Analysis

  • max time kernel
    17s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    05-06-2024 17:23

General

  • Target

    98c044496a3e97099daf31af9508d714_JaffaCakes118.apk

  • Size

    7.5MB

  • MD5

    98c044496a3e97099daf31af9508d714

  • SHA1

    586de5b9b0f292c91ec82e65467b6ef50b505d32

  • SHA256

    0610c70d059662b46e166eed099a4f3233cc861bba7ae4e6453f1b71554602cc

  • SHA512

    c3b5d5e970a91f613a93eb6cece3dc0aaf8c1fa7c4e8f2b4212d41edddbc3b257a53398af83083306f3f1aec5324717dd071148a3ee365a0c5022f874b5c4854

  • SSDEEP

    98304:hSaHq152jTzXi/uEf5SD1XACF9MjF/nXiEVI6OcdzhjHT6h/hgLvl4lfXe2pY:hSaG2jvX2etAWo9Q6OcdN0ujGfXtpY

Malware Config

Signatures

Processes

  • com.fchatnet.cleanmyphone
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4282
    • /system/bin/sh -c getprop ro.board.platform
      2⤵
        PID:4314
      • getprop ro.board.platform
        2⤵
          PID:4314
        • /system/bin/sh -c type su
          2⤵
          • Checks if the Android device is rooted.
          PID:4342
        • logcat -d -v threadtime
          2⤵
            PID:4369
          • logcat -d -v threadtime
            2⤵
              PID:4382
            • /system/bin/sh -c getprop ro.miui.ui.version.name
              2⤵
                PID:4411
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:4411
                • /system/bin/sh -c getprop ro.build.version.emui
                  2⤵
                    PID:4437
                  • getprop ro.build.version.emui
                    2⤵
                      PID:4437
                    • /system/bin/sh -c getprop ro.lenovo.series
                      2⤵
                        PID:4461
                      • getprop ro.lenovo.series
                        2⤵
                          PID:4461
                        • /system/bin/sh -c getprop ro.build.nubia.rom.name
                          2⤵
                            PID:4488
                          • getprop ro.build.nubia.rom.name
                            2⤵
                              PID:4488
                            • /system/bin/sh -c getprop ro.meizu.product.model
                              2⤵
                                PID:4512
                              • getprop ro.meizu.product.model
                                2⤵
                                  PID:4512
                                • /system/bin/sh -c getprop ro.build.version.opporom
                                  2⤵
                                    PID:4538
                                  • getprop ro.build.version.opporom
                                    2⤵
                                      PID:4538
                                    • /system/bin/sh -c getprop ro.vivo.os.build.display.id
                                      2⤵
                                        PID:4563
                                      • getprop ro.vivo.os.build.display.id
                                        2⤵
                                          PID:4563
                                        • /system/bin/sh -c getprop ro.aa.romver
                                          2⤵
                                            PID:4588
                                          • getprop ro.aa.romver
                                            2⤵
                                              PID:4588
                                            • /system/bin/sh -c getprop ro.lewa.version
                                              2⤵
                                                PID:4613
                                              • getprop ro.lewa.version
                                                2⤵
                                                  PID:4613
                                                • /system/bin/sh -c getprop ro.gn.gnromvernumber
                                                  2⤵
                                                    PID:4638
                                                  • getprop ro.gn.gnromvernumber
                                                    2⤵
                                                      PID:4638
                                                    • /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
                                                      2⤵
                                                        PID:4663
                                                      • getprop ro.build.tyd.kbstyle_version
                                                        2⤵
                                                          PID:4663
                                                        • /system/bin/sh -c getprop ro.build.fingerprint
                                                          2⤵
                                                            PID:4688
                                                          • getprop ro.build.fingerprint
                                                            2⤵
                                                              PID:4688
                                                            • /system/bin/sh -c getprop ro.build.rom.id
                                                              2⤵
                                                                PID:4713
                                                              • getprop ro.build.rom.id
                                                                2⤵
                                                                  PID:4713

                                                              Network

                                                              MITRE ATT&CK Mobile v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • /data/data/com.fchatnet.cleanmyphone/databases/bugly_db_legu

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                f2b4b0190b9f384ca885f0c8c9b14700

                                                                SHA1

                                                                934ff2646757b5b6e7f20f6a0aa76c7f995d9361

                                                                SHA256

                                                                0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

                                                                SHA512

                                                                ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

                                                              • /data/data/com.fchatnet.cleanmyphone/databases/bugly_db_legu-journal

                                                                Filesize

                                                                512B

                                                                MD5

                                                                f02069075e7ea8b674a8af98689a31e7

                                                                SHA1

                                                                de05d570035e332ceec5bec90cdf30328a5f00d2

                                                                SHA256

                                                                1619e4e776a9a5acf0d75685912f672de415763a47ecc247466143bcd8130dda

                                                                SHA512

                                                                8b65186623b20c4e531ad9bf05706a5cf6bf9f6fa5978469b49da54df5341650f47ba295328d1aa42a43ee403453076d4441bf7454e3e228efc88f3fbe5b598b

                                                              • /data/data/com.fchatnet.cleanmyphone/databases/bugly_db_legu-shm

                                                                Filesize

                                                                32KB

                                                                MD5

                                                                bb7df04e1b0a2570657527a7e108ae23

                                                                SHA1

                                                                5188431849b4613152fd7bdba6a3ff0a4fd6424b

                                                                SHA256

                                                                c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

                                                                SHA512

                                                                768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

                                                              • /data/data/com.fchatnet.cleanmyphone/databases/bugly_db_legu-wal

                                                                Filesize

                                                                245KB

                                                                MD5

                                                                e6e4791e30d40eadbdf72761bde7cb11

                                                                SHA1

                                                                8ff3ba2a57741521ea95d8ec33fe28c0953aa60f

                                                                SHA256

                                                                2afad5b62f95cfc28f834f2bcdd7e4318f69813c767f69c032c701a58cded2e7

                                                                SHA512

                                                                3a5830671dd4ae6f2accbcecc5d1872dabb1b9d7667c32525ae9c1b20e3cbb889b2c55a808a094f940bf8db502877a999e4f8aa2a14cae08f772f86aaa1f74b8