a7601b1488446879186a927eecda38ffd3e8591a246cab4281f5851f37380b43

Analysis

max time kernel
177s
max time network
186s
platform
android_x86
resource
android-x86-arm-20240611-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611-enlocale:en-usos:android-9-x86system
submitted
11/06/2024, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f3c7092718b2d4a0cf017acf3044751_JaffaCakes118.apk
Size

20.2MB
MD5

9f3c7092718b2d4a0cf017acf3044751
SHA1

222f2fc127abd165613311af4f74cbd08230399e
SHA256

a7601b1488446879186a927eecda38ffd3e8591a246cab4281f5851f37380b43
SHA512

03b5fbb1b837d9a2d9482e707c4e04ee24b380a2abdb241d07827cc31a82865a7154ef378eb94cd3b83fea111a34f8abec449ffa7004a47f8e38084dd4e924f1
SSDEEP

393216:qjDtZVu3F12DoGZT7mc4IT6uNzcH2nrPP3Dgj3F61jqApRUEeyA40dYd5S5JyH:eDtZVoFAtT7bT6izpbEj3gjqApKFyAnc

Score

7^/10

discovery impact persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.linjia.fruit
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.linjia.fruit:pushservice

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.linjia.fruit
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.linjia.fruit:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.linjia.fruit

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.linjia.fruit
Framework service call	android.app.IActivityManager.registerReceiver	com.linjia.fruit:pushservice

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.linjia.fruit
Framework API call	javax.crypto.Cipher.doFinal	com.linjia.fruit:pushservice

com.linjia.fruit
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4312
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4442
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4466

com.linjia.fruit:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4417
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4506
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4531
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4556

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.linjia.fruit/databases/ThrowalbeLog.db

Filesize
108KB

MD5
4f50712421ddd52528ccdb20adc42275

SHA1
ac02baa8691214f1395d664cf386fd2333c58cb8

SHA256
8a1164c8ef676a881c0e4618cdb06a627f77999bb34bbae5af61c6aadc8cd497

SHA512
88d3f25e0281a03f50df9c4100c07973e7fe2ea815d29a56a8a5d589c2e5a29a6c5d5873ab54cbb9cce3fd27a29a4a4ed166011be32f299f45a7a0c213e87180

Download Submit
/data/data/com.linjia.fruit/databases/ThrowalbeLog.db-journal

Filesize
512B

MD5
7e37400156d5909e0a4824399999403e

SHA1
fabfb8f521bc21dfa9cbaaf150594f3c0cf08918

SHA256
d08c23921d01ed69b16080cf426517e84fe6d23ab423878ac3924baa0f248ee5

SHA512
e962c400c88ffb5a4bb0956b392232aaa96b5490b381bd497cc1d99884f9a593a7001d2eb5d27b2f85f5a9bcc57ed9afe3daaa5a72b41874ac1f47e6d7c14716

Download Submit
/data/data/com.linjia.fruit/databases/ThrowalbeLog.db-shm

Filesize
32KB

MD5
291ee73ffcf6456b4a89927e521c167e

SHA1
ea7d18870c95c8372f431e600c67b01edf94df6b

SHA256
73704e4e180bae743c49857e07dde3c62b764bee43df926e0c29626937bda559

SHA512
333cc280f08b453829c615a3944bd4258bf924c2f15bccff38547d7730897efbefda407bec3f0c6030bc077277daa3ab125ea9a6bf1c5a7c40df01745942cec7

Download Submit
/data/data/com.linjia.fruit/databases/ThrowalbeLog.db-wal

Filesize
169KB

MD5
8a209e088e88daecdd4fef5c8a0a9f6a

SHA1
3f4dbb500f043fb3337f2565bfd7ccc15a826df6

SHA256
d8bfd52ad8fe6141f5b93e289357b4109f0aff67086a0c6841b66d9db6416e61

SHA512
a306ae98b809868726fb7aaebd81b108667b7e6eb51bb1f6abc08b518b580d12e6634af6b88bb78c412ddc2fa0e1da00baa08c438308d561490e9e4ea4b54686

Download Submit
/data/data/com.linjia.fruit/databases/pushsdk.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.linjia.fruit/files/Mob/MOBLINK_1

Filesize
16B

MD5
3ec9271315af53d18d13c16defb3c857

SHA1
b58f72ef7275a9c6542f0894f9675aeae72a0da6

SHA256
111e6180c9267e12608478837c017ae3038ffd9e4d8653b815e5b85ec4d174ac

SHA512
20ae2db8b54aa047268370fc655f7308af57e18195d0cfc962342fcc6cf68e67430cc88110bb39a3a301f5fb62ea48b26801276cfb70e2c878adac4ac9dfc3ae

Download Submit
/data/data/com.linjia.fruit/files/Mob/mob_commons_1

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/data/com.linjia.fruit/files/init_c1.pid

Filesize
14B

MD5
947e2db359aa10f98839d07957a2d8f6

SHA1
29fa9dd5c4feba5842d49f5f23ba31330b45f3f4

SHA256
6959e9a865ad7340c39a85fba5d719fbc9787c8e03342e5dbbc3963f25c90dd7

SHA512
b8aff699330934c1c9c7bb747a8892ee1659300412490ceddb188799e5c0fa4f418e0821e40fd04d1e2d56ff3de75abdc967d85be4b7fcb2407d288aac72aa9d

Download Submit
/data/data/com.linjia.fruit/files/libcuid.so

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/storage/emulated/0/Android/data/com.linjia.fruit/cache/uil-images/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/storage/emulated/0/Android/data/com.linjia.fruit/linqu#linqu/core_log/easemob.log

Filesize
1KB

MD5
2539750334261bcfbe8342583c03a38a

SHA1
578e90e0848edfe37fa1f84b7b6259a7ce8f2c84

SHA256
0d0cf92fa4afe5ef5018cc9446c627b9276e31a6a4172937027c80e589e7ce83

SHA512
62f6deb6756394a4bfa1006c8b11976e120ff274f965c0793be429be7b0ec84b858ef18a92297473ec9280d6e3499f23e5db99eaba28c4e89c21e59dea8ee51e

Download Submit
/storage/emulated/0/Mob/comm/dbs/.duid

Filesize
613B

MD5
c6445af130b0c2194964f6d486c4235c

SHA1
c08d2470d648a4adc83e1cda565feadf15177cba

SHA256
c792feac4bf16eefb4027c15422efd6ea79249a8697f7b957925717690c5f8d8

SHA512
f1dcbf62b779d1fa5dda84fd61b0cc359ab87bfbe5719f13095633443fe3aa95ba3b72546ffd6c333f21b967dc6c69d3f995067dd32a73e7540061d459252a8e

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid

Filesize
189KB

MD5
69a6096c58ef2d7a02124cb618e5367f

SHA1
272945796dd259c5c7412839873ad2d507fd46b3

SHA256
cd20137577b19eae4f88a5a4efe2c4986e568c35640e9e3e5c99e5022350845d

SHA512
aa6b21d482d4d766dc0242e909eee4c8f9f8f6c284246e17f531339e9dcf94331825168bc29dc5e2000c1550a2693f3b3b9b91a3af4b5de2f12a0049d6cb6a4d

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid2

Filesize
512B

MD5
3e2b9cf359340c0c6b471f35943f8d47

SHA1
f0c5d2813b5480ad3a2abe4c0c85ed21403e872a

SHA256
d069b8064e8fb6c5278e8013dd36c280066c85422c5dfe08bdb8e5400f62f7f5

SHA512
96ea6678a9bf024313473c0a18ed97537802a00c829f6cfd99431ff2350be7a92066b9b41a00b58c6366e7a502b7e28d254d0e5ff61bed5726d585d9759a9c9a

Download Submit
/storage/emulated/0/libs/com.linjia.fruit.bin

Filesize
66B

MD5
81960d65829b1f63d93e284552280dcc

SHA1
041c402e438eb10389e13b1cc21e3a6c6f7cd6e1

SHA256
2c3c7cec4d8d29d85bf6ecd25a39def7f67f22291669ff28472f3e418db4bb99

SHA512
42fd8db7439c803c661232d3c9971be2faed9e6ec8fbdd882cf9fbece0eb4ebb9f4bfa94c4aeca52f73bbc0541da764fa60e6929f05cf2a604af4c28b9c22627

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads