1433cb7c7c8f8bfe719fdaa75bc8a529814990b6d5b6bc8ecd8cad0aafdc1efb

Analysis

max time kernel
125s
max time network
178s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
10/06/2024, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b718f387cfb3a0377dbe8639dfb8ca1_JaffaCakes118.apk
Size 15.0MB
Sample240610-vxfe2atfnc
SHA256 1433cb7c7c8f8bfe719fdaa75bc8a529814990b6d5b6bc8ecd8cad0aafdc1efb
MD5 9b718f387cfb3a0377dbe8639dfb8ca1
SHA1 8733ff8f930fec5734e00167dd0dafc205449465
SHA512 5c5d2399afd3bad1892da2dbb8ecb1395dc1fb5727a44706eed8e4b1005aab2779c97a0bdece4af43ebe62c7460e2c189dcf62770dc50ca3feaefe9bb37d7eaa
SSDEEP 393216:54suCmwMsDj/FtQ8rDVSIzGFsFkVx5VWtPqz:5DuCOgtQeGpV/VOQ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 6 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/data/local/bin/su	com.buyou.bbgjgrd
/data/local/su	com.buyou.bbgjgrd
/system/xbin/su	com.buyou.bbgjgrd
/system/bin/su	com.buyou.bbgjgrd
/sbin/su	com.buyou.bbgjgrd
/data/local/xbin/su	com.buyou.bbgjgrd

Checks known Qemu files. 1 TTPs 3 IoCs

Checks for known Qemu files that exist on Android virtual device images.

evasion

System Checks

T1633.001

ioc	Process
/system/lib/libc_malloc_debug_qemu.so	com.buyou.bbgjgrd
/sys/qemu_trace	com.buyou.bbgjgrd
/system/bin/qemu-props	com.buyou.bbgjgrd

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/qemu_pipe	com.buyou.bbgjgrd
/dev/socket/qemud	com.buyou.bbgjgrd

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.buyou.bbgjgrd

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.buyou.bbgjgrd

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.buyou.bbgjgrd

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.buyou.bbgjgrd

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.buyou.bbgjgrd

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.buyou.bbgjgrd

com.buyou.bbgjgrd
1⤵
- Checks if the Android device is rooted.
- Checks known Qemu files.
- Checks known Qemu pipes.
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4500

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

1002

Path /data/user/0/com.buyou.bbgjgrd/app_crashrecord/1002
Size 227B
SHA256 a453fd4eee51c8a87e47ff92882683a141ef82a722642ffb9be2b96bb5e589ea
MD5 4ba51479295b40c4e912235f90306069
SHA1 38ff6951d9c7521e0ed4ba6638cd8c72d7ba7671
SHA512 bd55d6896fef7c0ef595b217d2f8d6adab003ce41960c5aa13440234aae5f9c2bef45b5d7f3c66cc371d20bd3601e99c6510d2fc29a1cb61b9b80ac2ad404007
MD5 SHA1 SHA512

Submit Download

1004

Path /data/user/0/com.buyou.bbgjgrd/app_crashrecord/1004
Size 227B
SHA256 a5b25a93c5946c2864a33f0f09959b6ba2b22b5594159cb13a614127d95a98f6
MD5 e8e445055b3b528d07e0b18dca65cbef
SHA1 11c41085e73acfc5255ee7dc5eea35aad64feb7d
SHA512 7b289a38f26001ed9d7490753f12cbcf1b0154fa3e63bf1498a8647f817b940e9399edfa597f4581552189f36e5d203d8fb8ffe5c514878f03341ec3ed1fb04f
MD5 SHA1 SHA512

Submit Download

1004

Path /data/user/0/com.buyou.bbgjgrd/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

bugly_db_

Path /data/user/0/com.buyou.bbgjgrd/databases/bugly_db_
Size 52KB
SHA256 1aa83fd4f0e68f3feb39ccf1e84a1b9060934e2cc0c4187947b22fa54a3f9e72
MD5 51343291f96f0e580fc6871109b09cfc
SHA1 8d4bd73120e43657fc89dec29655eff83023403f
SHA512 7bdd1113956750ebe4e339350c68b55b973e04be800fb95a72ab7c0ae29ea1cd8b4f38497ac23a7926805784f61bcd4408422e06b942b68b55db633c7a20ca55
SSDEEP 48:TAX85WuAriStwwuMN5meposSCOA1pWS2xCiNK:l53AzwCw3NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.buyou.bbgjgrd/databases/bugly_db_-journal
Size 8KB
SHA256 f515dd782fc6f79fb0eef838d12b8efb526f23d0040d75f59a4dd861f30e01e7
MD5 43e85efbcf770bd2a625391ed18e886f
SHA1 ca3b045ed460756a3f8e1ba1e6a5c115e8914466
SHA512 530453ca4457900cdbe4511e455d6a41c268fd59e567a764bfc249ef8f6e78846375a890482000b66a78f9dc0dd35287583e6a42169605114a50f49909911008
SSDEEP 24:7+tgsqLL4XBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGS3:7MgsqwX85WuAriStwwuMN5meposS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.buyou.bbgjgrd/databases/bugly_db_-journal
Size 8KB
SHA256 7fd66c8ebc38a3f88b43ff253a2e0ae14c03fa3d104607ccad2538d650b26ffc
MD5 446ce6ecebec2b644f82764da7394cf5
SHA1 7d00b9ccb9fdd65df23a82326dc7e25e91808d15
SHA512 46d96b2f7a2cecf053edd96f226106b26a2959f0a89418b276463f4ca6902ac310896e08871f5b632a856fd242e81951d2b7b643f609c9ee0af2b7b74563af19
SSDEEP 48:7Mk2FS2xCiNKqqgX85WuAriStwwuMN5meposSH:7A3NKq053AzwH
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.buyou.bbgjgrd/databases/bugly_db_-journal
Size 8KB
SHA256 c61a86c0ec8187585ff9083ea6be7e1d4c6d44654f097c4809113a7b18cd0187
MD5 43619af10477a0def83cfb0ef78637ea
SHA1 7edb3b28452bbf2cec7f0f60c1ce154e024fcf88
SHA512 fdf599083c097e2f21f5cdd46ac3e13e7b9cab1113084256dc0853d1e7204b9e77d73a0ad9d52acdeea3255684d9c9928a1c9e914d131fae9c2c01b088ba288a
SSDEEP 24:7+t4qL9HSXBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSy:7M4q5SX85WuAriStwwuMN5meposSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.buyou.bbgjgrd/databases/bugly_db_-journal
Size 512B
SHA256 cb6a7ed9d86f3e44c39729df0e2176941d7b7266a1cbe3ebafddccb113d45fed
MD5 face7e994cf815f5479644f990b5c705
SHA1 ad71e074eabd8870267d5fa7f98b3106b4c2cf0b
SHA512 f797240ed56632749ef7ce1acf9ac25d33876e7bb6a21e98f68bcc713859a3c95d8f2ddb90a3a9d04cbed4e566655f721ff218e9dafe2411ca329091d8540548
MD5 SHA1 SHA512

Submit Download

bugly_db_-journal

Path /data/user/0/com.buyou.bbgjgrd/databases/bugly_db_-journal
Size 8KB
SHA256 274e8eeb6cb330776b50aa50667a14413466706f381a7b81e3418cbdc1b69268
MD5 6dcba98af2c7a65cb16c51d391dd3814
SHA1 a7c823fb14f2b67bb03eecae42e067caf8a828ae
SHA512 3db7ed31b0593305773d60925c945ae85340d6be1aef228c3af9b6132b7d036ef1ba7d24968b0a1018800306a9ac3e7e89f4041de95ca4e6f701db99cd289521
SSDEEP 6:7+/l99Xgn1Tl/ng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKmln:7+tPcl/nqLiuWdYRmBEyPbXln
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.buyou.bbgjgrd/databases/bugly_db_-journal
Size 8KB
SHA256 85c36f8fb1a30a63a3ad43917423938325192359e12800ef25610e212a4c5e48
MD5 b609d6e25b9e326ff377e7b215e66a45
SHA1 e1521a8ecc7261e17b8ab155a6f09624fee35242
SHA512 384d4d6ad3d130fdebd840d1516f5d31da044e2fe51f8e5a898b91f4be5e0d42f55905a3db02a8b8ab0e0eaf2a1c93f1c366e74821d0bde98c11d012cefe4c65
SSDEEP 6:7+/l9mgPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKJnM/a:7+tA4qLJdeWRmBEyPbYsa
MD5 SHA1 SHA512 SSDEEP

Submit Download

pri_wxop_tencent_analysis.db

Path /data/user/0/com.buyou.bbgjgrd/databases/pri_wxop_tencent_analysis.db
Size 44KB
SHA256 0cb364f2b8459fcb1c39c4470add3c267f86acf5484e6f5ad1494ec7bb3622d3
MD5 d49d7954856af1367cc4234003f83406
SHA1 2b14125332ff63565c83027adae8d070d21a870d
SHA512 290e016c5748d77d4abf604fd2d5ce15c5ec18c36c9e030487f7759fffe7410fe18f46d8335f03f7cd120b87b24f212929f6c585948859b69493fd6958b35068
SSDEEP 24:TLV0nuJ82cUO3vrOgSDQ/PoISKIDT8GS+GQeQ:TIuJDOfr6UPmlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

pri_wxop_tencent_analysis.db-journal

Path /data/user/0/com.buyou.bbgjgrd/databases/pri_wxop_tencent_analysis.db-journal
Size 512B
SHA256 08fc96ea7fbf12eff27315b32836fc5a539a3ad40742d4e6843457767613f73b
MD5 67a477fbbfca687613c4b03f79e692b9
SHA1 776175c9d38f1ebabb30b89f6de9f8bc03f78015
SHA512 030c1cb523f5c965f76f11b16c91c0644ce8ed575505819a5f29ca22bc60e6238ba24f329096cd1879bc1d7993883446a7d291c9d1ee6d412709f7734e46ba51
MD5 SHA1 SHA512

Submit Download

pri_wxop_tencent_analysis.db-journal

Path /data/user/0/com.buyou.bbgjgrd/databases/pri_wxop_tencent_analysis.db-journal
Size 8KB
SHA256 d574020c824399765b82cf64d3cf6e996df85390c133e1ad976cd0a1796f5c3d
MD5 d78d7f72e8ceda4b03e231e2db1fea68
SHA1 e022b49d1c448b2151613f1158fa62c5284653cc
SHA512 46dc29e499191db73d055135e7603a020a303832c6438fe8ad08d46da492d0a77daf30722ff3a565e8ddd74f97c394296187d5ebb912e42e402127e141d1f159
SSDEEP 6:7+/l9Ty/gn1wFng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK3:7+txy/xFnqLiuWdYRmBEyPb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

pri_wxop_tencent_analysis.db-journal

Path /data/user/0/com.buyou.bbgjgrd/databases/pri_wxop_tencent_analysis.db-journal
Size 8KB
SHA256 4521c2fbcd54caccd34540d18a522f57a79fec6bd4ca125662558e3035ee3365
MD5 d62bfff45048f3a79823f1c381b003c6
SHA1 6045740da968ca1d51910842296cf64a3bef49fd
SHA512 34c56f530c1b6c81771eeaadeedc137b617485ee8b58ae46f6c7f10be960f1f65a72df74e0a0e5498c4c5443ea7ef2ceace111a2dd9a1f303e19c72c78c4403a
SSDEEP 6:7+/l9kjrPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKuI/Cw:7+tMqLJdeWRmBEyPbfICw
MD5 SHA1 SHA512 SSDEEP

Submit Download

wxop_tencent_analysis.db

Path /data/user/0/com.buyou.bbgjgrd/databases/wxop_tencent_analysis.db
Size 44KB
SHA256 4c5f50759da09c311146547fb6aa45d315c4cced0c6b22d1bf776dd9cd4ee8b4
MD5 26ccdb9a8a8e0d40b0d9377bb7ea8643
SHA1 3df69f38db13b01cb6633e5ca8cc160ee2721f05
SHA512 25268dd22b681232e42c32e15bcd3bfc12ff55c808f81d361c61205285520bfe9f25b02c9811160c2c43db2395b1e99851ef94960650bf4407cf01e434defb19
SSDEEP 48:TTbJDOfr6UPmlSS7jiGcrb0/Cjgb55Iqv19sYvku27fRT5nLsDKMXD1:36pJqjibrwajgbLIq///2rPpYx
MD5 SHA1 SHA512 SSDEEP

Submit Download