Overview

overview

8

Static

static

6

9dea94099a...18.apk

android-9-x86

8

9dea94099a...18.apk

android-11-x64

8

dmss_v2.apk

android-9-x86

dmss_v2.apk

android-10-x64

dmss_v2.apk

android-11-x64

dump.apk

android-9-x86

1

dump.apk

android-10-x64

1

dump.apk

android-11-x64

1

dynamic.apk

android-9-x86

dynamic.apk

android-10-x64

dynamic.apk

android-11-x64

Analysis

  • max time kernel
    179s
  • max time network
    188s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240603-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
  • submitted
    11/06/2024, 10:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9dea94099a5a72301c93d0cf154e827d_JaffaCakes118.apk
  • Size 6.7MB
  • Sample240611-mt5xhsvbpp
  • SHA256 33bd223c3f1ed0c5ae5c6d8068f64dcbe6edfeb6e3794be2a7cbfa0e2362145e
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bankercollectiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    evasion
  • Checks known Qemu files. 1 TTPs 6 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

    evasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about active data network 1 TTPs 2 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
    impact
  • Checks CPU information 2 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.qihoo.appstore
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4551
  • com.qihoo.daemon
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4590
  • com.qihoo.appstore:critical
    1⤵
      PID:4784

    Network

          MITRE ATT&CK Mobile v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          360appstoreInstallHistory.db
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db
          • Size 28KB
          • SHA256 8b7c89cb3a969d6dd2bd30e05ef5dd2fab3ee87facd48a90057aff12b9c57f3c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          360appstoreInstallHistory.db
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db
          • Size 28KB
          • SHA256 7da57948c092aebf9ec6d31137293dfb969a2e378b059e2ee21f5955d2cb366f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          360appstoreInstallHistory.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
          • Size 512B
          • SHA256 33cd655f7a29a474998d25dce3397eb4e64959db81732acf4cde6c30034c1d5b
          • MD5 SHA1 SHA512
          Submit Download

          360appstoreInstallHistory.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
          • Size 8KB
          • SHA256 79414cf65539e5492f1a94590e1694d8b1226999e3722cd0726f5d73f6244466
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          360appstoreInstallHistory.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
          • Size 8KB
          • SHA256 07987ab28280bf650fa739acc011f3f8cd0626c27b20c9cbda8654159924448c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          360appstoreInstallHistory.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
          • Size 12KB
          • SHA256 d53679f91ab002e0cc324154075149bd51960f0719bebcf9cebd35e4e7a65746
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ire
          • Path /data/user/0/com.qihoo.appstore/databases/_ire
          • Size 12KB
          • SHA256 67b1e827a498e60301f0b57d15e0e342027c49266e8be14c7441dc7f774c299d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ire-journal
          • Path /data/user/0/com.qihoo.appstore/databases/_ire-journal
          • Size 512B
          • SHA256 89c286b5bee7ede60a23f4f1831f6b34b9758a86c7550fcd19c4455c2dc4cc36
          • MD5 SHA1 SHA512
          Submit Download

          _ire-journal
          • Path /data/user/0/com.qihoo.appstore/databases/_ire-journal
          • Size 8KB
          • SHA256 7f9d4dfc3e72fbcabae52da00858e70b7488b9289d42147ea2f79daaea67a7a5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ire-journal
          • Path /data/user/0/com.qihoo.appstore/databases/_ire-journal
          • Size 4KB
          • SHA256 0bd1d44aa7a820ba356feb0f123332a1126ca8e083741c9202c4a7b43c61a83e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          account.db
          • Path /data/user/0/com.qihoo.appstore/databases/account.db
          • Size 28KB
          • SHA256 dc0c24c777a762b585f1f5213b8c021d30be608bb38d823271d9eea42d60f5b5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          account.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/account.db-journal
          • Size 512B
          • SHA256 6288fc3b67a17366c03c919baa299e2243cc3382fd9ba5bc3186a540384f4f34
          • MD5 SHA1 SHA512
          Submit Download

          account.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/account.db-journal
          • Size 8KB
          • SHA256 e6676b855682e2d31ff174e6fe4208728d19a1be82d164a68fb09f359813e3c1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          account.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/account.db-journal
          • Size 8KB
          • SHA256 36c56a07f58d33593095e645205b0477dedfa226be8353dbb2c93e5341b60c83
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          download5.db
          • Path /data/user/0/com.qihoo.appstore/databases/download5.db
          • Size 20KB
          • SHA256 4fa428f67556731442b5e5de1783b0be4a56d178f52da67db539866892ca00d8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          download5.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/download5.db-journal
          • Size 512B
          • SHA256 cc0df24b5dfc06c26f8ff7836ed8227d5eb63047709018ecd5a017436d499afc
          • MD5 SHA1 SHA512
          Submit Download

          download5.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/download5.db-journal
          • Size 8KB
          • SHA256 50eeafb22668b96f3c2f0501efc23661afe90b04bb9b9f472f6f7fe09905a712
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          download5.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/download5.db-journal
          • Size 8KB
          • SHA256 0124bdf9e45ab9740a00f58b122901b8d843fb34076181115b5ba7d62e9d7202
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          filelist.db
          • Path /data/user/0/com.qihoo.appstore/databases/filelist.db
          • Size 20KB
          • SHA256 f938d5485ba3913e898c3199966b965f443ddbfeff0eca5e33ea68d058b77b11
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          filelist.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/filelist.db-journal
          • Size 664B
          • SHA256 95368298eaefbef6b546a7ecf0a9e78700e37cc1f185f12b15e544a51074ed32
          • MD5 SHA1 SHA512
          Submit Download

          filelist.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/filelist.db-journal
          • Size 8KB
          • SHA256 3f641d6e38c72d3014a5b9a36c66f195d928be20d6c6a836893722c5e7eb7301
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          filelist.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/filelist.db-journal
          • Size 8KB
          • SHA256 09b6c456e1094f5206fc0252212204d9bc52ccd35bf5977db69ae5fc26a33338
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
          • Size 12KB
          • SHA256 d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
          • Size 20KB
          • SHA256 c7697eef33212f41e3bcffe8434f3fd01700db4717bf1ea60cc0826604e13589
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
          • Size 16KB
          • SHA256 f788fa93ee15080a627598c189caff36a90ddede8510bf2d3b5496c028d98773
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
          • Size 512B
          • SHA256 1ffb568b52868a167ed7e5596429503184b9fa9e2a3c36d6cd2c68c4d3cf3a5d
          • MD5 SHA1 SHA512
          Submit Download

          ignoreupdate_appinfo.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
          • Size 8KB
          • SHA256 638247e84cf1855cfda5c8b55b40a94070562e5dcc4cc1731671caa1758e6bf7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
          • Size 8KB
          • SHA256 726e9238dc935f9c0fa92bffd75c0958da1600f0875f7d74755fb0155ee2bba1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
          • Size 4KB
          • SHA256 c023ff632dffea772fe4028219628d73cb0893f75147cb8803cf9831cc0b2aa5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ignoreupdate_appinfo.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
          • Size 8KB
          • SHA256 a152b1f549034eb131dc86dae35f4bcf418d5bbdce04e6b5aaa158126cabb102
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          new_downloads.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/new_downloads.db-journal
          • Size 512B
          • SHA256 cd8a199c6cef5ee0f1d56475bcb983756a6cd38dd288820b68c19e1f120d12c6
          • MD5 SHA1 SHA512
          Submit Download

          new_downloads.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/new_downloads.db-journal
          • Size 8KB
          • SHA256 39c28897308b81b7acc3a4a4cc3869652332c285c4b26339b9b621b327f89012
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          update_history.db
          • Path /data/user/0/com.qihoo.appstore/databases/update_history.db
          • Size 20KB
          • SHA256 cedf5ce8e27874c3b635b7ecb3c9c404aa00f6924b45e8901e4c723f8b76b52f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          update_history.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/update_history.db-journal
          • Size 512B
          • SHA256 8e1a376c38caeeaf2f02c3900c9684df2c00f4037ed319089330063a3f0bbb48
          • MD5 SHA1 SHA512
          Submit Download

          update_history.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/update_history.db-journal
          • Size 8KB
          • SHA256 c45e6fa89c967622429902d14b90654b59263e87cd7a1834c4d5c40709a8096d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          update_history.db-journal
          • Path /data/user/0/com.qihoo.appstore/databases/update_history.db-journal
          • Size 8KB
          • SHA256 2b3c8d9e518d8fe32ab57fd477be6ce2b712e882d8af04a6d839255e5a39ab57
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 580B
          • SHA256 c0fca41fe33a6770b311fdafd08ffd441767c8df288314c02379d93811148956
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 520B
          • SHA256 dbbc0874e5513388833c12788d3c41312d1e78a39c40b3ef0736e8e2954bf78f
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 540B
          • SHA256 68f5ab6bc9ff4a2bdc6589313686634f562c85a5d41fd489a8754556c23310f1
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 1005B
          • SHA256 4f11fbac4c14e60f53706eb2cf71bf63db2da1746b801edc357d59b3a1ce0cb4
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 1KB
          • SHA256 4725b4422c1beb15f71c08a7ac258dcd9b83aed24206085e5ee4b3c2f8eb88b3
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 1KB
          • SHA256 d234e149e665ef01478b86a64947d047af5c5f4950d757d73a810abbb37dfc73
          • MD5 SHA1 SHA512
          Submit Download

          Y29tLnFpaG9vLmFwcHN0b3Jl
          • Path /data/user/0/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
          • Size 1KB
          • SHA256 f6710b3bbcbb8240b6306187c43391cbc7f35755bed666691f7ed3d82c3ff1a3
          • MD5 SHA1 SHA512
          Submit Download

          log1718102812238
          • Path /data/user/0/com.qihoo.appstore/files/sllak/logcache/log1718102812238
          • Size 2KB
          • SHA256 37026ae92f8cb27ddb5d3343d580d55756536491208f8bf7192fd8e766b8eddb
          • MD5 SHA1 SHA512
          Submit Download

          log1718102812319
          • Path /data/user/0/com.qihoo.appstore/files/sllak/logcache/log1718102812319
          • Size 596B
          • SHA256 c660d8fe0cdedd07a3ea09691159f853cd784fc2553a8115cb6d6287ef59eb95
          • MD5 SHA1 SHA512
          Submit Download

          finalcore.jar
          • Path /data/user/0/com.qihoo.appstore/files/sllak/opt/4551/finalcore.jar
          • Size 77KB
          • SHA256 5b3c103a7e0b45e487e5d511ae4da7cd3ee978807d752139ed5d63c8d9a529ee
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          finalcore.jar
          • Path /data/user/0/com.qihoo.appstore/files/sllak/opt/4551/finalcore.jar
          • Size 176KB
          • SHA256 536678202267f95d80480f15065e784d7ec609922a0963d935e9c5a4b0f62bef
          • MD5 SHA1 SHA512 SSDEEP
          Download

          finalcore.jar.tmp
          • Path /data/user/0/com.qihoo.appstore/files/sllak/opt/4551/finalcore.jar.tmp
          • Size 77KB
          • SHA256 7d7ada76ea057847b5c47ed0f16a6d0e52cdbebbbdb08c1a9519acf70a1a4107
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          finalcore.jar.cur.prof
          • Path /data/user/0/com.qihoo.appstore/files/sllak/opt/4551/oat/finalcore.jar.cur.prof
          • Size 556B
          • SHA256 360e0d42bdb9984e0a57d67d7c5835e421756bb80a8a2201ee5c326f88f75c10
          • MD5 SHA1 SHA512
          Submit Download

          localApkInfo.json
          • Path /data/user/0/com.qihoo.appstore/localApkInfo.json
          • Size 109KB
          • SHA256 c22a7605620ad94a473da5b5ecfc4546972f76770c96211a2c49b6c10aa4009a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          .sfp
          • Path /storage/emulated/0/.sfp/.sfp
          • Size 83B
          • SHA256 cd28f0d4f3a0384c6bdbb51daafcfd351f5820fc134ba4d4a8590ab765246829
          • MD5 SHA1 SHA512
          Submit Download