2928edbc5783c5d005c89298b30adb2
- MD5 0a96743ee7ac59fe58cea6fbce023bf6
- SHA1 1665a42e7520ea8ed4edac9be8d635cb0d96c0d6
- SHA512 feffcd3ee1de8e6b029f9e1918a8d8d0743cd7f7b14471c10d5351ca27d911c05090ed11d8bf68bee8a08fe6895284c1f2fad1830f54817f65d09a16fb161fdc
- SSDEEP 12:Xx3kwjKdTRmBEyPbP/KW/qDOwClbFDBOyNTSFbydJexF4bb84riiKj2OVRmBEyPz:XpQyGSP/KW/ECNTpexi+TuGSP/zlP
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.video.newqu/databases/bugly_db_
- Size 4KB
- SHA256 1c372ccb20b32c66faee752c59f1f2914c4eca85acb396832cc40883109f9c84
- MD5 52c5b571afb2582ff943594b2bfab220
- SHA1 a10ace7e9e97634e938c6236413f2aa109610831
- SHA512 c81b3e28776a0dd7815ec690ed7f5841b4e34ff0178f36671963c51d0b94784a402a37a34759bd8fdf78fef160cb50d3ceb04e859b0464b245238bc96decdd70
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/databases/bugly_db_-journal
- Size 512B
- SHA256 658043a0e325568e9093b4db7e5a105ff35bd24ac7b5b498c0aad4b803b1f0c0
- MD5 6ff5261c11e15d72f4c2ce9368034105
- SHA1 760a28fe6b100e9e5de8d50aa85fba174c0bdef2
- SHA512 060ac9c6370e11ead45699164796cfd3aee46558d9fcd4bd2d217d6c7af3df67dc193dbd0023eda8aaac2100f1834a80f832d64522e042b65abc97ce163a4cc0
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/databases/bugly_db_-shm
- Size 28KB
- SHA256 f7a93a3faeecca2398b5ebc189914f935e5f56980d03b0bcac8f1ddbe7c52e0a
- MD5 5e656122e74e9931342748cdbc08a728
- SHA1 0ea82c193c038d9136b1010dea44a1bde439062d
- SHA512 48f9bf05cfa965dc317de0247bb8923c45f27dd9d186cd61a23f992e719ff9af99663c715b2b3ad42d2a2bd862721dd73ae9c183802510386b4b4bd0d76fe825
- SSDEEP 3:GlTVzyLLZzlnjDNEFyK//lz69ll+9BbNEUQWSgRUuS00Fgill:GlT5yvZz9jhUyeiW9xNxyqw
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.video.newqu/databases/bugly_db_-wal
- Size 72KB
- SHA256 3c1dcbef2874be6f41aba33da5a437d29cf9ecd8eea798231ce0f30142b1b77d
- MD5 7b4c831af89d704fd619d73366e8014e
- SHA1 08119eda9203665d5659fdd7ec587545f2aa1530
- SHA512 281ef6d8608461a68b8cc1e255bcf51743cb0d8dac7b09f15c7eb792c95c89b7a88eb1300b3844779eb4e84dc7d1d488b8a9b5104aeadb1bf3ad8ec8cf484e6b
- SSDEEP 48:7lzNSP/2a8lW85WuAriStwwuMN5meposSP/IzRnVxIKrrOqNRo4UxIKrJ:V0Pq53AzwPgdVxIKrFrUxIKrJ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.video.newqu/databases/cc/cc.db
- Size 36KB
- SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
- MD5 5d7ea1a23af19b4340cc8d90f28297d5
- SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
- SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b
- SSDEEP 12:TCFP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQn:Tz7sL7yot3BVrHotGGSgGQQQ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.video.newqu/databases/cc/cc.db-journal
- Size 512B
- SHA256 90e83156b348d5f0edd87846ef684c389b37bd680dd90d137663db0be13cface
- MD5 278ae0c71ec06c47579b778b03dbb149
- SHA1 01c65b6d8e9ec24f6bfddf3e80163635bd78456b
- SHA512 f7f22f0a7e9222f73e6398cc6f4bfa2cdfe0f779bf2897ce3c44a60c70c1459cea60f250533b1a8a20f67fd1914616ebfefe75d7ec9ce4ac3d9825925f5c5b7a
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/databases/cc/cc.db-shm
- Size 28KB
- SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
- MD5 cf845a781c107ec1346e849c9dd1b7e8
- SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
- SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.video.newqu/databases/cc/cc.db-wal
- Size 48KB
- SHA256 eda41041108f30aa7e45099bfe8e3d25736bac78c4def01b1726981ea330222b
- MD5 36b051919f4e76935a25490a3bebca59
- SHA1 e0ed3f86664cab67a0ee375210dd357783e6631f
- SHA512 9a2be74e25253c6023223df013e24e0ae6737822ad6f47d5f7b1520de3f9fc8657e3379b5c3ff2e914e01b32f37d8614be2bb12d9b9742a604a870be347e5770
- SSDEEP 24:KwE0zyGSP/vSRRjqz7sL7yot3BVrHotGGSP//8:9ZzNSP/vfshBWfSP/U
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.video.newqu/databases/xinqu_data.db
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/databases/xinqu_data.db-journal
- Size 512B
- SHA256 227df12149daefe4733da52116fcde6bd23327c2c1e0f729b1cfa055192f55e1
- MD5 e5e25b04b9886a7a1c755d0ed2eba113
- SHA1 8582315625e648f998e52aa440eaff7b28c3ccbd
- SHA512 546451ede120916a2820e7c6a7010368d667295cbcc852879d696b81bdbd4884d7cb25d30d398b3028bb172681f3a33e207a2f72b2f02b8f8c862ce8cbd815a2
- MD5 SHA1 SHA512
- Path /data/data/com.video.newqu/databases/xinqu_data.db-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.video.newqu/databases/xinqu_data.db-wal
- Size 56KB
- SHA256 e34c4801c11cfa902eb9a301ab65e7d3546167c64b2ba9b275fa7c9c3f7f19c6
- MD5 4d13bdea30f612a3a0f2ab1267ca0511
- SHA1 f2cfcfed7fd601a969f80612ffcd74e2fd5494ef
- SHA512 1dc9319bf4ab42565974cb29fc3075f94fd8dc48d25ce835c953f7f5eac27ec02fd916b8e4d5df689d541efaf112eefe77e4be6e3931a71e917a6bc9d3267b48
- SSDEEP 48:xIGzNSP/swJidnk6uhlKdPB7Kk3wQ/C3HkAXaFyzFuToC8FVPvgpYxOzK+yESP/3:xd0PUBmM1B7KE/szDJznMYxE8Pb2d
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.video.newqu/files/jpush_stat_cache.json
- Size 146B
- SHA256 325d06938b4e19b0d956e9d96f6e183081f863234fd892bd824b769b567701cb
- MD5 09a5f591d6e503af3c2208ee405af66e
- SHA1 04f992196eae645ddae7d1dca02bca8db6d537f6
- SHA512 363df4b3bb5aaa00b8b8b7672dd06c71eb03edd220d0953ec508a66bd4975a800f1501fa24c925728a648b69b970d392874fefffc50d87bd5275b4f0a94667f9
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Android/data/.mn_410185822
- Size 82B
- SHA256 97f36bba6fac1a853fc47a62ed426b46325a58a209d20a7c232641ffba4e44f4
- MD5 e8be01a3d651b9f955cbb28d7fe2f623
- SHA1 04010f8b539c2e98c8d7b7752e9879547aa9dc0f
- SHA512 19eb61bf037bcc667e6a19773beee13011faffc9a5f8efffebddeb5e27e017bc47f26e143de5e9f471668bdd9eb445fb85afda410b065f0d3ae323169ba4b34f
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Mob/comm/.di
- Size 57B
- SHA256 499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f
- MD5 70a42cba408700f9a6c01c7941a8829e
- SHA1 eab01cc2c0671538795fb0b1146017dc099d0984
- SHA512 8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c
- MD5 SHA1 SHA512
- Path /storage/emulated/0/data/.push_deviceid
- Size 32B
- SHA256 b14466aaf94bcf8e5cec27b99407da0863ec865caefa947f29dd20c81861f750
- MD5 84dfb168baed5613154039cbd3a49df2
- SHA1 ea6f70bab5ae92c1faf0c7e5735361d942a79df0
- SHA512 cc5628e1b9695e7e0458a998a891c35aa97753903f8d050ad6e2d302ce525ed9f044d9a7852b99b7446f6126a0bc7ca11fab18a51a6c49bfc354797a5d9d1206
- MD5 SHA1 SHA512