Overview

overview

8

Static

static

6

99bb2fd8bc...18.apk

android-9-x86

8

99bb2fd8bc...18.apk

android-11-x64

8

dmss_v2.apk

android-9-x86

dmss_v2.apk

android-10-x64

dmss_v2.apk

android-11-x64

dump.apk

android-9-x86

1

dump.apk

android-10-x64

1

dump.apk

android-11-x64

1

dynamic.apk

android-9-x86

dynamic.apk

android-10-x64

dynamic.apk

android-11-x64

Analysis

  • max time kernel
    127s
  • max time network
    184s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240603-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
  • submitted
    06/06/2024, 01:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    99bb2fd8bc509aef435544c506eb036e_JaffaCakes118.apk
  • Size 6.8MB
  • Sample240606-b378fseh79
  • SHA256 d64f0e62f47f519b45c86f91228d800f780cc8c3b86ac1fc8b14f53290038d6b
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bankercollectiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
    evasion
  • Checks known Qemu files. 1 TTPs 3 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

    evasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about active data network 1 TTPs 2 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
    impact
  • Checks CPU information 2 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.qihoo.appstore
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4569
  • com.qihoo.daemon
    1⤵
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4608
  • com.qihoo.appstore:critical
    1⤵
      PID:4782

    Network

          MITRE ATT&CK Mobile v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          360appstoreInstallHistory.db
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db
          • Size 28KB
          • SHA256 8b7c89cb3a969d6dd2bd30e05ef5dd2fab3ee87facd48a90057aff12b9c57f3c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          360appstoreInstallHistory.db
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db
          • Size 28KB
          • SHA256 7da57948c092aebf9ec6d31137293dfb969a2e378b059e2ee21f5955d2cb366f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          360appstoreInstallHistory.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
          • Size 512B
          • SHA256 b742a951d4d6b51a377df3ea47d1d3bddb3a4def69972ba6634c4a596f69de6a
          • MD5 SHA1 SHA512
          Submit Download

          360appstoreInstallHistory.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
          • Size 8KB
          • SHA256 93b0b9dacd7a7138b2f65fde8524a65638edf9653e15b9ada0ac96f14c977fda
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          360appstoreInstallHistory.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
          • Size 8KB
          • SHA256 fcf40b3409d56275ccd098bc63488829be8aa9a01ef67eb758b7ad6172e8fb1b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          360appstoreInstallHistory.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
          • Size 12KB
          • SHA256 106d448e0fcb1a38ab3bd44d5f2e59b9f30baf5c0ccef3193731baa036f490ee
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ire
          • Path /data/user/0/com.qihoo.appstore/databases/_ire
          • Size 12KB
          • SHA256 67b1e827a498e60301f0b57d15e0e342027c49266e8be14c7441dc7f774c299d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ire-journal
          • Path /data/user/0/com.qihoo.appstore/databases/_ire-journal
          • Size 512B
          • SHA256 791efac0479c2065dea95c1bac15fdc294ed40afebac6264beaf38299e12f8af
          • MD5 SHA1 SHA512
          Submit Download

          _ire-journal
          • Path /data/user/0/com.qihoo.appstore/databases/_ire-journal
          • Size 8KB
          • SHA256 21ba0efd32b8d8a0049b588ee0ac141c9042af115ac31038b5370825ee9156e9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ire-journal
          • Path /data/user/0/com.qihoo.appstore/databases/_ire-journal
          • Size 4KB
          • SHA256 8386b6240fe24dbec26525eb56a3b215c1aad891584379049570a2f6754cf98c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          account.db
          • Path /data/user/0/com.qihoo.appstore/databases/account.db
          • Size 28KB
          • SHA256 dc0c24c777a762b585f1f5213b8c021d30be608bb38d823271d9eea42d60f5b5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          account.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/account.db-journal
          • Size 512B
          • SHA256 08c846461758b73a0d055742bc4344b959716feaef5195d9ea5ffa1ab9e9bca7
          • MD5 SHA1 SHA512
          Submit Download

          account.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/account.db-journal
          • Size 8KB
          • SHA256 22ba58bb5b420b5ee7e55a8a2ddd197b05eecb0f795961ec49458666068ac7e8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          account.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/account.db-journal
          • Size 8KB
          • SHA256 8815f5a5768f60da24ad15dac3bb6665065d136350d792dca7156676f94318e2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          download5.db
          • Path /data/user/0/com.qihoo.appstore/databases/download5.db
          • Size 20KB
          • SHA256 4fa428f67556731442b5e5de1783b0be4a56d178f52da67db539866892ca00d8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          download5.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/download5.db-journal
          • Size 512B
          • SHA256 ba220e263ac9545ae02e39bb0a5a998162bb71b623bd88f75cc5c5e5d3513b7f
          • MD5 SHA1 SHA512
          Submit Download

          download5.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/download5.db-journal
          • Size 8KB
          • SHA256 caed4642c49a6cd67caae10568acd8d895d50a4101a23469343e52ee5598fa42
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          download5.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/download5.db-journal
          • Size 8KB
          • SHA256 b1e4c6422c11e5373572f106275d1fa7c8a036842f5c91d1cefcab2b6ab5489c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          filelist.db
          • Path /data/user/0/com.qihoo.appstore/databases/filelist.db
          • Size 20KB
          • SHA256 2be19a6dcf3cc68fcf46bd3d151a1afc013eda100fa2f399017be19d79c314f4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          filelist.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/filelist.db-journal
          • Size 8KB
          • SHA256 2756f331a16015091948afe89a7d41fef1ef3a78d1503769d76fa94b811c67ff
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          filelist.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/filelist.db-journal
          • Size 664B
          • SHA256 a34a748ca19c0e7e0f41434c98963a0cc4e4a73b978ccbc3404a13c99e403930
          • MD5 SHA1 SHA512
          Submit Download

          filelist.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/filelist.db-journal
          • Size 8KB
          • SHA256 e0048fadac7c45182637e2fb781f25103095d759641f61a1af3edf635a021b76
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
          • Size 12KB
          • SHA256 d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
          • Size 20KB
          • SHA256 c7697eef33212f41e3bcffe8434f3fd01700db4717bf1ea60cc0826604e13589
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
          • Size 16KB
          • SHA256 f788fa93ee15080a627598c189caff36a90ddede8510bf2d3b5496c028d98773
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
          • Size 512B
          • SHA256 5e5ebcf329c05ce8e620079df403af7f74bf0fda7c096a10f6426efbe936bba6
          • MD5 SHA1 SHA512
          Submit Download

          ignoreupdate_appinfo.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
          • Size 8KB
          • SHA256 5ba42c3436be18739d1a2390883a760cf46627c4486c2caec636f5b2e0d0d1bf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
          • Size 8KB
          • SHA256 fe9c5aff634d899cdd90b441fb45f8d399e379161337190c579fe241bd646168
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
          • Size 4KB
          • SHA256 e3ef162b1c387282b3a3b581868cb14756ca81e3ae2ca29315aaf791d08362e9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
          • Size 8KB
          • SHA256 03109d6c1cd5f660b223067bec7c9de3041669062377e0936b4e2637a41237d0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          new_downloads.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/new_downloads.db-journal
          • Size 512B
          • SHA256 f5a4e5b8f2d8836a7fcd83350f0f971a8cfc1ff475f93507f90c285483395f9d
          • MD5 SHA1 SHA512
          Submit Download

          new_downloads.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/new_downloads.db-journal
          • Size 8KB
          • SHA256 c5beadbaefd6c5c685e8ab187f709d1914194b50b2dc3a507c0a34be8c5ad5ee
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          update_history.db
          • Path /data/user/0/com.qihoo.appstore/databases/update_history.db
          • Size 20KB
          • SHA256 cedf5ce8e27874c3b635b7ecb3c9c404aa00f6924b45e8901e4c723f8b76b52f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          update_history.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/update_history.db-journal
          • Size 512B
          • SHA256 70a64ae6b632b7cce3d693dec5774b33a38723f80c6cd8a6652ac927d09623ee
          • MD5 SHA1 SHA512
          Submit Download

          update_history.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/update_history.db-journal
          • Size 8KB
          • SHA256 268d96ce6a79b502c7629e77cc858568275b1314891b9d64139d8d6425c6e945
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          update_history.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/update_history.db-journal
          • Size 8KB
          • SHA256 6d18846c000d615d2e85dff572e05f5532091fa0fcd84cdfb143987808383e3b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 544B
          • SHA256 847126ec2de2eaa1fa6310924ecc0d74e9c8789cbbb6800599792a002e905b0c
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 672B
          • SHA256 dac27754ea836e41af17e9a03e22f3d3e4a78c38eaff9f3ac1264ca9faccd733
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 520B
          • SHA256 7d1c3f367ec7e9945552bb78e4e320c16636eaa0babe49a89dc628e0894ead56
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 544B
          • SHA256 cb9e1e47ed6ae3465441e060cb4d716a10de31564972caeab5fad41616e571fe
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 1009B
          • SHA256 0ebfdcd28c29dd515f40eb873c46653a5854881e89cc02c48a5cda971c00eeab
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 1KB
          • SHA256 c5e3304a767c74575765953dddf082ddf50bfdfd7c3b73b2fa6273c82d97e5c4
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 1KB
          • SHA256 88ce6b818e6345c0f6eb127c13e6b399e9cda659cbfbc15df6be267c546ab6f3
          • MD5 SHA1 SHA512
          Submit Download

          log1717638495961
          • Path /data/user/0/com.qihoo.appstore/files/sllak/logcache/log1717638495961
          • Size 2KB
          • SHA256 27b955f28fe77a92ded32891f760263ce6e70ee0b94c8854832d0e4054291094
          • MD5 SHA1 SHA512
          Submit Download

          log1717638496031
          • Path /data/user/0/com.qihoo.appstore/files/sllak/logcache/log1717638496031
          • Size 596B
          • SHA256 c49e3c21d9acb9fcb41467d98fc70784cd33a2cc4ab6de1777fae3050403c902
          • MD5 SHA1 SHA512
          Submit Download

          finalcore.jar
          • Path /data/user/0/com.qihoo.appstore/files/sllak/opt/4569/finalcore.jar
          • Size 77KB
          • SHA256 ebfe2efdd2667dd6cf9547959844b4e1843ed07eab8283b556ca07b605de75bb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          finalcore.jar
          • Path /data/user/0/com.qihoo.appstore/files/sllak/opt/4569/finalcore.jar
          • Size 176KB
          • SHA256 536678202267f95d80480f15065e784d7ec609922a0963d935e9c5a4b0f62bef
          • MD5 SHA1 SHA512 SSDEEP
          Download

          finalcore.jar.tmp
          • Path /data/user/0/com.qihoo.appstore/files/sllak/opt/4569/finalcore.jar.tmp
          • Size 77KB
          • SHA256 5f37106fab4f07b26d488fcc7d88eafa82902305d4b667d689f70463b596706c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          finalcore.jar.cur.prof
          • Path /data/user/0/com.qihoo.appstore/files/sllak/opt/4569/oat/finalcore.jar.cur.prof
          • Size 556B
          • SHA256 360e0d42bdb9984e0a57d67d7c5835e421756bb80a8a2201ee5c326f88f75c10
          • MD5 SHA1 SHA512
          Submit Download

          localApkInfo.json
          • Path /data/user/0/com.qihoo.appstore/localApkInfo.json
          • Size 109KB
          • SHA256 61ecc602e8a036f96ab0148b5d95193317ba6d614ee40459c0106189af7dac99
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          .sfp
          • Path /storage/emulated/0/.sfp/.sfp
          • Size 83B
          • SHA256 925a7a06cacd5c39c2f028e3f642a46b62719e194b67c66bba4e27fe7deabb4b
          • MD5 SHA1 SHA512
          Submit Download