Analysis
- max time kernel
3s - max time network
131s - platform
android_x86 - resource
android-x86-arm-20240603-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system - submitted
06/06/2024, 04:34
Behavioral task
behavioral1
Sample
99f7fa8e3e29edf07399d68e31fe1136_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
99f7fa8e3e29edf07399d68e31fe1136_JaffaCakes118.apk
Resource
android-x64-arm64-20240603-en
Behavioral task
behavioral3
Sample
tf.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral4
Sample
tf.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral5
Sample
tf.apk
Resource
android-x64-arm64-20240603-en
Behavioral task
behavioral6
Sample
unicom_resource.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral7
Sample
unicom_resource.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral8
Sample
unicom_resource.apk
Resource
android-x64-arm64-20240603-en
General
- Target 99f7fa8e3e29edf07399d68e31fe1136_JaffaCakes118.apk
- Size 30.8MB
- Sample240606-e68j6shf56
- SHA256 59379aa4dd91a4b346a125561ef27ccdc8a12e8a1a88cf88c7746f9ed37e559c
- MD5 99f7fa8e3e29edf07399d68e31fe1136
- SHA1 194dac31c5df728461d97c652c22733b76fe639f
- SHA512 8d2e36447fea4ca676b1abdccbe41ff38e3b39f0324e6a051865da8fcfc37ea4b79cce4554d1763cd3bada7279645b059b7097d554a2e699f212d43d7065dd39
- SSDEEP 393216:uKfOhKeiMyW7iKJ70Y+x/CK2IulFlmPVuhx2sUBIKz1Epg0UNZVEEh8xkVZukD29:uWOhKd07iKh/+xaFPUG2sXg0UN3EPxFd
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.sg.dljz.qihu - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.sg.dljz.qihu - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.sg.dljz.qihu
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.sg.dljz.qihu/files/TDtcagent.db
- Size 32KB
- SHA256 8c9b5adb013e4b6f005f8952e54d32632f702ab42be33db491b30210ae293435
- MD5 36bcfd52a3b3fa1b16ddfe6d7cd8918d
- SHA1 4860386abf1fa77c5b9d51c26a8f225ce61cc30c
- SHA512 ad09acaeb00c197ae0ea5b9bec908b19dd606b37ffab4a2fb39a3c280d4f89f6891c99183a3c8b9a408532694ffc845463610716f80a72090dfe76a31d971843
- SSDEEP 96:Htg8ql8Ud/gpWkdxmhAXUX+hau/tukrGz/Y0vMLl8j:+8q/BeFeiy
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.sg.dljz.qihu/files/TDtcagent.db-journal
- Size 512B
- SHA256 48845f5af1cea713f5cf15e9c6c95320298a0047a874f777b14940001b7dab62
- MD5 6db4ab0de7f36611da8675f6a7562f87
- SHA1 f94d5d6fa6ec009f19c70a2899863bacce58c856
- SHA512 01d292f13e73d4b844d8e6b8ab340d7477524f51d4a9c13285f8d7940ae6d0ca345fdcfe353ea230f8fb8fdcdae07cbf5fe16b6cfae3e6d565961f273805e0eb
- MD5 SHA1 SHA512
- Path /data/data/com.sg.dljz.qihu/files/TDtcagent.db-shm
- Size 28KB
- SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
- MD5 cf845a781c107ec1346e849c9dd1b7e8
- SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
- SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.sg.dljz.qihu/files/TDtcagent.db-wal
- Size 80KB
- SHA256 666ce893a2d38befc1e02fd0303679f229d98d88be36671b857faec1e45dddce
- MD5 61cc88f437d98b1f9e8da667440ce552
- SHA1 e1c8dfef994b85fb5201d1e9e63418a6236c625c
- SHA512 49a4255f200641ecba425ca07b5a2f81f5e6857c9984c864af9eeef187b25f2bf28c6d7132bfe77aa07769024b652af103d4f812f6f69c24ede77101e7b98ec8
- SSDEEP 96:p0Pl8OPYUd/gpWPV3ql8Ud/gpWPRk8ql8Ud/gpWPejtg8ql8Ud/gpWPs5xmhAXUV:aT9BeaV3q/Beaa8q/Beaey8q/BeaUeiy
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.sg.dljz.qihu/files/talkingdata_app_process_preferences_file
- Size 21B
- SHA256 f365ca78857c65a36a924e4093d46fcda6e077775c44c80c1654b299fe4a29a8
- MD5 3247b42797bcd9ab724dd3c5bd9efd26
- SHA1 72f33e6d44dee5e48f3b3098e39578b959102065
- SHA512 15ffff3ec9b2499019cd0edd7bf87ba3b839bee2dbfbf8dc0925908aaeb778b021d488ff2f5338826dd06b45a7c767080c9a2757805cbb802b10435e8253959f
- MD5 SHA1 SHA512