6e18d4ba1573d71019af5bad6ac5908a92d7363e257e58bb4a1e1dd5b468bac5

Analysis

max time kernel
9s
max time network
184s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
10/06/2024, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c40ce8fbc3cd345cdda36d6c953a9c2_JaffaCakes118.apk
Size

31.1MB
MD5

9c40ce8fbc3cd345cdda36d6c953a9c2
SHA1

e81a7a9f475fcd974f44059e83fe5b016c7ca20d
SHA256

6e18d4ba1573d71019af5bad6ac5908a92d7363e257e58bb4a1e1dd5b468bac5
SHA512

c988397ae70d59cba5f92a223e14341c5662f490c59b282bb479b3994af8e38eb0518187004c42b514320c1673c265d048804bc6a107418b32b2ad3d1a867ed8
SSDEEP

786432:DwQ+x2oGYkvdsPbe/+sfQHlK3TqT5J1xTo+ARF0yY8Bks:UQ+oojkvdObe/v6lKjqvTZ+es

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.juxin.rvetc
/sbin/su	/system/bin/sh -c type su

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.juxin.rvetc/mix.dex	4261	com.juxin.rvetc
/data/data/com.juxin.rvetc/mix.dex	4359	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.juxin.rvetc/mix.dex --output-vdex-fd=52 --oat-fd=53 --oat-location=/data/data/com.juxin.rvetc/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.juxin.rvetc/mix.dex	4261	com.juxin.rvetc
/data/data/com.juxin.rvetc/mix.dex	4261	com.juxin.rvetc
/data/data/com.juxin.rvetc/mix.dex	4261	com.juxin.rvetc

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.juxin.rvetc

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.juxin.rvetc

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.juxin.rvetc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.juxin.rvetc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.juxin.rvetc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.juxin.rvetc

com.juxin.rvetc
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4261
- /system/bin/sh -c getprop ro.board.platform
  2⤵
  PID:4292
- sh -c getprop ro.yunos.version
  2⤵
  PID:4311
- getprop ro.board.platform
  2⤵
  PID:4292
- getprop ro.yunos.version
  2⤵
  PID:4311
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4343
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.juxin.rvetc/mix.dex --output-vdex-fd=52 --oat-fd=53 --oat-location=/data/data/com.juxin.rvetc/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4359

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.juxin.rvetc/cache/image_manager_disk_cache/a22bf15289455402f3d84fb8356bc5b8ac6190360c10033ea9abc4b98eafcf6c.0.tmp

Filesize
59KB

MD5
9ff8994692ea3081f563c50523e6185b

SHA1
08cbfa1926085501ea9f1eac2ef40b27d9a4e933

SHA256
35d0e63b86065a22f9faf956d1a8e0de49ed7909c911962f29003367f0e38354

SHA512
7e7264f5c49948570e24468b8caaf3f669ad17539e13da731556b765082da8fd4f06b297cb824f99ce1f9681799eaaefcc4e7c0580cd1fb2c2c5622040af4104

Download Submit
/data/data/com.juxin.rvetc/cache/image_manager_disk_cache/journal

Filesize
179B

MD5
d96a877c0c5cf821d07e2b30cf656974

SHA1
18018cc83d15cdc7791d8709265dbf514257f7c8

SHA256
c177aa7be801ee57d21bc122f959a72286720810e8f4cb5fde4efd3be2388528

SHA512
8c934c7028974761e503e9310b39e6dc9a02ca11e61ea28327aa996544004ad7cdf1cfeeeffb8252d341c29ecb7f9f01e0dc966a486ec72d5f59bd04c22f6cc5

Download Submit
/data/data/com.juxin.rvetc/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/com.juxin.rvetc/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.juxin.rvetc/databases/bugly_db_legu-journal

Filesize
512B

MD5
f9a0c5835041c3a8cfc6d9724c883d0c

SHA1
19e3f42ff1c5206255a460e9eb9f67a82c472876

SHA256
2f66bd305f36f303c00b859440ee645bf0ff826dc658bb9e654edd724669b363

SHA512
4709ad81897c16a5055d87db05ae11074253b0de7b177ceac82b2d0db27433fa189dac4edf0fcc6a276c8466661598cc788e43074dd3d196b13cc5cf5ec51d6d

Download Submit
/data/data/com.juxin.rvetc/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.juxin.rvetc/databases/bugly_db_legu-wal

Filesize
92KB

MD5
7e634de49da825297e96a751706725b0

SHA1
114e54a8a821c9b5d901e3a2c607e58499e205ce

SHA256
bd05c24eadece6e7dd61fe687d70089918d501f52bfdcb1933d73f7772fc0303

SHA512
73f1792b9377379835275586f26c57cf3d58352acd23bd2b9dfd9dc33762f13ac50392e4e4aa274bedab12e547796c8e7c61204d39172a2b0469b6e4f8d07964

Download Submit
/data/data/com.juxin.rvetc/mix.dex

Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit
/storage/emulated/0/Android/data/com.juxin.rvetc/sjk#rvet/core_log/easemob.log

Filesize
785B

MD5
ccc347ab850d4b213c1fd1c53c82a0a2

SHA1
c30388a8058f19efa27da7a4cd1b73c257aca1b0

SHA256
7ccac08064875d5e293a6a6ed482ca6dc833750a3fff6a1daa51696a4c5d99af

SHA512
50b947c2cecf5845592e53996cb2e9fd3e279bf75d2e8351ddc36a6b66d7c890a87e3c6a1d3d5b152035280739e216220b6234624693a437ae3037df8bdedff5

Download Submit
/storage/emulated/0/crash/crash-2024-06-10-23-11-36-1718061096787.log

Filesize
1KB

MD5
a52fc6019361b2bbbfd84f616c435c47

SHA1
581762e1bb94ca479927dd1673ddd99a9e98e612

SHA256
5026ad2d273d2877e46a50a709c2b20a65285247e09f681b98ec5ce2794d4e01

SHA512
a61091dee8b494ae35dc3937b1a5560c62a475888e11bdd0d284e6d4a603559f87994d018a6d471487296609fbe9bdeaa0b5d27b7623bdc5d02698e4b0afd025

Download Submit
/storage/emulated/0/crash/crash-2024-06-10-23-11-37-1718061097087.log

Filesize
1KB

MD5
981a8fc8fe4691005be04a22de296d59

SHA1
e996ba4efcacc25264470a43a5971acebbfa9e0a

SHA256
3af6bb327747a376e8ccac722307f6a6e9b88970b6fee717e9fb46af30c2d07d

SHA512
9de5336559ab3e3b7ab1f6b33744d8341b6ec00123b7b669b5403d1cc24bfb58f54bf1aedac7e355d459e77f3342fb0e0520a93c1bb0bd318cc92abeaa362392

Download Submit
/storage/emulated/0/crash/crash-2024-06-10-23-11-37-1718061097532.log

Filesize
3KB

MD5
0fedfbc028754d9266fc13079ec2d16e

SHA1
2c6328498da45c95cb7d5db03ca1d86b0749d300

SHA256
e17676f7698dca049da0e8b2655756f18a17cc029293010108864f40df8de1c8

SHA512
13025815c456b0f5461122d1e4d341d09f3be9b08e7c73c3c21828c5e93b3088f155df2be09a8ffd1e7a0c1d0283322d30b39eb3634ef861c1b59dc69c1db0e0

Download Submit
/storage/emulated/0/data/.push_deviceid

Filesize
32B

MD5
8ba1fb020641dd6b3b56cabb962dd98d

SHA1
7db61d4f3a71e5169586865a2fc2d38d799e86dc

SHA256
95ca9e64ea68ecdcba0a6fd4d3c99b68f319f9fff4aedffdf65714514a6babbf

SHA512
e9795fa35abaf94674751fea48ff621e7b4a2a30c5c400b0d9f11ae851d8ba902f29759c1e4756ee143d9cd93a1751c28ba71ba3ce4648bcc1d09f607b745987

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads