a3e759fcece21e51dcf408cfb95e4f3a3c46d76c0cf7a08d2067428ee17f62a7

Analysis

max time kernel
14s
max time network
135s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
06/06/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99bf0892ee0c2e3e7e2262f016a187aa_JaffaCakes118.apk
Size 19.1MB
Sample240606-b619bafa65
SHA256 a3e759fcece21e51dcf408cfb95e4f3a3c46d76c0cf7a08d2067428ee17f62a7
MD5 99bf0892ee0c2e3e7e2262f016a187aa
SHA1 703e91aa3e360587c5d9f91308045c7a3b2c0d58
SHA512 0b3e5aeda2aaf6b599be7558b3fe8acde10aa35cc6d0f6364fed7fd4fa4379d6f6f01ba3d061c90ff78d4f63718359be6281b372ee92b6bd0047fe5669edad61
SSDEEP 393216:U3L3+Ek7ViriDtx5a4AbLrs3EDBqtZOewwQN1MMDWINhgNrJZuXL:U3L3Df0txxAbmEDBqtZOew7YMCvZy
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.wuzhaiyigou.users

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.wuzhaiyigou.users/mix.dex	4600	com.wuzhaiyigou.users
/data/data/com.wuzhaiyigou.users/mix.dex	4600	com.wuzhaiyigou.users

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wuzhaiyigou.users

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wuzhaiyigou.users

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.wuzhaiyigou.users

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.wuzhaiyigou.users

com.wuzhaiyigou.users
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4600

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

mix.dex

Path /data/data/com.wuzhaiyigou.users/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.wuzhaiyigou.users/app_bugly/rqd_record.eup
Size 364B
SHA256 d869b5e7b846e2011110de4424c3526c09563f8ba01c620e3cb20ac659fd0887
MD5 e8ee93160425629a7fd20ce2724c6095
SHA1 77a331edbe3984791989b8f85e750f2efb179bd6
SHA512 88340d5c6473f7695e871b9d8be7f44909bd1af9e6679a81ffaffe53580b61334fa811be30067ef963b5346d728df5472aed23dd0ee1515ab27c7a5cb041b77f
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.wuzhaiyigou.users/app_bugly/rqd_record.eup
Size 1KB
SHA256 9db9efc871e05fc4c114380c4c1a4f85c03cc982a3eea5ece14a77e5ee45c2cf
MD5 4070f61ffdb0d5a467235fe79089eadb
SHA1 794e2a596f926291ca126d6153c595d4038f03ef
SHA512 8c7ecdd464a739f568e09665c5dc9c264fd22e52f49f06df56536355e2e78f0146d72bd1f9e2e06b41084aa5bb4d9586abc0faa032aeae7e9860f569eaf2598f
MD5 SHA1 SHA512

Submit Download

tomb_1717639524211.txt

Path /data/user/0/com.wuzhaiyigou.users/app_bugly/tomb_1717639524211.txt
Size 23KB
SHA256 852764524e60d65dfe7f93df37338e00c426bb646e37b7cc16b0a2865c8dbaa9
MD5 168d5fe9ec68c6983edc06f824d35972
SHA1 e91e54322dd8c50f5064122ba904dc78b8c4c724
SHA512 338160e34b75887444bf229d000710e4d4265be5a3c6ab38e6035be893ed40537c31cbaa47f018818a646db192033d06c3868973174672270be9274172b08cd4
SSDEEP 192:svcDkzGM6Bt0M1RbuzCM9uje1g2jXjzGSUfHuMw51gHnzfu036ozo+w+Un:/D/0M1jzcbnLU//w72np31U
MD5 SHA1 SHA512 SSDEEP

Submit Download

tomb.zip

Path /data/user/0/com.wuzhaiyigou.users/cache/tomb.zip
Size 4KB
SHA256 5941331f8a6012963c54b3cb0430455413c044107a4eb5ad0a434214b55b6ee3
MD5 db9535417fb1f65b0e15dd2fdd90d6c9
SHA1 00dfc45062a5c7f34d7c0b23fbf32b0af3390a2a
SHA512 38d32ae087ac30459f4989b8d8f29c85c91fb171bdfc360890a7a9b8b4442e42bc3084f3734c4e9bae54dd05a8f2691fe5036a3e54400eb36ca396c39799055d
SSDEEP 96:BE5jFBcrxaMzO2KcLlTAg33KvtTEEK9CFZUWk7w7JFY7sx3lBrXBy:g81tYcJufK9+Z8wfY7Q3lpBy
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu

Path /data/user/0/com.wuzhaiyigou.users/databases/bugly_db_legu
Size 172KB
SHA256 774bee6528376f899148a85c63f85c4bd1f76904b8688bffdc1511d63fecadb5
MD5 47a51a99fafdd7c91988014ca3a62482
SHA1 162c6dc0fc73c004f329c9a90d20de293a641532
SHA512 d74ea7d76ff7b284e35623e2f59a6400ee26bf2e1fb44f2403fe8dfd43aa90fc202e3f5b4d9d2b404d05005b544006f6650a416eb29d335a9ca32d4865888c9d
SSDEEP 768:i4ImT8emTvPiDuE+xYAUeDYJPbyEyq8X/r+qv2o4DN2ji0BJSd1dBxd6O7efMgBa:iKQJW2vp4JV59/fZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.wuzhaiyigou.users/databases/bugly_db_legu-journal
Size 12KB
SHA256 134a07a3c8f9cea9a5840d04f594ff272e170158e3b15c54d3820614437ba3e2
MD5 6b73976849e22a2abdeb252b3669b48f
SHA1 e13754341e3be04365f807c2b7070c9859dc69e1
SHA512 676a8afafbc47910c1f80ce63dccd3bfb44d041d28de948bf5ba8e4773dfca45c797db61d5a920e2d9e8ccf5f3e1843c083b2d9b2d87481c56b3b13242ea1961
SSDEEP 96:7Cj4m7lG6VSD0SDwXSpnqoSpkq1SuSxSKpSKD:7CEmpAhwqqPDSfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.wuzhaiyigou.users/databases/bugly_db_legu-journal
Size 512B
SHA256 7efdfd34963f52affcb9f88f4876296edcc42397aff24955a78823a073713b94
MD5 6c67a3af78a9d1450f83da9580c4d028
SHA1 20b53562f5c34b0491055d2d040f0021698dd0c4
SHA512 c8198f26c113950aff78a31eddffd7f258ad76124ebffeccc729e889113334e514a518fa039888ae4d2abea2667f7ffc47dd05192d29686870ae8abf8bd3220d
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.wuzhaiyigou.users/databases/bugly_db_legu-journal
Size 8KB
SHA256 c969955a0b5a0694a40292365446bdc9d33e4750923e681a1dd0f779e39e8b8b
MD5 0b090c01b9bf229a4ce78a3864a06edf
SHA1 8cc21ec14e28e0f33cb8caf01daed32dc30a9987
SHA512 4c543511364fee78e827aee2e82ad39a44a538cbdb61f4456f67ad855d79a23a4721ecc74a6867f1749d0cf273768969d17782eb829080fd2559ddcff41f562a
SSDEEP 6:7+/l9ZFn1azg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKR:7+tkqLiuWdYRmBEyPbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.wuzhaiyigou.users/databases/bugly_db_legu-journal
Size 8KB
SHA256 f5738ce2e4cb3b17f6e5800cdd37f8865005cc71aa2014bea040b646d4720dde
MD5 6f1e0c5577e211bc06047753db1e61d2
SHA1 df4df122f14c1b747018f54311dc65f50a8216ef
SHA512 7fcf828accf0977937b8c51c7db14b6712cca51aadef2821366fe3d9afc923b6a03f2927f2cc7656b404d34daa800fb2f2ca05bda0559c1450b57866897ee89c
SSDEEP 6:7+/l9JOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKV//R:7+t2qLJdeWRmBEyPbOR
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.wuzhaiyigou.users/databases/bugly_db_legu-journal
Size 8KB
SHA256 f8832049f3d6c9dd6964c088d5085e6db11a769e333eeb3db2553323ea317158
MD5 4b11967eec8f88113c744a37996007be
SHA1 588f722a13378ae74ae9f3512fd42b0a5297daca
SHA512 076ceaca2b50b855cf08c8da17d61b01e07877b2edbca875a091885178715b7c5784a217c0233c99fce4a46e9759e3655d92124c0ccb087ca86181e44c99a3f9
SSDEEP 24:7+tVqLTtrrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGS5:7MVqVZfrQiw6uMg6/YBg72meposS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.wuzhaiyigou.users/databases/bugly_db_legu-journal
Size 12KB
SHA256 feac1f1c2fa89a5585e5e0013f646eeb7596a3e673a9e141e0c1864b8e49cd92
MD5 a1d392089995a950447e22bc7c9eb9b6
SHA1 b366329ed0db5a01e2d0aed9d43302c678ac09ef
SHA512 4f8e3f29aa7b7dd4941736861133bc2846b70b577d524290b51b72eb91f2785e3a361da5acc70e441aeb5b38f8738e90e8bdf6ad1bae334c3882f7ab3110d8ba
SSDEEP 24:7+tTnqLMvtYrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGS+:7MTnqlZfrQiw6uMg6/YBg72meposS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads