ede0f85cee4a2e3fb6b23de922055a758de78a12ba22a3e8ad1087703fd6af78

Analysis

max time kernel
71s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
10/06/2024, 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ae837da8ace09359db1c22803e159ee_JaffaCakes118.apk
Size

9.4MB
MD5

9ae837da8ace09359db1c22803e159ee
SHA1

82e6b28c767419eb27b94ae99178692f5e6e403b
SHA256

ede0f85cee4a2e3fb6b23de922055a758de78a12ba22a3e8ad1087703fd6af78
SHA512

38adae51ac08ed9e0b444d7af3e927d24d5fa4f3acb61de961e8d9a8cbdd8a7b71e7cc7d5462b44697a14c3ef3df1d423ae5387e7aeeb1dae33ee474bef79ae9
SSDEEP

196608:k4fYOOwHw8aBljU1x8CjKryuMXtiIJHRSwWDNRHRewNwU:kKJQ8aQJjKry1oIJHRS3HRe8p

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.nlm.nlmmaster:pushcore

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.nlm.nlmmaster/mix.dex	4290	com.nlm.nlmmaster
/data/data/com.nlm.nlmmaster/mix.dex	4359	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.nlm.nlmmaster/mix.dex --output-vdex-fd=49 --oat-fd=58 --oat-location=/data/data/com.nlm.nlmmaster/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.nlm.nlmmaster/mix.dex	4290	com.nlm.nlmmaster
/data/data/com.nlm.nlmmaster/mix.dex	4399	com.nlm.nlmmaster:pushcore
/data/data/com.nlm.nlmmaster/mix.dex	4399	com.nlm.nlmmaster:pushcore

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nlm.nlmmaster:pushcore
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nlm.nlmmaster

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nlm.nlmmaster
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nlm.nlmmaster:pushcore

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nlm.nlmmaster
Framework service call	android.app.IActivityManager.registerReceiver	com.nlm.nlmmaster:pushcore
Framework service call	android.app.IActivityManager.registerReceiver	com.nlm.nlmmaster:pushcore

Checks memory information 2 TTPs 2 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.nlm.nlmmaster
File opened for read	/proc/meminfo	com.nlm.nlmmaster:pushcore

com.nlm.nlmmaster
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4290
- sh -c getprop ro.yunos.version
  2⤵
  PID:4332
- getprop ro.yunos.version
  2⤵
  PID:4332
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.nlm.nlmmaster/mix.dex --output-vdex-fd=49 --oat-fd=58 --oat-location=/data/data/com.nlm.nlmmaster/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4359

com.nlm.nlmmaster:pushcore
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4399
- /system/bin/sh -c getprop ro.board.platform
  2⤵
  PID:4428
- sh -c getprop ro.yunos.version
  2⤵
  PID:4461
- getprop ro.board.platform
  2⤵
  PID:4428
- getprop ro.yunos.version
  2⤵
  PID:4461
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4582
- getprop ro.build.version.emui
  2⤵
  PID:4582
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4610
- getprop ro.lenovo.series
  2⤵
  PID:4610
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4634
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4634
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4658
- getprop ro.meizu.product.model
  2⤵
  PID:4658
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4683
- getprop ro.build.version.opporom
  2⤵
  PID:4683
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4708
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4708
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4735
- getprop ro.aa.romver
  2⤵
  PID:4735
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4778
- getprop ro.lewa.version
  2⤵
  PID:4778
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4804
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4804
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4829
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4829
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:4854
- getprop ro.build.fingerprint
  2⤵
  PID:4854
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:4879
- getprop ro.build.rom.id
  2⤵
  PID:4879

com.nlm.nlmmaster:pushcore
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4996

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nlm.nlmmaster/app_tbs/core_private/download_upload

Filesize
84B

MD5
291b6495ea8cc484755d5cecfded1d48

SHA1
14113de9ca03fa9436b744f16d4ba934ea52e9cc

SHA256
176c0579b7708dafcea27644f49b5bccfbbd6eb4aa8d1bb85e01eacf9ddce193

SHA512
644d5258596ad31e13206ac5c8a4c448d864a9bcb11a936df95592eb369e905c8b44002d65f8a8506c89303e3b6d0d917384eeaecf5e94f419cf435090bed08d

Download Submit
/data/data/com.nlm.nlmmaster/app_tbs/core_private/download_upload

Filesize
84B

MD5
6474eba054b35f1d238c446e4276d8e8

SHA1
5af1028d6048d67200974a3dee7fae931d2f85cd

SHA256
a3e0b4a76c06e80528817c89bf762f6d80d2fb85458cdbc1baf009c565dc2abc

SHA512
890d6abd1445fa2ffd4f099c1e5285a4f843eb95dde98f9bce4a1a58a3ec47ebc13fd434cb9338e55fb372ac55d1e50505a71de2ca5cf130a3bac3b1b3a01afd

Download Submit
/data/data/com.nlm.nlmmaster/app_tbs/core_private/download_upload

Filesize
56B

MD5
6865cb2b6fa422ee615e1c8c043a172d

SHA1
ac5cf0bef227b0b6440fd143e0cc024a0b563c55

SHA256
73b511aadf89ecfcf07ee9ae1641e24c7851c0f35b67f64e36595a92b41b526f

SHA512
613ad3ad48dcb51b3d1a14714bd2c9ecaf6411f5f6c478f8e002ff081c3aa4945b792319adfaf1683724f7949d7a2eb6b4d01e2599cca4fd9e2afec32db3f898

Download Submit
/data/data/com.nlm.nlmmaster/app_tbs/core_private/download_upload

Filesize
56B

MD5
e26f7889e724bb4c9c19f47b716b9d05

SHA1
450ca0cd6503d4e04fda37938d1b99d73b38f3ea

SHA256
907174f832e388a9035d3b814baccede6d2b7e7e10cda1b7b11c2268297d0e64

SHA512
f50173d332a38828c1cbc364adc4c8bb1a9f1f09f0245d5da0c2f8db6400280b3d7cbfd2f43d5006f4337f5e02a67056f2dcabf74e008b4df23bed60c8450799

Download Submit
/data/data/com.nlm.nlmmaster/app_tbs/core_private/download_upload

Filesize
84B

MD5
4b17ccafa9f9c7c48bab14294ccdcc0e

SHA1
612e753e49d75ae5706a00747283a0fddfa557ea

SHA256
9f280cce95a56c64fbbd3fa3947406b815fe7d2f3cfd43dab7b758588150255c

SHA512
0318e329e0eb198e45dcf2421279fa831de6699f1bc13c31756f46df1acee89380838eac0e2c9f52ba28a345a7b537c4003c3739ba2e5fe569479d9dd85a6a35

Download Submit
/data/data/com.nlm.nlmmaster/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.nlm.nlmmaster/databases/bugly_db_legu-journal

Filesize
156KB

MD5
ce26cba2a2176b6d6d6e6bb089727db0

SHA1
324ff8da12a6ec699e7726b18dcdd015bc05add3

SHA256
7990c78f02e8f65820abc0c0cc9589ab5abbb5b1fa6d73fdb177bc9e882c5cc1

SHA512
8e6a7451ced4152d4c3362c00d70f0afbd3f36d8505ec34fa43bd17d2629799fb8b59d853e0adce3dae528743b6205a83f00192615c91e28ee5ac858c7df412a

Download Submit
/data/data/com.nlm.nlmmaster/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.nlm.nlmmaster/databases/bugly_db_legu-wal

Filesize
92KB

MD5
5b2c25d73dc6d29b3e097283a6b8b830

SHA1
f137a8fc640b5045a1ea636ac16c140a33cf36ec

SHA256
6b929b19bf535b5309e4290eaa197a5e04131f67d9097dddfaddc5a49a6814b2

SHA512
afe235be2f730b430b3d7e6a16f4cf234706b61d674e39049438d00a9689dec7ccbfe4f77786b100972f06acb91af20c4a3fce7993ab52fa5e329a4771efd684

Download Submit
/data/data/com.nlm.nlmmaster/mix.dex

Filesize
292B

MD5
852332c7d1fbbc5859b5271875deeee5

SHA1
8cd6c12a45a491a26512ac3eb1812459a7374480

SHA256
5d1a736dc8270dd9b72d796899b15669d47fecd4fd42b0f80e89797cefa47d2b

SHA512
5aff83513d04abb6ee9c0afcdda95a46dc899b497d6cd7f99025ea827cd5d2591f728b8d789d06f22f9d5a0f4aca96dab1e1bb4265470dcacc634b46e258c12f

Download Submit
/data/data/com.nlm.nlmmaster/mix.dex

Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit
/storage/emulated/0/Android/data/com.nlm.nlmmaster/files/tbslog/tbslog.txt

Filesize
5KB

MD5
01c772e2b24817f67f5a82989a46ab22

SHA1
ab3971c1dfe8c1f77603de748749c51181a2b710

SHA256
02ca3015e0647f6f2422efbbeecb977487510fb3f33c68e2d2a0528e33af473e

SHA512
feb6fa47586b90e3061ec8bb63928fd9cdc591359a519304a488efefb0b96643cbd436ea00c06e2248f2bbc036b24c35b4c9a673998260a1b95edc8760213940

Download Submit
/storage/emulated/0/Android/data/com.nlm.nlmmaster/files/tbslog/tbslog.txt

Filesize
2KB

MD5
b3c8a909ee7873034da85abf1af7c866

SHA1
08a5bab845a81e4a22f920ebc1594e82d36a2e54

SHA256
22429212ef255b8dd01efa83eb7ce83fd31127515a3a555cf2ea5d07afdef13b

SHA512
a46463ee3787be798b3bd5785636f74fbb404dbbd7f045e138027ef3bc32bcd6953e21794ca78b84f5ba1649655f052f2de4b5d140a6d1c6684bde25fcb03c8d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads