659e0699fd4d798dae973e34c908810002bc5a01357cae5a72ad0909cb98cd84

Analysis

max time kernel
104s
max time network
187s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
11-06-2024 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9deb7c70cd2d543c987af7d22097cc76_JaffaCakes118.apk
Size

31.3MB
MD5

9deb7c70cd2d543c987af7d22097cc76
SHA1

3717f4aeb97619cb7d60d40e9209dfd93d4e9f5d
SHA256

659e0699fd4d798dae973e34c908810002bc5a01357cae5a72ad0909cb98cd84
SHA512

9da2d417ce0f0be2848cc938995cf78d8dbc515a9662fe3b132c54debb25c4f4ecb0402732c604b02236ac46f3ef4aa0f488f9a15ce3932284f50d3fc5685994
SSDEEP

786432:7NftyvdbKay294+b3VluTbJJDhgAT9A5U9O8YOYp1XXPX:8l4+b3VkvJJFgAT9A5U9HTYpVXPX

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.syxx.tkzd.huawei
/sbin/su	/system/bin/sh -c type su

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.syxx.tkzd.huawei/mix.dex	4276	com.syxx.tkzd.huawei
/data/data/com.syxx.tkzd.huawei/mix.dex	4378	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.syxx.tkzd.huawei/mix.dex --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/data/com.syxx.tkzd.huawei/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.syxx.tkzd.huawei/mix.dex	4276	com.syxx.tkzd.huawei

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.syxx.tkzd.huawei

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.syxx.tkzd.huawei

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.syxx.tkzd.huawei

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.syxx.tkzd.huawei

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.syxx.tkzd.huawei

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.syxx.tkzd.huawei

com.syxx.tkzd.huawei
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4276
- /system/bin/sh -c getprop ro.board.platform
  2⤵
  PID:4305
- sh -c getprop ro.yunos.version
  2⤵
  PID:4326
- getprop ro.board.platform
  2⤵
  PID:4305
- getprop ro.yunos.version
  2⤵
  PID:4326
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4359
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.syxx.tkzd.huawei/mix.dex --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/data/com.syxx.tkzd.huawei/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4378
- logcat -d -v threadtime
  2⤵
  PID:4435
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4457
- getprop ro.miui.ui.version.name
  2⤵
  PID:4457
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4484
- getprop ro.build.version.emui
  2⤵
  PID:4484
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4509
- getprop ro.lenovo.series
  2⤵
  PID:4509
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4535
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4535
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4561
- getprop ro.meizu.product.model
  2⤵
  PID:4561
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4586
- getprop ro.build.version.opporom
  2⤵
  PID:4586
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4612
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4612
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4636
- getprop ro.aa.romver
  2⤵
  PID:4636
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4661
- getprop ro.lewa.version
  2⤵
  PID:4661
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4689
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4689
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4713
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4713
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:4737
- getprop ro.build.fingerprint
  2⤵
  PID:4737
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:4762
- getprop ro.build.rom.id
  2⤵
  PID:4762

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.syxx.tkzd.huawei/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.syxx.tkzd.huawei/databases/bugly_db_legu-journal

Filesize
512B

MD5
38939d23bf76f331015d68e3ead04095

SHA1
d69b6ddf251928b425162de830c0dcce9ab52bad

SHA256
03573a91769cb38a2fff95b8ebda190bfdb7d560cc58bdd7856142dab507b3ef

SHA512
9b410e3530cb78b02027c471b84c716b45dfcc539a915d29d4d1ca2036815928b627246f06d630212f96b7a9762f456e4b91025f5ca1b75c4c26abccbfaa0374

Download Submit
/data/data/com.syxx.tkzd.huawei/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.syxx.tkzd.huawei/databases/bugly_db_legu-wal

Filesize
164KB

MD5
b8fd9d939f3c9e81b2029b30f7cdb0d6

SHA1
f8908fdf87a8b9fd1af40ba3b3832b4307d5b9c5

SHA256
ae5fd3fde63874b554a78bb9b79a61eaf4b802feb0faaaa088c0062e2a0cc9da

SHA512
290ac3ab98649e1b9c9b98df54cc9321ac6fd6cac3eea7b3deabe318b0584e6f6d73ffa2e856125df3469aaeb55a965005795036e4ad382965c797eb3a5545fd

Download Submit
/data/data/com.syxx.tkzd.huawei/databases/cc/cc.db

Filesize
36KB

MD5
5d7ea1a23af19b4340cc8d90f28297d5

SHA1
4cfe95b23a9e98378d69c4290af81b51fbe76aea

SHA256
474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da

SHA512
33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

Download Submit
/data/data/com.syxx.tkzd.huawei/databases/cc/cc.db-journal

Filesize
512B

MD5
b363c7d6f2609431ed595fc417c3fd34

SHA1
56b54677aef4847bac8b2fc69a3254bfac29bc4c

SHA256
cd0c3e825ddbf6e6e22317ea3328fe2773f0bf17ac6ead3c029f909ea10f018b

SHA512
b6d217443616154b83956d47a9042d8c81dd623df1832a2e43351cbd88ae85be4cb51ff9e8e869952fd978261168108e853d01006e8ccd6379c84f0a24f39144

Download Submit
/data/data/com.syxx.tkzd.huawei/databases/cc/cc.db-wal

Filesize
48KB

MD5
8b378e6aee679b12b8f3958aeafe88ae

SHA1
088c8b69579cf81f0878e36f4134775e5e18696e

SHA256
d5a67ea2f909473c74c7c581db343b6fd14b2fe312da7e631512451750628d6a

SHA512
2bcc41fef8cc1a25032450e366a0086df33a220be8f2e3789319dc524ecce4b0caa4e66157aeebe36c24ffc3d51856223faafb8102313b6c772008ac2caa6a8f

Download Submit
/data/data/com.syxx.tkzd.huawei/databases/ua.db

Filesize
32KB

MD5
d27b40746f23e8db67b008410d31adfd

SHA1
37cece86360c1e72055f1e7d96cc9d914c8c32fa

SHA256
f82e129cf733594dd9a9ef9a4ab1440833766365dda65f48f0d5285127dca1fc

SHA512
597e3782feaebd1513c7dab85b6ef864171c95cbce7a518a71607ee8477be69df5d8b3e0b19dfaf4bf9e7d96276db26e0796df259b5b96ae395268918793cb1f

Download Submit
/data/data/com.syxx.tkzd.huawei/databases/ua.db-journal

Filesize
512B

MD5
85318af023b2a5b7b486083dfa1db94b

SHA1
9d3fa84cefedeb07cfe53b945f76275e93740577

SHA256
ea06dfa3b32498bf34d830c47cc24cb090cdb8bbc2251fedcd59954d41d8b464

SHA512
d71b639110a906e22d08fde5a0ae7a3c7c6fa75aa275843d5086575518b9565321610255e0783c5e2b917675ca2ecbeb7112d53b0ddedb32c68178779088da40

Download Submit
/data/data/com.syxx.tkzd.huawei/databases/ua.db-wal

Filesize
44KB

MD5
83e6fcbf7733e288f6a3b49203981ddc

SHA1
ccb56098736396e8d301612bdab2956b1c0b27bf

SHA256
5e90bad39e17c376c61bbe6216e6134f50a14a16ef32bdafb11c0e4db0471f0e

SHA512
5e5bd05d1e1c1f728793190d9cdf05d98a9b00fb39bab08e65cfedeb1eabaaa6baec0f8741e8c36e09735c190d0d794a1e17adc1593d7c32a02a825927edb6a6

Download Submit
/data/data/com.syxx.tkzd.huawei/mix.dex

Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads