83b254c4d66a794d3a72f2860f8424e329e5549d62e712300085f1503e6e3a10

Analysis

max time kernel
11s
max time network
140s
platform
android_x64
resource
android-x64-arm64-20240611-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611-enlocale:en-usos:android-11-x64system
submitted
11/06/2024, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ea300a2f8ed4a0656403b485c6c903e_JaffaCakes118.apk
Size 31.4MB
Sample240611-stecfssckj
SHA256 83b254c4d66a794d3a72f2860f8424e329e5549d62e712300085f1503e6e3a10
MD5 9ea300a2f8ed4a0656403b485c6c903e
SHA1 b9b0e56d3d17dddc006aff723dcf362c2e22e719
SHA512 b4273179dbb2d2a2bff2139c70d031f3bbaea3f976d8c073687167644cbc6f74e0be7825150ee4226e9563b58cf6637db4841d3d7c78b1b9e5389b53411dc767
SSDEEP 786432:W7MIFV6NgRJpaHA5VS7G/xBaXbTnEF04F47KUlZw94iywT9XOOj:OgrtjXbTnZ4F47NlS75XJj
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.gongziduan.app.duangongzi

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.gongziduan.app.duangongzi/mix.dex	4553	com.gongziduan.app.duangongzi
/data/data/com.gongziduan.app.duangongzi/mix.dex	4553	com.gongziduan.app.duangongzi

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gongziduan.app.duangongzi

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.gongziduan.app.duangongzi

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gongziduan.app.duangongzi

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gongziduan.app.duangongzi

com.gongziduan.app.duangongzi
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4553

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

mix.dex

Path /data/data/com.gongziduan.app.duangongzi/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.gongziduan.app.duangongzi/app_bugly/rqd_record.eup
Size 369B
SHA256 a0d8f47618df5e26203b1a1a9211700e9bd719d3f5a0b4303c99dda6a3a19231
MD5 0ee3cb5b6d1d0ebc8e76c3c5f6b941c4
SHA1 a742930121cd02b134dff29485715c211df238ee
SHA512 d4244a1c0d31f3833a540674b9b7d2044cdd6ad01dab06607412abfc803c7530e861fa7ea4df6dab2fbb311d44336596309fe48238647445e3b8e27009548c71
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.gongziduan.app.duangongzi/app_bugly/rqd_record.eup
Size 1KB
SHA256 579178e6f2da1d62452290f05e6274283e252e7e57d3a0d6fbdb18b117baa67c
MD5 2f81b49ea7c519a3f4ffe02c0f38f373
SHA1 ad465e85fa6f7c8a9ab79e1640533c20eaace7dc
SHA512 e3c889b964eb9a25a9c2b3348db62fcece7f6a7628262aed9acbcf04e502ba129d9dcc471d2d59ab9e131d4f316b8ac25968cf925a5a46369e4c3667f0c244bb
MD5 SHA1 SHA512

Submit Download

tomb_1718119519449.txt

Path /data/user/0/com.gongziduan.app.duangongzi/app_bugly/tomb_1718119519449.txt
Size 56B
SHA256 7fe875398dea7537a57a77c5275cbc8647aaf63ab6fd9148443b65df2e1d0647
MD5 bd0f8f8f3ad93fa07623422ec6e72003
SHA1 c3589295e7a4ddcf35bcd7a2c13bfd381783821a
SHA512 2ec3e073321262b667afbf98fe4e9f51e4c0c58baaad506b120239031f10699d699b94470bef13007bd6199df3d3b03f1eaf147c0cba5178aee7e267072b1c0b
MD5 SHA1 SHA512

Submit Download

tomb.zip

Path /data/user/0/com.gongziduan.app.duangongzi/cache/tomb.zip
Size 207B
SHA256 b3d7ec1048d054ca43d9cec347dd818f08c5220b93393fc53422064d97b18219
MD5 415761a1e4653ea0945245b03cce186e
SHA1 2e0539940ebd80f2723b19884bd4c5716474f53e
SHA512 6f47c77ee505aae892dec980cebe720f8bfb9a334c43b8a9d16241b7075413049c07d9f78e1af7a49aa8f64fe744855da4357812873f9a019f51271504aa2748
MD5 SHA1 SHA512

Submit Download

bugly_db_legu

Path /data/user/0/com.gongziduan.app.duangongzi/databases/bugly_db_legu
Size 180KB
SHA256 54ce7b542b24fa1dc58a206027712e2fc07c394afe9a8f1eefce1e133f6ce5da
MD5 8ce0089be2d756a2cb06aa243eb344ca
SHA1 103e90f62c45037f7d29c959853ad2984f59ec02
SHA512 2b76026737909f1f239f2c1300ec1d967f7f6cd602e81ae583932864dc48054b57f02a21acb9676be1761bc98052c45d30bc2ae2e384ef2b6c116a01c4358a5b
SSDEEP 768:iqQaYkbJemDTEysmAEcqLDmA1i0bRhjn3JT/J9oBfvkqJr1UfEmglF5dmM9dBndT:iaQTLq2J5hoz2
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.gongziduan.app.duangongzi/databases/bugly_db_legu-journal
Size 12KB
SHA256 c297e9d42bd81f871af8f2e1842e2370ab8b6f6325c9892cd9f59a8d719d3d84
MD5 b7969e77e2d5bf0a4b8b3d3b5f7e96c8
SHA1 9940973268f626fef7ff595302ea95c8cee8a407
SHA512 b0e2d4c225f06109c5bdeb591aeb4a96d8ecadf76a901a6f57f82402d2dae84043de0b06cecdefd2ccbea67e251471c9b780bf3a862efc9059f8ec2429d79c2f
SSDEEP 48:7MDqMZfrQiw6uMg6/YBg72meposS2JzalwuohL0h:7qh4m71lWY
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.gongziduan.app.duangongzi/databases/bugly_db_legu-journal
Size 512B
SHA256 f90cd53576853828930cfa11f1c0b22bd3e3eb5ed662b00fcfd67d0dcd8feb89
MD5 3a13434c9889395ba04cdf54806f41a2
SHA1 abd240286eefcf6051c676b02aa80b1a66406359
SHA512 65459fb37326b63f43b2f07d965ef6cc0a69eb2306ca8f4c4e93e0dbbf869ee2dd5f021348ac73e611d6c9e00bf4e66b1617194117c3c035c512f451e587989c
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.gongziduan.app.duangongzi/databases/bugly_db_legu-journal
Size 8KB
SHA256 52b9de3f8b023b1fde3bdf9067cb17b0b80f2cf55619a471aa3dccb401ed82c0
MD5 cec066e006dc49e0cf3e899bd43df290
SHA1 f8a9f1ec09d867d0e0b60f05c16cdfc5a1ab3ed1
SHA512 8599de313032bf333583ec32e0425eb5ffc12803f710cbc128b884535ca526ee4940db2260dba67d3e7e5e5fc6c670c6250584c51732c50e7ec792b9377b7e0f
SSDEEP 6:7+/l9Pj/Gn1Zlpg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKmln:7+ttuqLiuWdYRmBEyPb/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.gongziduan.app.duangongzi/databases/bugly_db_legu-journal
Size 8KB
SHA256 22cd307e2342f9a1f5e25e092683aa30293c21065b15e3c656cbc75fd6da890e
MD5 3ff2154724b9e93ecdb1eb6b393c6a25
SHA1 d2b8b2624cfbd2c25f3564f4b94841b657bebeb0
SHA512 adfb34b49d3ad8e15498fdbdb2965bc6c0fbba8a9730a9e5216cff60062a9c1c468dfff87242f549d508c9f0ad86957f04ca869ee5e07e184da593f4791a9a34
SSDEEP 6:7+/l9BGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKoPU/B:7+t2qLJdeWRmBEyPbh0B
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.gongziduan.app.duangongzi/databases/bugly_db_legu-journal
Size 8KB
SHA256 c5b07e74528b3f1e0704c6f924efd197f6663084b08edefb7289d43245ddbdcd
MD5 0d04a2554d5e7f63655b5380b6614561
SHA1 ec3121d2cc99e5cdeb3c311b62c0c50146d731e8
SHA512 60a7e215e0aa99cbed876a837e8877777663bb731674fe9fc287de33afb7432c3d1f59087d0114b18d103aa6c4b38b2d5242c48deebeb420a8551e51a61b10ff
SSDEEP 24:7+tvqWqLTtrrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSe:7MvdqVZfrQiw6uMg6/YBg72meposSe
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.gongziduan.app.duangongzi/databases/bugly_db_legu-journal
Size 12KB
SHA256 c6a1385c056635f16266f42b11c6018bbb87c7eac128c289a7d20cefbadcda3f
MD5 9d4b538000297f51b3b68465fed8d75c
SHA1 1aab417df008ca7f53f40597b7e6ea2bda6c6d53
SHA512 ed070801b3e59abb6bd0dc6cafeab489811c6625f45fd86d9bd51ba7aa939b0b83650f1e27984d18b255b1708e5d1b0a406afcc1a8fd9d9be6fce80eb3e04e29
SSDEEP 24:7+t3KqLMvtYrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSd:7M6qlZfrQiw6uMg6/YBg72meposSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads