Analysis

  • max time kernel
    47s
  • max time network
    178s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    12-06-2024 14:50

General

  • Target

    a10cd0db7f6946f719c8f70001e3ab5e_JaffaCakes118.apk

  • Size

    6.3MB

  • MD5

    a10cd0db7f6946f719c8f70001e3ab5e

  • SHA1

    29faa503ad09d2ef5c95ac1982e138f082035869

  • SHA256

    741c972323eef28570a40adf6e36dc57a1aab08e20e340a2606c81a8bab1670a

  • SHA512

    863674902e5e128e5de47036b4885ce20e272397c2ec2f59726e0a24c5507f6f7cfcf95764abadcfd40f27ec0d9575c1b44ed310c9a02110693ceb80189b0140

  • SSDEEP

    196608:zXA6EtVEaT2f1fO2G9DCbpv6EGIn8WF7m8g1:zwtVEaStfO2G9Gbpln8WF77s

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.chaozhuo.gameassistant
    1⤵
    • Queries information about running processes on the device
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4275
  • com.chaozhuo.crashhandler
    1⤵
      PID:4356

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /storage/emulated/0/Android/data/com.chaozhuo.gameassistant/cache/com.chaozhuo.gameassistant.inject.dex
      Filesize

      13KB

      MD5

      58cf455334d5cbe2a6d269e400473103

      SHA1

      97eda20a303ec21b49ebf87fec14eeaf59fa4498

      SHA256

      1bd3dfd8e39dcf08f74f217f7dea76a089e27d3860e81af1f4f39c58c4165130

      SHA512

      a88c791ea0ccc9521edc917fd3c98c5ca6620d3be60a27795df50be5c2232ee5a92280fa731b6f7232f0dd0d421cc21a7ee56eff6bfb8223c656e9d87916138d

    • /storage/emulated/0/Android/data/com.chaozhuo.gameassistant/cache/inject.sh
      Filesize

      1KB

      MD5

      956d006a6ad3b7859fc1d6a5a62cbf29

      SHA1

      0c04bbfab373c6dfd057e55b6bed0e49d702fb0e

      SHA256

      4d689453741dc287592030a4a9aa24abdb469e52cf740db6b06ecd51efa8d84b

      SHA512

      068a066be803552906dd239d23b907abd4a44cfc6f07b7279c0e83fa92105cc9dc5b43e582c54831d004a72a8c8f9a8aeed23721d32d154b3d4945606f56286a

    • /storage/emulated/0/Android/data/com.chaozhuo.gameassistant/cache/libinject.so
      Filesize

      177KB

      MD5

      d46e8f2c2bfcd7b1d8e65e6834f94d02

      SHA1

      c9f92e0ccfdd2d2cb30b2744c4b8564a837233f2

      SHA256

      50a9b6addebb7027fb4aa2460b5e74d7ef059b8398de4acde48560c7c73897c8

      SHA512

      12db65e80cfa181f3385ed45853d37bacf84bff8ddce2acdb776b392af166706cdb8aff26aaac738db0a39ed6932e7cc458398a96c966eea2dc908d922f2f836

    • /storage/emulated/0/Android/data/com.chaozhuo.gameassistant/files/stats.dat
      Filesize

      90B

      MD5

      7265a1953ddda5e37527c75197b27520

      SHA1

      78974c44588ba38fb18d58de37a01e5cdf1a1527

      SHA256

      dedd7554a4be6be1a756a2d1e4cf86cb6d453e0a6b19475ecae514d7064e9c81

      SHA512

      fec5b4929eb33dac58211030d1f10225942073244e3d29bf91c9140aa01f4e97ce6060fa51ff614475a58274060ecdb48edfd44650e9ff2d358e5a3416459987

    • /storage/emulated/0/Android/data/com.chaozhuo.gameassistant/files/stats.dat
      Filesize

      86B

      MD5

      7df48ec01a375323cc8d532a24793bce

      SHA1

      2b3a9f3508d238d8c648843d565701a76f27a4f8

      SHA256

      73fe4030e1dcdfabe9725e314c95b24b3a3912960e2e8a93baf77971313e757d

      SHA512

      24c5cd8f9f6b2345f56d90a4f8d84bdedf80db69f9b948991846625801da9b15e5a89332b6c558b95e077f26c0a8b77de4d9168fea1a900937c29021190d8db9