Overview
overview
7Static
static
699cb54c825...18.apk
android-9-x86
7gdtadv2.apk
android-9-x86
gdtadv2.apk
android-10-x64
gdtadv2.apk
android-11-x64
patch.apk
android-9-x86
__adroi_co...te.apk
android-9-x86
__adroi_co...te.apk
android-10-x64
__adroi_co...te.apk
android-11-x64
org.apk
android-9-x86
org.apk
android-10-x64
org.apk
android-11-x64
pujia_c.apk
android-9-x86
pujia_c.apk
android-10-x64
pujia_c.apk
android-11-x64
Analysis
- max time kernel
7s - max time network
131s - platform
android_x86 - resource
android-x86-arm-20240603-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system - submitted
06/06/2024, 02:19
Static task
static1
Behavioral task
behavioral1
Sample
99cb54c8251809a995e1ebe8ae984bc6_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
gdtadv2.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral3
Sample
gdtadv2.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral4
Sample
gdtadv2.apk
Resource
android-x64-arm64-20240603-en
Behavioral task
behavioral5
Sample
patch.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral6
Sample
__adroi_core_remote.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral7
Sample
__adroi_core_remote.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral8
Sample
__adroi_core_remote.apk
Resource
android-x64-arm64-20240603-en
Behavioral task
behavioral9
Sample
org.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral10
Sample
org.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral11
Sample
org.apk
Resource
android-x64-arm64-20240603-en
Behavioral task
behavioral12
Sample
pujia_c.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral13
Sample
pujia_c.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral14
Sample
pujia_c.apk
Resource
android-x64-arm64-20240603-en
General
- Target 99cb54c8251809a995e1ebe8ae984bc6_JaffaCakes118.apk
- Size 17.8MB
- Sample240606-cryqbaff26
- SHA256 810377aec8c8a795b8338736aeecdf3e681f0fbf3b9755d213c7a03dcb87d9eb
- MD5 99cb54c8251809a995e1ebe8ae984bc6
- SHA1 78aacd7d2218a53534302efb473e83706533cd36
- SHA512 ac17e028327aec5fcbe93bbe34cc79a1805ad1245b15fea2d6e6d56d5a26c63633f0664b1366a6b638526262862c74efa497bc089c43e2bb19b6794a9f0042ad
- SSDEEP 393216:AXUrTlHfwwP6tlbSE8yRp3VOg12TcHAOjzB9bCzvg:zrR/FCBnRpAgoYH9jzB9bCzvg
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/patch.apk 4395 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/patch.apk --output-vdex-fd=48 --oat-fd=105 --oat-location=/storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/oat/x86/patch.odex --compiler-filter=quicken --class-loader-context=& /storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/patch.apk 4264 com.sakai.imikowa2.pj - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.sakai.imikowa2.pj - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.sakai.imikowa2.pj - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.sakai.imikowa2.pj
Processes
-
com.sakai.imikowa2.pj1⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4264 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/patch.apk --output-vdex-fd=48 --oat-fd=105 --oat-location=/storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/oat/x86/patch.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4395
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.sakai.imikowa2.pj/cache/1582435991586.jar
- Size 9KB
- SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
- MD5 e8e0527a01aefdb89afd2c508f131da1
- SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
- SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
- SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.sakai.imikowa2.pj/databases/partytrack
- Size 16KB
- SHA256 cd16181d54b4b2fb2a46c517648bc09c59650144de19ef7164c26c4f4100cd69
- MD5 3fabf09ddda0c5c50006154a5101223b
- SHA1 4ba5de973e1edf5b0259cd617808fc45e3c320e4
- SHA512 91c868e590803eec6d572d19a0f836587aa2ee174877b524763cda8509293e458174184fab61509c956ad51d641d31ddc4c40f86a3ad044c22067c42f576e1b4
- SSDEEP 12:TgEL6HfLynDPATd6XHmfRmBEyPbBvOw8p:TEf2nLATd63m0GSN8p
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.sakai.imikowa2.pj/databases/partytrack-journal
- Size 512B
- SHA256 6d4dfed2d2d11e3dc991e0aabac380ea8e20b0640b90a6b12359b30f2f02caa7
- MD5 539f03a6f21bbc3210ab4a02fe577143
- SHA1 e4439dcdee30e9c87e7c92d43d2bde5f5af81ab5
- SHA512 9246c66c4653884ac4fa93950894007197e8ccde8a6bf5a204be5e8557b274481c0a6192e3c54bfcd679ac7c157d6d434c72880c938289b130b4bc199910e243
- MD5 SHA1 SHA512
- Path /data/data/com.sakai.imikowa2.pj/databases/partytrack-shm
- Size 28KB
- SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
- MD5 cf845a781c107ec1346e849c9dd1b7e8
- SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
- SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.sakai.imikowa2.pj/databases/partytrack-wal
- Size 32KB
- SHA256 f46cfe1c260a0b235a2442f7fdca90211a0a30f1b111b194522711ff6ed022b1
- MD5 cf60f2fd6e4b79fe471c7bb32b23ae5c
- SHA1 1d7c4306109d83717b252802e501a2e950942bd4
- SHA512 af9537790a80da9d0f8c0c5abaf5db01edf13593d03bbec89adea09c6aa5c6ac637c31a2694d624bbc929b2f77812a122c4bc4813e3531bda2e482087953f686
- SSDEEP 24:Kon34zyGSP/C3LEf2nLATd63m0GSP/8tT232up:5ozNSP/KJLUlSP/UTcT
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/patch.apk
- Size 2.2MB
- SHA256 4fef18a19ac2625a353e3d9ccecbce3fedb5a71925b7419a5752dc8c02aafd4b
- MD5 4fbbfb5f86156ed67af4d6c6a4f3bb99
- SHA1 cd0912603a759b9e74899ada8b18aa418c278b28
- SHA512 e14edf5a79f479c5c69fb3593d16ed64dec7b8f2c6ebbd8bbdd8927ff06ab9447d7c9e8ff6759b3e569dd414702a7396cc2f37dfb8845293754cd0ee01c28736
- SSDEEP 49152:DNWLhHfBFhOTYW37pFzVBNAH2MNC3lcPjZNgj8bHe/Fy9:I1hO8W37pFHH3y7Xgjcr9
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/patch.apk
- Size 1.9MB
- SHA256 4d55b97d362af2cd13957e0f79a1f8a070f7644d337e7f57c628230247a3f0cd
- MD5 2b53405cabedd6139a945b097d292072
- SHA1 fe01d81e66a5ad1539c51343e31acd7b684b4823
- SHA512 d224c03104f75e2b8335158efc160b7dc125d389fd2a85ede2676375ec03a155306145cd53ea0ee3a3d1f34d201bf350d3b035e1cd17e24163662c83df74a63f
- SSDEEP 24576:sIMQxKnXKc5RWyXeKhaPHEXt5MII2cfS5RT3wWIImLOK5vIsH37zUo65:6KGRVLaPHEXt6zxSoWIImLOK5QqA5
- MD5 SHA1 SHA512 SSDEEP