83b254c4d66a794d3a72f2860f8424e329e5549d62e712300085f1503e6e3a10

Analysis

max time kernel
9s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240611-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611-enlocale:en-usos:android-9-x86system
submitted
11/06/2024, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ea300a2f8ed4a0656403b485c6c903e_JaffaCakes118.apk
Size 31.4MB
Sample240611-stecfssckj
SHA256 83b254c4d66a794d3a72f2860f8424e329e5549d62e712300085f1503e6e3a10
MD5 9ea300a2f8ed4a0656403b485c6c903e
SHA1 b9b0e56d3d17dddc006aff723dcf362c2e22e719
SHA512 b4273179dbb2d2a2bff2139c70d031f3bbaea3f976d8c073687167644cbc6f74e0be7825150ee4226e9563b58cf6637db4841d3d7c78b1b9e5389b53411dc767
SSDEEP 786432:W7MIFV6NgRJpaHA5VS7G/xBaXbTnEF04F47KUlZw94iywT9XOOj:OgrtjXbTnZ4F47NlS75XJj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.gongziduan.app.duangongzi/mix.dex	4255	com.gongziduan.app.duangongzi
/data/data/com.gongziduan.app.duangongzi/mix.dex	4357	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.gongziduan.app.duangongzi/mix.dex --output-vdex-fd=56 --oat-fd=57 --oat-location=/data/data/com.gongziduan.app.duangongzi/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.gongziduan.app.duangongzi/mix.dex	4255	com.gongziduan.app.duangongzi
/data/data/com.gongziduan.app.duangongzi/mix.dex	4255	com.gongziduan.app.duangongzi
/data/data/com.gongziduan.app.duangongzi/mix.dex	4255	com.gongziduan.app.duangongzi

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.gongziduan.app.duangongzi

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gongziduan.app.duangongzi

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.gongziduan.app.duangongzi

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gongziduan.app.duangongzi

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gongziduan.app.duangongzi

com.gongziduan.app.duangongzi
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4255
- sh -c getprop ro.yunos.version
  2⤵
  PID:4300
- getprop ro.yunos.version
  2⤵
  PID:4300
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.gongziduan.app.duangongzi/mix.dex --output-vdex-fd=56 --oat-fd=57 --oat-location=/data/data/com.gongziduan.app.duangongzi/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4357

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

download_upload

Path /data/data/com.gongziduan.app.duangongzi/app_tbs/core_private/download_upload
Size 56B
SHA256 313393a014a93f78940a416ccb9963912e16138abd61866ad66063197d8af664
MD5 da5b98e8715f65128300ad33fefd7d2c
SHA1 d300fffb0ae8503f137bf6496dcee24e8cbd4832
SHA512 a97ac156da219b5ce61b1de143409b2a366d82aab930eef449e53cc4c5b990e332857608527f581dc24a818a10f2cde2cd0a3284534ed4e11d6e02dfe530447c
MD5 SHA1 SHA512

Submit Download

download_upload

Path /data/data/com.gongziduan.app.duangongzi/app_tbs/core_private/download_upload
Size 56B
SHA256 c66e80a0585c1feef7ddf4479c78c73d30db068fd8d9877c268e0cd7179f1b06
MD5 c41164dc9215bc72171e32a18566570f
SHA1 d74f56665f188fa8e4b26c93394ac01a5fd1ed58
SHA512 b173fea9bee26c2cd1d66eab00211d44ce36579711a3e1d2768295b3bd9b6d4934b187404d9fa1da9c3a8295d4d43174abf416fa336040acb1cf1a7c34458573
MD5 SHA1 SHA512

Submit Download

download_upload

Path /data/data/com.gongziduan.app.duangongzi/app_tbs/core_private/download_upload
Size 84B
SHA256 0477e33a7ad99b65626f8fb0aa7286466a9475dddcb3ac48c9d23359139c0309
MD5 5781017e3281dec4f0346012c59251c6
SHA1 0a289a7815a972cf7581866a46e3f5e5a330b15c
SHA512 fe4f7b3b180ad3895bd44de4aace288771772447aeab63a698d7de07b4c7182bb095fed328ee4a11021999296ee35edce6ab833db502283b89622936665d7acf
MD5 SHA1 SHA512

Submit Download

MessageStore.db-journal

Path /data/data/com.gongziduan.app.duangongzi/databases/MessageStore.db-journal
Size 512B
SHA256 7b311da0c26fbbcd4845925a00567340e49b6b39570238031795602841c988ca
MD5 dbd7a9e150226bd546541c7afb8a7cf3
SHA1 2748e18f3fe2e33562648d8664c1079edfa36137
SHA512 5dcf398dc3be734b76f28572c10de02c43ca8d8c814de0513c8d8cbb03a3f6fd7f4235022747d6c4e22a8e29ddcb7d927908f1bf96e3d11146d23ce597acacbb
MD5 SHA1 SHA512

Submit Download

MessageStore.db-shm

Path /data/data/com.gongziduan.app.duangongzi/databases/MessageStore.db-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db-wal

Path /data/data/com.gongziduan.app.duangongzi/databases/MessageStore.db-wal
Size 48KB
SHA256 35f845c7273fddcacb5f13add78da78a541723c8be54237cff4373e09a2569e6
MD5 4f8efb7b984f358381808a252d75e054
SHA1 b0247bfd52f22e608cd84467abc39169fb6aafc9
SHA512 5fb0d8912116a563ee1516677cf5aecec3c00a13711d1965e1bfe1f0df9174409e75670f5ff39946da6c8d6a8449020b3e3bfba78fd03e79a1679a7d352cc93d
SSDEEP 24:KFqzyGSP/PLWSHylUi/UPzmD6ZWaJyZ4M0yAN9GSP/bezn:oqzNSP/PLPSlBRvZ4M0yIoSP/bez
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db-journal

Path /data/data/com.gongziduan.app.duangongzi/databases/MsgLogStore.db-journal
Size 512B
SHA256 3794df118ece5937a6897fc65edf582d01b9826980268277c624298f2e598149
MD5 84b55736b36e8a06148f1e590f941022
SHA1 e82e83432545b9092f5c439c865b7964104069f6
SHA512 fe25a3bf4ca52bbe9dc30d73dc8092ea566c383528e29e3396786985984dbf754499b69d5ba9e85b0ad80ee473b45dca4eeb3690a5e2123bc7e04792ee2b421a
MD5 SHA1 SHA512

Submit Download

MsgLogStore.db-wal

Path /data/data/com.gongziduan.app.duangongzi/databases/MsgLogStore.db-wal
Size 68KB
SHA256 a3ea73957ddad4f0c92c93930532534679282cd81d43afc6a51d1225740d1f0c
MD5 1c9e3e8adf67271a49fdac01ec28395a
SHA1 20f82ae91a06b4c7f819145cbe2c84f341310be1
SHA512 3675c9bca2b4bb4b76842c5a9f81ca075c6a07929fc9186fdcbe18fad3568beaf759f92a9295025f82e2b2069e37498563ac2a91fe7309b4ac8a1ee33c7ec252
SSDEEP 48:ND02zNSP/YmZjGF33QO+t070OCJfhF8GIUWZw3RSP/Y42n2V/gfCaAick:N0PEtQG0OIwP
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu

Path /data/data/com.gongziduan.app.duangongzi/databases/bugly_db_legu
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/data/com.gongziduan.app.duangongzi/databases/bugly_db_legu-journal
Size 512B
SHA256 a66d995116492615d4f5a56bcdfed3692f749e0b90100809cf5d85b2dbf97b91
MD5 fc57529a69043b196ccd69211b45f999
SHA1 87c88618eb36535308d89d301a508281af5f80ac
SHA512 4a2d465669aa359fee8831bbc81c3c785f87eb63e1e7162d538508d1b5581482651861fbf87a47f88bd2695e01cb0f142985b3bb1dbaa2fc1a827139bd6db6ad
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-shm

Path /data/data/com.gongziduan.app.duangongzi/databases/bugly_db_legu-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-wal

Path /data/data/com.gongziduan.app.duangongzi/databases/bugly_db_legu-wal
Size 92KB
SHA256 5cec80a00a29650c3f9c227a463518e1f4fd51b777b46a5253bc28f47c596c04
MD5 e283a88e7e3a787d81d98874d10b58f5
SHA1 f6828f7b6b9df4d1917c73c49895269a5a4e2686
SHA512 8cbbb509870de9283e24a6f0690648833359945250fbcff5359fede311330075747ee78a6aabc3a551896b5b62030b2a117eec21d38ce3d0334c934f2d40c832
SSDEEP 48:t5TzNSP/iK6pfrQiw6uMg6/YBg72meposSP/ZKnvJZvqKREmA:H0PqKY4m7P6kKI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mix.dex

Path /data/data/com.gongziduan.app.duangongzi/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 e037ff4514a62ade4d09f465fb5218835d7cdcf088ecae2c4754af70bd082645
MD5 6c128bf7b7f476ff7704eb3adb0a23ed
SHA1 6894de7dca2b66f4fc32c1dd0b7eadc89c53fd65
SHA512 f940ec9d44fe60ee5ee7cb3a0a6a7678459bfade73f91416fbbeaa319e0a91a94d58ac27ac745d9fde999cceba113a3bea291e399af3807ea487a0bdc3528443
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 6cfe3867902f7608148b814c46e2577fd9be490d9493fc0ab506f5ada60918de
MD5 291b09335869e7075f188ee9e92ad941
SHA1 24ccfd4343739816313e0462c871ad109246b8dc
SHA512 64c367d89c5ea374037ebb152153c4a3905968c7fe2660076df3c086ea798cbe3ecac8c1039616e24aaa2f9f647ae8ac260d3f8b0201185669b819116413f491
MD5 SHA1 SHA512

Submit Download

.mn_410185822

Path /storage/emulated/0/Android/data/.mn_410185822
Size 130B
SHA256 53efd5207de6ed80429ec3c7865eed2b64023a0ed66e0fd29e7f45b708a1751c
MD5 f321656a466363e5192773d92000e401
SHA1 3a6abe9be1a6f4deffaa98fd27f3449c888d3c4a
SHA512 fcf6884bf5ce8d10b3a3dd461fad96cb6cf0bc4129e01788de112551230fbc4d8ea6961b04411d1c7816e248437c4560277069d9c544e5450612abc0e2c0171d
MD5 SHA1 SHA512

Submit Download

tbslog.txt

Path /storage/emulated/0/Android/data/com.gongziduan.app.duangongzi/files/tbslog/tbslog.txt
Size 2KB
SHA256 3557569928a71a88241612b3a01c54490d4e8e701ac40365d78578ddc9453619
MD5 d2547f120cfb95548b1e2d10bea9bc61
SHA1 31cc9f8ea166f4072fb9b34d5d61b9cbd0ba4319
SHA512 2c7dd43b6a4a4fa5df14eacd7549117c3bc70278309539f7dc90a2d84b4f6837849905701db6b9a0ea50419e3387a6185fa8d90085fd0288c8815b79348503a9
MD5 SHA1 SHA512

Submit Download

.di

Path /storage/emulated/0/Mob/comm/.di
Size 57B
SHA256 499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f
MD5 70a42cba408700f9a6c01c7941a8829e
SHA1 eab01cc2c0671538795fb0b1146017dc099d0984
SHA512 8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads