ad61daaf858ae5d9fae01eb15fb57ad679e51e2b3314d110b41e10bc703e91c9

Analysis

max time kernel
157s
max time network
187s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
11/06/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c85c902fe4fa92a70bf7cc6699d8538_JaffaCakes118.apk
Size 30.1MB
Sample240611-bfpslaydkk
SHA256 ad61daaf858ae5d9fae01eb15fb57ad679e51e2b3314d110b41e10bc703e91c9
MD5 9c85c902fe4fa92a70bf7cc6699d8538
SHA1 1530cc383c8b55a6145d65cb266350f641c0d5bd
SHA512 788668e9dc874489ac4b859ed0d13760311c5fd60f077a973d2c5df0bc1aa1fc4dbae111e432e0ac2f48ee69a2245e8cb8574166060a1641750a9e6403939104
SSDEEP 786432:fUMMeAz3SkwikLsUlvr5dNP8HzB8+7ftlAIwiv:fUMxAz3A3Lr3NPg8YlA2v
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.ctvit.cctvmusic

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ctvit.cctvmusic/[email protected]	4501	com.ctvit.cctvmusic
/data/user/0/com.ctvit.cctvmusic/[email protected]!classes2.dex	4501	com.ctvit.cctvmusic
/data/user/0/com.ctvit.cctvmusic/[email protected]!classes3.dex	4501	com.ctvit.cctvmusic
/data/user/0/com.ctvit.cctvmusic/[email protected]	4617	com.ctvit.cctvmusic:pushservice
/data/user/0/com.ctvit.cctvmusic/[email protected]!classes2.dex	4617	com.ctvit.cctvmusic:pushservice
/data/user/0/com.ctvit.cctvmusic/[email protected]!classes3.dex	4617	com.ctvit.cctvmusic:pushservice

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ctvit.cctvmusic
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ctvit.cctvmusic:pushservice

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.ctvit.cctvmusic

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ctvit.cctvmusic
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ctvit.cctvmusic:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ctvit.cctvmusic
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ctvit.cctvmusic:pushservice

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.ctvit.cctvmusic

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ctvit.cctvmusic:pushservice

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ctvit.cctvmusic

com.ctvit.cctvmusic
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
PID:4501

com.ctvit.cctvmusic:pushservice
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
PID:4617

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

libjiagu.so

Path /data/user/0/com.ctvit.cctvmusic/.jiagu/libjiagu.so
Size 486KB
SHA256 c8d37512f73bef5a1c1b060676cdc6d508a8d8dd36f2438f5d6353c9b8524bef
MD5 50750315eef281575611bc425174b939
SHA1 acaff02526d7b4c257e00002ed09af364f66a401
SHA512 60584a993992a68e8d0a53be705e3a9d52fc126df26b9bdcf80d14e659f1d70bceb926e0a99a69fdf40f1c09fd61aa52c2d2c008ee5c3ef59af5922a75161ea9
SSDEEP 12288:n9fCZt8eCRQ5P6i3gIj8pGXDlIP3PWf8x4Z3EjWPG0k+:n9fwmM6i3w4hIPy8x468G0k+
MD5 SHA1 SHA512 SSDEEP

Submit Download

[email protected]

Path /data/user/0/com.ctvit.cctvmusic/[email protected]
Size 6.5MB
SHA256 0df5bcdfdd5dfc922e59f561913498824e9ed09237678e4b1a328556720321cd
MD5 fd7b53da69352e78bd9f9efc068977f6
SHA1 00f3c67434c647c0ee2f05f5c343d602e8dad14e
SHA512 3645f23351591425211e9dbc8c24f4950ee8f5ad9d4f268bd03c8f321fc7de35538799437c64e195c17a99de2ee7aa4f93712aefad6b1caad0bc037806c14ffa
SSDEEP 49152:EJHoVkpzQJGFK62a0Jld6Pja0fApasFYy5Bnud+4sKz7PeBMknfQisND8n:2oVWzQQK62P5pasuyej3AfQMn
MD5 SHA1 SHA512 SSDEEP

Download

[email protected]!classes2.dex

Path /data/user/0/com.ctvit.cctvmusic/[email protected]!classes2.dex
Size 6.7MB
SHA256 d46d1e8c5cc2bf869903d5fc2a4f9a0f5fc222f97395cc4007fed9f659d0d606
MD5 9166bad9e7660ec16014ae0cecd09f2e
SHA1 db86719ddee044617a5c956365f8bd0800d5126d
SHA512 236357065dfc5d8e032bfa99517a2c57f2ffac2bc47e1d9a2c959b1b4ada7c2c634b57405c8f5f31bb457e12bb30d4123ad225042bcea220219b122f59aaf664
SSDEEP 49152:7HLBLiOJ2sqTENQE32I1u161J+CbAxunz3Yf4bsMe7zvC91T3OMkMwjYGXMjIf9A:jLjXjC9875DLmlUUy
MD5 SHA1 SHA512 SSDEEP

Download

[email protected]!classes3.dex

Path /data/user/0/com.ctvit.cctvmusic/[email protected]!classes3.dex
Size 242KB
SHA256 c051ac8d6096bd4c4d2b10cc0ecac9d0ee589db6ed1df5e0dfd8996917d12e38
MD5 1000aba008ba91159e5f2c94aece9b43
SHA1 eee548e59e8d3173d91465d8aed3e6db32659183
SHA512 9698c26eb0963102397b5b1de8ea662f3497c34d99a37c38a1ae44ce70c3ef1cbf9bea233d518c78e8d25fa9df165a2b6c84fba99ab5209c9e6f1f495626f2b9
SSDEEP 6144:n1QR2V1FtXvrhpU5mv5SGHX4EiSiNcyly8b0eWe41NhNltZZQMecaf4AxQhEz7fe:YMecaf4AxQhEz7p3wDN3i9Uvb1
MD5 SHA1 SHA512 SSDEEP

Download

gtc.db

Path /data/user/0/com.ctvit.cctvmusic/databases/gtc.db
Size 20KB
SHA256 188ef14eb28d918cc12c52035f1cfbc328d1f28542df82131eff5f408456c5b6
MD5 bc40456c9b747ff6b07a45e860770264
SHA1 b4d53b9f6d6a145f0ec6ed115610e30f4ba64bae
SHA512 0185ea41c2083853a87c5c9ed6dec146510d50f40a71c0a9c2742208bdb9e5c8d5af44eadc99edec69c92732b0691e661228bdf6be50a8005886b38cf710599a
SSDEEP 96:8a24wPTU2DzfcvlFI+4wPTU2DzfcvlFkAYp:8R4HF4H0p
MD5 SHA1 SHA512 SSDEEP

Submit Download

gtc.db-journal

Path /data/user/0/com.ctvit.cctvmusic/databases/gtc.db-journal
Size 12KB
SHA256 86ebee5a146c53a7a4a746200d73c94b93daa462be60cc3ac0af24a08c68ffd9
MD5 ff9eda341c8d3299c81db0e833c3d7cb
SHA1 55dbf39b44ba8d142e90d97927267541b116377d
SHA512 66cf89db0f4b2e7868394cb9dedffd6ac622a1c47612578bf4e304959ba1ad88cf435d67cb5ceb3dad91b23942dca143272a7163f8de1870f5acd1bae38d2cdf
SSDEEP 48:7MgOcWdxCVxPTU2DbPfcvlhzkAgqeygPSO:7j4wPTU2DzfcvlFkAg3aO
MD5 SHA1 SHA512 SSDEEP

Submit Download

gtc.db-journal

Path /data/user/0/com.ctvit.cctvmusic/databases/gtc.db-journal
Size 8KB
SHA256 411e7c2c8c48eeea8e9830fb484fff43751f43232fa5d8678911c0f46800a7fd
MD5 af92819e55bfe5d64729aace09a5a3f7
SHA1 1dae6d4bed227b303b37aba9e6de978d88ff2ef1
SHA512 fa4cbad8b5caa22ea0b8f6805630bac7dd56f1e7be2a5f553e7888ad01d780deb6a8b113aa7aa5b80ed29a49c5caeaccf53fb84d1d5de5030f0553c5cff4ba28
SSDEEP 6:3Fn1Wg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK8Qn:3CqLiuWdYRmBEyPb/Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

gtc.db-journal

Path /data/user/0/com.ctvit.cctvmusic/databases/gtc.db-journal
Size 8KB
SHA256 598ed55c0b832a6dc0d741f35b6ef78e1b0cb9ab0cd75d062dd9cfaebc85ea04
MD5 57434a80330fa8f0058c69fe757f54c0
SHA1 0ca16c073c61216ebd58164c49ce1847b6fed82e
SHA512 fa7218f6bd646971604e5ba340156cf1537d58c1848ef65013fed9c7494f1cde095e9e54e2ed48155581db25fda9cc633acf06e5152421d4137c511f3ddf7a0f
SSDEEP 6:+gFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKkl//:dBqLJdeWRmBEyPbvX
MD5 SHA1 SHA512 SSDEEP

Submit Download

mwsdk_analytics.db

Path /data/user/0/com.ctvit.cctvmusic/databases/mwsdk_analytics.db
Size 20KB
SHA256 27385cd4cab6ad52c6e79861ede0842b298e0c19c325f7440840b8249860bacb
MD5 ed64bcdef470216ce5db5b4b0d0399f1
SHA1 5f296bf333f4d80679c0ca04b52e63c3ddd7ec1b
SHA512 0099265cfff88cb27f6fc3d3be8c6c4184f50bcf581b7436fe7933c8d2e91a198e6e04baa057cbc2d6906498e4678919a717b2e02f604dacce3ff25463caad48
SSDEEP 12:TLmaA6tqyNTSFby1uviBkcqIzztRmBEyPbAVOwG:TLXA+/avi7qFGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

mwsdk_analytics.db-journal

Path /data/user/0/com.ctvit.cctvmusic/databases/mwsdk_analytics.db-journal
Size 512B
SHA256 77e7e123f8bb2b82b97d973051bf2c1b3111f3be4c0a66637758d0ef717095f4
MD5 b18254732ee8c4d8ef5fdea9db50ddfc
SHA1 2fe526f8fc0229a41f8201d11e4bdd8d8fd6eb51
SHA512 5341329883efad2e07176247f8e653563434db4630308cb1b93423cc71a301128438c043c1604ab09f9e02b6e9c29925f6cbf229aee7e7e6454b8f4becf5c41d
MD5 SHA1 SHA512

Submit Download

mwsdk_analytics.db-journal

Path /data/user/0/com.ctvit.cctvmusic/databases/mwsdk_analytics.db-journal
Size 8KB
SHA256 ae7716ada737c5b73fc12ae8039a04d71c0cad6d8e763b41002c092d9f4bfe58
MD5 53e4efab75ade3cdfc9f138c5eb07929
SHA1 94b066e323e73920a5a821a07a4da264f5e25d8a
SHA512 0d32768cb5e7da4c2dde6cd2ee061c0fe5488d0fae5abd3992c6b974fa080387994da6519b84142dcaac3314b1634e36cf41b8879e732612ed23a5359175b42f
SSDEEP 6:5htzVdyVIMd15Wg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKZ:5rz+uqWqLiuWdYRmBEyPbO
MD5 SHA1 SHA512 SSDEEP

Submit Download

mwsdk_analytics.db-journal

Path /data/user/0/com.ctvit.cctvmusic/databases/mwsdk_analytics.db-journal
Size 8KB
SHA256 494c35f688d9d25919c90680119212eae170bfed3c1e5d856a82bab50ade3c87
MD5 abb6f28be56faeeed3e52be1706fec5c
SHA1 c46efcc58d6d5bef4f18f1b1e8685b6cda2e5b34
SHA512 77e0305107a7e3ce2a941972db4bbb8fcc870cfa64df75f434c4a04bf25d0239a18af3c1cc77b2c14c27b8a33d5882f43bf849c288fcda3712e0c5f91f587a16
SSDEEP 6:7+/l9TPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKGMly//:7+tpqLJdeWRmBEyPba0X
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/com.ctvit.cctvmusic/databases/pushsdk.db-journal
Size 8KB
SHA256 29a1926ad5efe7550d0fcd1eb4aac88959ee5d94a9765d49885aa344aa53e76f
MD5 6bd5983a1c792938b08df50f96a1880a
SHA1 50cd020bc808febaf488ad97b02274a5ab0045d5
SHA512 e95848e92ab9a9d111638a4948efac3460dc1fc106de848f1b1a04980446fda8874c3736144a9708c14bd5c92e44985c94834f1a615ee15bf17f7ecc8d089499
SSDEEP 24:7+tvqL9T7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSP:7MvqRT7/W0xopA/t379y/MSP
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/com.ctvit.cctvmusic/databases/pushsdk.db-journal
Size 8KB
SHA256 53fbbcb31d3624f6e8407bbad4cd01ce542675173e9991f650778543b35113a9
MD5 dea94431cc190a3f793826ea7fc1f1e2
SHA1 1a5736d1ff1cdcf59ae5abef9c1649811a956494
SHA512 933e2ba6981e2564a5c70ff328421da18908fd049a23032b0ee0c117f68d297ceba8a4152fbdfb1087cdf2d97b8ed73f6fd1417225225b53a74873e421e223cd
SSDEEP 24:7+tgUMCl+aRc9UqL7Z7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSB:7MgT7QqXZ7/W0xopA/t379y/MSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

.jg.ac

Path /data/user/0/com.ctvit.cctvmusic/files/.jglogs/.jg.ac
Size 512B
SHA256 eeab65c60c1d913ea9a35212be6fde2c0bb8e2148d7523771b0e4c005f8f113c
MD5 46ef44d6bf5be050ca6b8481edcb2a9e
SHA1 1cd0f3f1d50b316be1cc33f16cc28ed3beed9f0a
SHA512 844b3ca184a3e605c47beee0dc13635875c380770b3957be5c1d9abc6e3525c0e9a096b4212cb47823c0244be831068680fc098daea86b404615f6c5c50bb26e
MD5 SHA1 SHA512

Submit Download

.jg.di

Path /data/user/0/com.ctvit.cctvmusic/files/.jglogs/.jg.di
Size 8KB
SHA256 48795d76760b36619b98b57c36fa093ece3e2fd0255dbdc5eef8de42ce706de6
MD5 a9f565fd0bf9f80b2bead96a205c66d2
SHA1 ef5241caa4ac06de983986c4f38ea3e898ad4670
SHA512 3537b86a3cc94eb6ff3ff4048fbd70839ea6414cc7e3255142ca63f6cb9f4dca0eeba0b60c3e312da83c644342637b80ab48be2922c1bbbd36ceb3b0d1cbf328
SSDEEP 6:7+/l9wPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKgvM/9:7+tqqLJdeWRmBEyPbVvs9
MD5 SHA1 SHA512 SSDEEP

Submit Download

.jg.ic

Path /data/user/0/com.ctvit.cctvmusic/files/.jglogs/.jg.ic
Size 8KB
SHA256 8f71ece53b3f08c2b930d2973c9723184818ec80a477b5bf1e2991ae76050ecf
MD5 7c515211d0a5c58a0e2a92e5c6ce00ab
SHA1 c3ba6d0a75e56785cfb170bc6cce6feb9936da22
SHA512 4ce6f08a5290f4bb1cfeabf39b6416173fc5e0a0978220e099917b56f19b592616ed36342e6dad3159a79b4720e4d8642611870e26f869d1f4658c3aefedb559
SSDEEP 6:7+/l9R+6gn1gq/ng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKY:7+t5OqLiuWdYRmBEyPb7
MD5 SHA1 SHA512 SSDEEP

Submit Download

.jg.rd

Path /data/user/0/com.ctvit.cctvmusic/files/.jglogs/.jg.rd
Size 48KB
SHA256 e670e5f690b4a63b42499f98eff1a5d2da1b00e652a8353689a97e3be5e50e65
MD5 0a5c90782099447fdddc3823084e3ab3
SHA1 c02e67be7c11db20cecbddc58066de0632df38fb
SHA512 6d0315d62c5ff028f33a80dc923f66187abeececb223c0f525c9eef53b61c19e12616e938feea454da72a8a43b601084636ff5ae5edb30b4ea2bb6771fd0632e
SSDEEP 24:TL8bm7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSFCU9RCl+aRc9lQ+:TIbm7/W0xopA/t379y/MSYMR7
MD5 SHA1 SHA512 SSDEEP

Submit Download

.jg.ri

Path /data/user/0/com.ctvit.cctvmusic/files/.jglogs/.jg.ri
Size 314B
SHA256 df94c18404022ea65a5a80596d6ceccec13fd27e5fe820ac1086becbfea17782
MD5 a5c7186a54d99375937e862a497e34ee
SHA1 537a9226e01097f4862175d0d3fee27fd237a9ae
SHA512 5e0268d246eba68b1c040883b6997b3ae3a5d0af4f66387dc17df1e91b95c79cc5afaa059e7e6d15915e2a8dbde0e67ea18fc4f1dfa9ec01cb2eac7e269fcb88
MD5 SHA1 SHA512

Submit Download

.jiagu.lock

Path /data/user/0/com.ctvit.cctvmusic/files/.jiagu.lock
Size 27B
SHA256 489302bd46a64fc2850c08eef334f7f0d29e19412251deabffe817a9ce9ac9de
MD5 4e515de6921107523ac96babec84ce41
SHA1 40866576f69366950948f7b85c599e3845d09322
SHA512 fc305014583b2cbe9a6b8a95b2f40c9502f6a4f34e1c5d227815d477f494904bd7d88c56e7fd6d969284b404da40afad30f08a0d4e60eab2370ee0a4f138848a
MD5 SHA1 SHA512

Submit Download

.deviceId

Path /storage/emulated/0/360/.deviceId
Size 4KB
SHA256 71ceb9dbb1d4d66699c4e2fd796cb7eecb5b0095989bbeec77fd46356bf4bb86
MD5 4d71218ad8a4d950b23143add60558ec
SHA1 beba44826a4aee36f2c9601e3c686ff46c285cc7
SHA512 090b05e16b8b5b24911323c69641682547cc7f27fe6d927721a0238e3ab2ff5975c8fadf730fa03574bf2e519aad57f5ec74c310b35bdf632ecb70f8f2a9d31d
SSDEEP 24:7+tWqLqG7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSL:7MWqGG7/W0xopA/t379y/MSL
MD5 SHA1 SHA512 SSDEEP

Submit Download

.iddata

Path /storage/emulated/0/360/.iddata
Size 32B
SHA256 1915a3c3f74e8c5f60152a539f41f45894a7a66f57cedf095cbc55a65c0072e7
MD5 ab20284427c6b37f78f819fb725b5050
SHA1 a6ef68bc7dfa519c3179164e82c1d383462d55a9
SHA512 429b4b28fee1a9bac994f4d351d54c139ae5df46eeb2e63c8fdb05c423906137a2bed6fb45840a7bbe2dd98a3f1530062a5ba0dfb56679689035d1174796828b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads