34e747a69e7ea93dfedebd408d5175a5161e90c3b8f4dae9c00423d8ae811931

Analysis

max time kernel
175s
max time network
190s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
12/06/2024, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2c8ebc3542d98d7b25c04f0d1d646cf_JaffaCakes118.apk
Size 24.6MB
Sample240612-2sclxaterh
SHA256 34e747a69e7ea93dfedebd408d5175a5161e90c3b8f4dae9c00423d8ae811931
MD5 a2c8ebc3542d98d7b25c04f0d1d646cf
SHA1 c3d479135dbe680f951810c0c40918b8ca6d51fc
SHA512 259b58ed45ed0204d5513b34dde43d2d23632a8137b9571ce49da46186b872d2943e802b90114776dfd2fabd97eb4685929ff4f32af25c376128ec5bd9a7ca27
SSDEEP 393216:bKKlw2WZpcMv6IBVjppgz3pYOGQRtZwyb9WlxrPeiba6f7PRIavTi4ksSnQ04:bVlw2mzvnjpMmr5DLJba6frhW4ksSnQD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qijia.o2o
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qijia.o2o:pushservice

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.qijia.o2o

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.qijia.o2o

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qijia.o2o
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qijia.o2o:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qijia.o2o

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.qijia.o2o
Framework service call	android.app.IActivityManager.registerReceiver	com.qijia.o2o:pushservice

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.qijia.o2o:pushservice
Framework API call	javax.crypto.Cipher.doFinal	com.qijia.o2o

Checks memory information 2 TTPs 2 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.qijia.o2o
File opened for read	/proc/meminfo	com.qijia.o2o:pushservice

com.qijia.o2o
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5075

com.qijia.o2o:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5256

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/data/com.qijia.o2o/cache/cache/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

pushsdk.db

Path /data/data/com.qijia.o2o/databases/pushsdk.db
Size 48KB
SHA256 18e94ffcf008ae9624c4faf398f46789051d931a49ad87308638f8f22377fa31
MD5 296cbcf185fbb965607c6447e4b0cbad
SHA1 666bc9f051a9e5ecad9d306d8692d3db4d26d21e
SHA512 6af21622e23d0478d5be5ec9049f184dcb611dec55a44bd8968cfb7cf3c82803af3de90a8f133bd8faf535f230d6b40a41526ac7e08b193dd960d1aca2b22940
SSDEEP 24:TL7Rs9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSFqU9KCAC1V3T3QQQF:TXR/W0xopA/t379y/MSAMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/data/com.qijia.o2o/databases/pushsdk.db-journal
Size 4KB
SHA256 b811702a0c3179118a66d595fd13f1635c8c1427a5617d6a16ea2de5ba1783fc
MD5 dba447c1b725a65eedc0f0a9d870438a
SHA1 61d6e948cd6f9e42341b8656eecee3494d08599f
SHA512 c641faa777e58f2794c0ec00cb57bba5213ae510d4071079f57a1e18a778dffd0ec7cbffb778f53b491ad9bb603a79140d7248576c594ca13b8de0770b06dd57
SSDEEP 24:7+tSqLqws9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSt:7MSqGw/W0xopA/t379y/MSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

qj_1000_ISME9754_guest181382860294297780492575544627650543291

Path /data/data/com.qijia.o2o/databases/qj_1000_ISME9754_guest181382860294297780492575544627650543291
Size 28KB
SHA256 c2210af3c35c1823d09dc15c1516568cdd6cde09c46a4b15aa11d608dba268a2
MD5 0491ba0d96657fc494fd0be27fac8779
SHA1 214043fdfaeebe6ff05d35c93ae2343ed53414e4
SHA512 eb5ba62f7c2b5fe9aacaf74def4939948d3988c7c39f491a60adfc53007f21e207d390ca51df702a526ab7a708458147512dee878768ea87210b69314f2dc8a6
SSDEEP 48:7MFkBqEK/W0xopA/t379y/MSJDWjI0nHEba6:7WqPK/W0+pYto/tkjI0o
MD5 SHA1 SHA512 SSDEEP

Submit Download