Analysis

  • max time kernel
    179s
  • max time network
    188s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240603-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
  • submitted
    05/06/2024, 12:18

General

  • Target
    98246c745c3169d42cd5f0d230449a11_JaffaCakes118.apk
  • Size 30.9MB
  • Sample240605-pg14xaga49
  • SHA256 a2a0f87596aaa77065c3b1a4e6b3f87372ae40bd110f5ab93b701cbe1359a927
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Requests cell location 1 TTPs 4 IoCs

    Uses Android APIs to to get current cell information.

  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks CPU information 2 TTPs 2 IoCs
  • Checks memory information 2 TTPs 2 IoCs

Processes

  • com.sixrpg.opalyer
    1⤵
    • Checks if the Android device is rooted.
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4473
  • com.sixrpg.opalyer:mult
    1⤵
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4537

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1004

        • Path /data/user/0/com.sixrpg.opalyer/app_crashrecord/1004
        • Size 228B
        • SHA256 d92171aa5c4a54bf8b958a8f901f6a5c19a64a5e4d208b7224c726555c16639a
        • MD5 SHA1 SHA512

        1004

        • Path /data/user/0/com.sixrpg.opalyer/app_crashrecord/1004
        • Size 58B
        • SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
        • MD5 SHA1 SHA512

        journal.tmp

        • Path /data/user/0/com.sixrpg.opalyer/cache/uil-images/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512

        bugly_db_

        • Path /data/user/0/com.sixrpg.opalyer/databases/bugly_db_
        • Size 52KB
        • SHA256 d27b0a58a770e9ce890281cdd668632da0a9e0c00c1b0ee4cfffc312ab9e46c5
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/bugly_db_-journal
        • Size 512B
        • SHA256 00cf4988f55ff817390ad55209971569bae463c1f190c3eafe26b154449be2c7
        • MD5 SHA1 SHA512

        bugly_db_-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 bf93e098a2d8f008eb9ffd5a1e3a3093fb6218ed982d554d45ecdf891e2759f7
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 c4c8e138d54106225df67f4aab98f3eea99a2d776653541ec557ee33ab706baf
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/bugly_db_-journal
        • Size 12KB
        • SHA256 c00cd15561333c6bc193deaddae044d13e6c6731705defd1f8fa1a15f27955c9
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 293d55ea5da1c5ad06aa509bb5ff95bc13a03ed894da1f876efb1d04dd8a106e
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 fc72d0e1618de5ea6141fa50d72f53358968d87fd83e351b006a3ba0962ac5e8
        • MD5 SHA1 SHA512 SSDEEP

        com.sixrpg.opalyer

        • Path /data/user/0/com.sixrpg.opalyer/databases/com.sixrpg.opalyer
        • Size 24KB
        • SHA256 8dc3509c199dcd309579c3eea91911fb517c0d279f9826be9d177a895733ec86
        • MD5 SHA1 SHA512 SSDEEP

        com.sixrpg.opalyer-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/com.sixrpg.opalyer-journal
        • Size 512B
        • SHA256 e736ab1d80548473e2aea5c9e2454804105e16ce89dabd41767cafaf687cfeaa
        • MD5 SHA1 SHA512

        com.sixrpg.opalyer-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/com.sixrpg.opalyer-journal
        • Size 8KB
        • SHA256 c9c118151431fed64f528ec6eb682352d6d59764b767ac99269cf3120db113d5
        • MD5 SHA1 SHA512 SSDEEP

        com.sixrpg.opalyer-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/com.sixrpg.opalyer-journal
        • Size 8KB
        • SHA256 6a75a0b76977dac538e40d2aa405851ded9aeed875d7daf4bf149581c575cd65
        • MD5 SHA1 SHA512 SSDEEP

        com.sixrpg.opalyer-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/com.sixrpg.opalyer-journal
        • Size 16KB
        • SHA256 ce76c177c2c903126cdce8546db4f6d92cf4a9b8520ddfa994db277fc187e9f4
        • MD5 SHA1 SHA512 SSDEEP

        com.sixrpg.opalyer-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/com.sixrpg.opalyer-journal
        • Size 16KB
        • SHA256 a7320270092a7e16cef0527b1c73240aabd58d3040c8e29b1dadc660e8aca027
        • MD5 SHA1 SHA512 SSDEEP

        com.sixrpg.opalyer-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/com.sixrpg.opalyer-journal
        • Size 16KB
        • SHA256 fb57511e53ff8b9f17c94747c3277b3213c51642b69aa358b6d7f059c46b2645
        • MD5 SHA1 SHA512 SSDEEP

        og5.db

        • Path /data/user/0/com.sixrpg.opalyer/databases/og5.db
        • Size 28KB
        • SHA256 612db676a852b930ff64e0e6468d33721387f1ccc281dfb093489e11dc7e482b
        • MD5 SHA1 SHA512 SSDEEP

        og5.db-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/og5.db-journal
        • Size 4KB
        • SHA256 5cee858f391a73a274f3f3339319a9c1921994dafeba4d8f227a4b5ac6fa17df
        • MD5 SHA1 SHA512 SSDEEP

        og5.db-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/og5.db-journal
        • Size 8KB
        • SHA256 83a21fb7929ace1b40db4ef1e86d88f7799abcf76babdc7ced0931357ea652b8
        • MD5 SHA1 SHA512 SSDEEP

        og5.db-journal

        • Path /data/user/0/com.sixrpg.opalyer/databases/og5.db-journal
        • Size 8KB
        • SHA256 dd9309765a6be2f79f8158554a936e90f9f288258cfbfffd88c710cf3feb56c8
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.sixrpg.opalyer/files/TDtcagent.db
        • Size 32KB
        • SHA256 978e10b07e91ca29ede5c387dfd9e501a19cc5a02675196d716962e7697de695
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.sixrpg.opalyer/files/TDtcagent.db
        • Size 20KB
        • SHA256 9aef7f22b20e26f01b93786c258d2c15f11d22228756d82f7188ce74c05f566a
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.sixrpg.opalyer/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 9147d383d5b69a9bae746e39ada522ef5071398b457b3fe857ff72cfbe4ca931
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.sixrpg.opalyer/files/TDtcagent.db-journal
        • Size 12KB
        • SHA256 085d04f0306102995964ec48b094220475409777089da450ce859e1c91d0a513
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.sixrpg.opalyer/files/TDtcagent.db-journal
        • Size 512B
        • SHA256 3d5a5ed70873ad051d67519602408d26dba4a0bc953c39b6c6b8f6cfb02ad87e
        • MD5 SHA1 SHA512

        TDtcagent.db-journal

        • Path /data/user/0/com.sixrpg.opalyer/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 4181d24ad062b700cf77a9f57a45c2588e54d29f7196c1a9da421da49ec2a8c4
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.sixrpg.opalyer/files/TDtcagent.db-journal
        • Size 4KB
        • SHA256 c1d83e0eb38624a460d3fccee0e7212ad29ba77d2354cb4f76666712b0e754df
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.sixrpg.opalyer/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 234292ceb8f7a79af052fed8cf955c13d07e1bc39affed67f06591801b77c48f
        • MD5 SHA1 SHA512 SSDEEP

        jpush_stat_cache.json

        • Path /data/user/0/com.sixrpg.opalyer/files/jpush_stat_cache.json
        • Size 119B
        • SHA256 f3fd0464a394d48e4ee7dbd8786e1e03048a610614a90ed215fa644656f949b0
        • MD5 SHA1 SHA512

        85a0b992-2908-4975-94ae-b0b1925180be

        • Path /data/user/0/com.sixrpg.opalyer/files/jpush_stat_history/normal/nowrap/85a0b992-2908-4975-94ae-b0b1925180be
        • Size 159B
        • SHA256 10f438b56e33ac9eefbda697e68031d666d1b495bf27164322959ef1a1846063
        • MD5 SHA1 SHA512

        1717590004015_4473

        • Path /data/user/0/com.sixrpg.opalyer/files/td_database1SaaS/1717590004015_4473
        • Size 2KB
        • SHA256 7621fe2a57caed5752d6f9e2e6092d874bc4c3e698af2c4be73d93d73c7b7910
        • MD5 SHA1 SHA512

        1717590008011_4473

        • Path /data/user/0/com.sixrpg.opalyer/files/td_database1SaaS/1717590008011_4473
        • Size 2KB
        • SHA256 68b63e1d23753c6f93bff4ae2e2a06a4f88ae98689d15e5b0140656d6ca28144
        • MD5 SHA1 SHA512

        1717590002529_4473

        • Path /data/user/0/com.sixrpg.opalyer/files/td_database2SaaS/1717590002529_4473
        • Size 2KB
        • SHA256 1d71a3ba43b448444babbd5c7b678d55ad69a0ca6036e23102d942e70568ca68
        • MD5 SHA1 SHA512

        1717590003135_4473

        • Path /data/user/0/com.sixrpg.opalyer/files/td_database2SaaS/1717590003135_4473
        • Size 3KB
        • SHA256 169d617be4821feff57b85285f22ec665b7a6d05be3a0ef14a650c9959e9e68c
        • MD5 SHA1 SHA512

        1717590003783_4473

        • Path /data/user/0/com.sixrpg.opalyer/files/td_database2SaaS/1717590003783_4473
        • Size 2KB
        • SHA256 b5ecb66f935e870d3e85ac0c18289d8b3e2c99f62dab07bc402d86b5d8898de6
        • MD5 SHA1 SHA512

        1717590004712_4537

        • Path /data/user/0/com.sixrpg.opalyer/files/td_database2SaaS/1717590004712_4537
        • Size 2KB
        • SHA256 ec4e97e07590c541f62c503d2cea516276540edc8b8ad1b369e1010e4a279f3c
        • MD5 SHA1 SHA512

        1717590005345_4473

        • Path /data/user/0/com.sixrpg.opalyer/files/td_database2SaaS/1717590005345_4473
        • Size 2KB
        • SHA256 3a015eb5c438626864bb6a2211cf18e37e118c040088aa24823cdf6dd24c8b71
        • MD5 SHA1 SHA512

        .tcookieid

        • Path /storage/emulated/0/.tcookieid
        • Size 2KB
        • SHA256 1e1d702e7d9f578c9e4078f8ff6f97441242d44d4b2cb7267150c9f1eafd845f
        • MD5 SHA1 SHA512

        .tcookieid

        • Path /storage/emulated/0/.tcookieid
        • Size 33B
        • SHA256 154dde0c2152fc3b076d5c791b78339d18e2cc5c2c147d33683095cd3ce1f261
        • MD5 SHA1 SHA512

        03089F23C7B162A95CB2CFFC3816C864_o

        • Path /storage/emulated/0/sixrpgReader/httpcache/03089F23C7B162A95CB2CFFC3816C864_o
        • Size 40KB
        • SHA256 177d2d5a54b7bb32b4a21cd0a7a67fc1123d58e35ae50d76da74fa5e33c28099
        • MD5 SHA1 SHA512 SSDEEP

        05148658FC989B2172DB351AEB4B131C_o

        • Path /storage/emulated/0/sixrpgReader/httpcache/05148658FC989B2172DB351AEB4B131C_o
        • Size 116B
        • SHA256 b8affc28e1721b21dea5db43ddcad32000d75ba8c3b113ae3a0c209adffcfda6
        • MD5 SHA1 SHA512

        2186db9390dd4285ee303f9967694edb.0.tmp

        • Path /storage/emulated/0/sixrpgReader/httpcache/2186db9390dd4285ee303f9967694edb.0.tmp
        • Size 797B
        • SHA256 b2d57bd56554ff5c4e0065212a1f4ead778fcabc2826d360fec9ce4aba673665
        • MD5 SHA1 SHA512

        2186db9390dd4285ee303f9967694edb.1.tmp

        • Path /storage/emulated/0/sixrpgReader/httpcache/2186db9390dd4285ee303f9967694edb.1.tmp
        • Size 6KB
        • SHA256 90288bc68b20b3e9b05f43911871cff88365c6bd4438f130eed5a208b511ebed
        • MD5 SHA1 SHA512 SSDEEP

        39AACB98FBF41B82F9B54038678847D8_o

        • Path /storage/emulated/0/sixrpgReader/httpcache/39AACB98FBF41B82F9B54038678847D8_o
        • Size 86B
        • SHA256 5f8fa61e097e5a40ff120251d4587601f5a76616afb163903f29965121ced4b8
        • MD5 SHA1 SHA512

        63ec7aabe108f6b59d29f280db03f105.0.tmp

        • Path /storage/emulated/0/sixrpgReader/httpcache/63ec7aabe108f6b59d29f280db03f105.0.tmp
        • Size 1004B
        • SHA256 1c7ebd8bcf55f510f1a65ffec20af77652a26662ecc74c07daa877976821357b
        • MD5 SHA1 SHA512

        63ec7aabe108f6b59d29f280db03f105.1.tmp

        • Path /storage/emulated/0/sixrpgReader/httpcache/63ec7aabe108f6b59d29f280db03f105.1.tmp
        • Size 82B
        • SHA256 246bc704b0ffa502b69da132d3f5a8bd981257810466fb5066bba3918dd7fd1a
        • MD5 SHA1 SHA512

        6AED21586E519E87FDE9D33358C6D7BE_o

        • Path /storage/emulated/0/sixrpgReader/httpcache/6AED21586E519E87FDE9D33358C6D7BE_o
        • Size 164B
        • SHA256 3e4e14d609c23ab44b83acade369fb18d2bda87399172298f4a8bdbb421fe5d1
        • MD5 SHA1 SHA512

        7e8105be7be19705f96028e7c91c74a3.0.tmp

        • Path /storage/emulated/0/sixrpgReader/httpcache/7e8105be7be19705f96028e7c91c74a3.0.tmp
        • Size 996B
        • SHA256 2d1d1ffb0c4b679e5787eea63e1b60e1c2756b3b964c9efc9a56ff4b123c0d25
        • MD5 SHA1 SHA512

        7e8105be7be19705f96028e7c91c74a3.1.tmp

        • Path /storage/emulated/0/sixrpgReader/httpcache/7e8105be7be19705f96028e7c91c74a3.1.tmp
        • Size 160B
        • SHA256 59620075030f03119082410320dad82504a99c15919eb9f403de229f99eec5f2
        • MD5 SHA1 SHA512

        c55543c9ea8fd8f1d370e2578c954ec5.0.tmp

        • Path /storage/emulated/0/sixrpgReader/httpcache/c55543c9ea8fd8f1d370e2578c954ec5.0.tmp
        • Size 846B
        • SHA256 991baebded9a4e451cf4cb58d09d5c9abb7e583c847367bafd689e27ee765606
        • MD5 SHA1 SHA512

        c55543c9ea8fd8f1d370e2578c954ec5.1.tmp

        • Path /storage/emulated/0/sixrpgReader/httpcache/c55543c9ea8fd8f1d370e2578c954ec5.1.tmp
        • Size 112B
        • SHA256 88dd16a34092b765765fd05487d81fa49a08837fa53d20993e473e5bd33f8271
        • MD5 SHA1 SHA512

        fb6ea35261d5afe8db9d5561599a8085.0.tmp

        • Path /storage/emulated/0/sixrpgReader/httpcache/fb6ea35261d5afe8db9d5561599a8085.0.tmp
        • Size 844B
        • SHA256 34faa8e8f100dfa29cb6e156ce11fbd479d14e51fb4a7a0e9b71149137fc15e3
        • MD5 SHA1 SHA512

        journal

        • Path /storage/emulated/0/sixrpgReader/httpcache/journal
        • Size 123B
        • SHA256 45c083f11f2f39d2526bfe87ce4688f0447706804f8d76db17bc0323900d5126
        • MD5 SHA1 SHA512

        journal

        • Path /storage/emulated/0/sixrpgReader/httpcache/journal
        • Size 209B
        • SHA256 53bd9f02a8ae18f555bafb9ae75463bb159c5cad0c853ff83d94b5ba2e84bda8
        • MD5 SHA1 SHA512

        journal

        • Path /storage/emulated/0/sixrpgReader/httpcache/journal
        • Size 381B
        • SHA256 d985afab8f3fb77c5497679381049455c2c29bd1943f0bc7986aecb78b9dcb56
        • MD5 SHA1 SHA512

        journal.tmp

        • Path /storage/emulated/0/sixrpgReader/httpcache/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512

        info.oge

        • Path /storage/emulated/0/sixrpgReader/info.oge
        • Size 71B
        • SHA256 7e104d974f14f608e0c369f91ab2bcba567f4581929d601ca652dba6853bf903
        • MD5 SHA1 SHA512

        ufrist.oge

        • Path /storage/emulated/0/sixrpgReader/ufrist.oge
        • Size 25B
        • SHA256 69651d4274404c4ebf58b1519ddee85308936d2ef4ae37889fc708da8c6f2eb4
        • MD5 SHA1 SHA512