Overview

overview

7

Static

static

6

a1b96520de...18.apk

android-9-x86

7

a1b96520de...18.apk

android-13-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    185s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240611.1-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240611.1-enlocale:en-usos:android-13-x64system
  • submitted
    12/06/2024, 18:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a1b96520de368b74e6d9cfa1f71461a6_JaffaCakes118.apk
  • Size 11.8MB
  • Sample240612-w1llwsvdqa
  • SHA256 29c0a26b5556928038be4e4567037a032fbaa0572bea30cbd5788cf2de9aff89
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryevasionimpact

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 25 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 6 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about active data network 1 TTPs 4 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 5 IoCs
    impact
  • Checks memory information 2 TTPs 2 IoCs

Processes

  • com.yugou.og
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4331
  • com.yugou.og:ipc
    1⤵
    • Queries information about running processes on the device
    PID:4380
  • io.rong.push
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4412
  • com.yugou.og:ipc
    1⤵
    • Queries information about running processes on the device
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4560
  • io.rong.push
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4672
  • com.yugou.og:channel
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4699

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        framework-adservices.jar
        • Path /apex/com.android.adservices/javalib/framework-adservices.jar
        • Size 25KB
        • SHA256 ebf554eca9585be7cc99314e35c844d481ab811456055a1127b3df4641cf2ffb
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-sdksandbox.jar
        • Path /apex/com.android.adservices/javalib/framework-sdksandbox.jar
        • Size 11KB
        • SHA256 e71199d47af29d61859792529bfee051ebb23b92747d57e402d6af30c8d2a9c2
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-appsearch.jar
        • Path /apex/com.android.appsearch/javalib/framework-appsearch.jar
        • Size 145KB
        • SHA256 a77cfbc9d66d3fde22540b2e6a5bee8ce21dbeb3f66c0d9121764513188252f7
        • MD5 SHA1 SHA512 SSDEEP
        Download

        apache-xml.jar
        • Path /apex/com.android.art/javalib/apache-xml.jar
        • Size 1.2MB
        • SHA256 a592316ce171525b731179a84d91a1f7824d5e7c2c6f713d038163a95f7f3626
        • MD5 SHA1 SHA512 SSDEEP
        Download

        bouncycastle.jar
        • Path /apex/com.android.art/javalib/bouncycastle.jar
        • Size 1.4MB
        • SHA256 b12a49fda7dec105cac09b6d77b083d37b1be5d52f4f265790f2e348e5783f06
        • MD5 SHA1 SHA512 SSDEEP
        Download

        core-libart.jar
        • Path /apex/com.android.art/javalib/core-libart.jar
        • Size 549KB
        • SHA256 eb3b040c7700fccdc6a637ff9628c0867b6f48ebac4b09c2b5bb4dd77baf3d38
        • MD5 SHA1 SHA512 SSDEEP
        Download

        core-oj.jar
        • Path /apex/com.android.art/javalib/core-oj.jar
        • Size 5.0MB
        • SHA256 d9d541d074d858571d60e2964fd39fb74130217fa7c92d74ed1695b0962837cf
        • MD5 SHA1 SHA512 SSDEEP
        Download

        okhttp.jar
        • Path /apex/com.android.art/javalib/okhttp.jar
        • Size 397KB
        • SHA256 14d759d0257e1be79263f4ff0bd41548af7f83f7d5f8f5029dae5e58a4687ada
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-bluetooth.jar
        • Path /apex/com.android.btservices/javalib/framework-bluetooth.jar
        • Size 937KB
        • SHA256 9f51175dca7d241cff99acba4f8e29a1b781f3d16a72baebc8ab7434ded1869c
        • MD5 SHA1 SHA512 SSDEEP
        Download

        conscrypt.jar
        • Path /apex/com.android.conscrypt/javalib/conscrypt.jar
        • Size 453KB
        • SHA256 787aa8fdbb20b5a4df8a61213c8df30de929dc610967f32712611b323d89d32d
        • MD5 SHA1 SHA512 SSDEEP
        Download

        core-icu4j.jar
        • Path /apex/com.android.i18n/javalib/core-icu4j.jar
        • Size 2.7MB
        • SHA256 baa7c3b0f8df0cb4e6b925b44ccf99dbe35dbf4be00a0ae33c5e4eeb173ce7f5
        • MD5 SHA1 SHA512 SSDEEP
        Download

        android.net.ipsec.ike.jar
        • Path /apex/com.android.ipsec/javalib/android.net.ipsec.ike.jar
        • Size 670KB
        • SHA256 dbf99fd2ecc3f0a085855d9a53881b91132da8f0e85dd11d92ee46db01d6ab83
        • MD5 SHA1 SHA512 SSDEEP
        Download

        updatable-media.jar
        • Path /apex/com.android.media/javalib/updatable-media.jar
        • Size 482KB
        • SHA256 19eb02aed8c826a9a4b74d11a345e8ecbe1fe5562c5b9d13ac1286efaa4771e9
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-mediaprovider.jar
        • Path /apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar
        • Size 73KB
        • SHA256 6ae5b642fe117238ea95d6f39931c86cc3e784115a0874e8b742dab88ef9629b
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-ondevicepersonalization.jar
        • Path /apex/com.android.ondevicepersonalization/javalib/framework-ondevicepersonalization.jar
        • Size 8KB
        • SHA256 f2d356c75b62b631972f29ed268497b3088e80676f34c4f8ea779d30be959b4f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-statsd.jar
        • Path /apex/com.android.os.statsd/javalib/framework-statsd.jar
        • Size 73KB
        • SHA256 22481f2149c6f9b6e8873c4419c8fd33fd72c7dd1ef8e968c63ba3a1c8eab914
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-permission-s.jar
        • Path /apex/com.android.permission/javalib/framework-permission-s.jar
        • Size 173KB
        • SHA256 25c24c41332b5886427c5864067ac491e163a6c729bc219b31183b229e5d3219
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-permission.jar
        • Path /apex/com.android.permission/javalib/framework-permission.jar
        • Size 612B
        • SHA256 e62333a706d04ca49f917826f49770ad089d134580f050567de912ecac31302c
        • MD5 SHA1 SHA512
        Download

        framework-scheduling.jar
        • Path /apex/com.android.scheduling/javalib/framework-scheduling.jar
        • Size 11KB
        • SHA256 a80d2a1dd96cbfd38ed68d8934611f2294ff8f85fce7378500570814d571ce7e
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-sdkextensions.jar
        • Path /apex/com.android.sdkext/javalib/framework-sdkextensions.jar
        • Size 5KB
        • SHA256 835e58ff912600ddef1b3fa9adaff5d7e2c4b379fbe8adaac065122777b204a5
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-connectivity-t.jar
        • Path /apex/com.android.tethering/javalib/framework-connectivity-t.jar
        • Size 374KB
        • SHA256 595956d19b204fce5ae88e02999467cd6bee084158ef209fce06958d76806608
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-connectivity.jar
        • Path /apex/com.android.tethering/javalib/framework-connectivity.jar
        • Size 490KB
        • SHA256 13f8f21e0f6c093ce54e81bbd0e169f605060d68a60070bffb0e1ba2e54a40c0
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-tethering.jar
        • Path /apex/com.android.tethering/javalib/framework-tethering.jar
        • Size 63KB
        • SHA256 fdabd2584172b86fb29014cb70f61e5995c229db5fe098a80244809bb7bca7cc
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-uwb.jar
        • Path /apex/com.android.uwb/javalib/framework-uwb.jar
        • Size 102KB
        • SHA256 31ec5ef294c561e6ead889767bd0656714f42998717a947427150d51dbc3b367
        • MD5 SHA1 SHA512 SSDEEP
        Download

        framework-wifi.jar
        • Path /apex/com.android.wifi/javalib/framework-wifi.jar
        • Size 985KB
        • SHA256 79bb444346e1086292f96dfd8f859fe6e72fb439c1426db6915aaddb5bd30a65
        • MD5 SHA1 SHA512 SSDEEP
        Download

        journal.tmp
        • Path /data/user/0/com.yugou.og/cache/image/journal.tmp
        • Size 512B
        • SHA256 fbbcd052eb0548ef5445c2f67287e7ce8ff6e029193233da2fafa44336be9639
        • MD5 SHA1 SHA512
        Submit Download

        MessageStore.db
        • Path /data/user/0/com.yugou.og/databases/MessageStore.db
        • Size 36KB
        • SHA256 b63164aa8dde36b72b4757ab4ad7db9d39ee1235ef4001a6cfae60f8381a1cf9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.yugou.og/databases/MessageStore.db-journal
        • Size 12KB
        • SHA256 d84c2ba8b51aa399531a7d8aab7e2efcf3e327cb33accd8f3feb649d4946a70c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.yugou.og/databases/MessageStore.db-journal
        • Size 292KB
        • SHA256 de466471056d7d66ffd8ebe3db40aab77a48339a5c45c7634e76009a7489a855
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.yugou.og/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 e3b6131329c132a4dbd4219827f5dd21552812b55d0cdb483c83193a13136da7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.yugou.og/databases/MessageStore.db-journal
        • Size 292KB
        • SHA256 582661fd7bf1234de481298fe5dd8b6749b8175e824751feb505228ed9a49d20
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.yugou.og/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 c42fa322a307aafa5ba1a5207a603dfd713cb29423bd4a91d1a018dba1c0857b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.yugou.og/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 881beb983e9a457db75ed3bd5debfd93892e21d812273b06ad43b302ee7956d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db
        • Path /data/user/0/com.yugou.og/databases/MsgLogStore.db
        • Size 56KB
        • SHA256 e129740781e7f2193b49fdf7f0862bf5b44877f15df94baa5df523f4dade664b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.yugou.og/databases/MsgLogStore.db-journal
        • Size 512B
        • SHA256 3108544b29759f1478372b195e1308b9afe728d2f04c7717f6c198eb8eb5b1f4
        • MD5 SHA1 SHA512
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.yugou.og/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 44db67bf14691f8ba9b53546f8d4dac3667c8fc50ac853775f127167330b0c64
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.yugou.og/databases/MsgLogStore.db-journal
        • Size 36KB
        • SHA256 4cbe86bf14b5cba7e82b4c126ca2d7b4e10fb1760936c3a785dcc360863003a4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        accs.db-journal
        • Path /data/user/0/com.yugou.og/databases/accs.db-journal
        • Size 8KB
        • SHA256 c015359c121fa269dfa8fdbf91c03616db3e30f36a99f4e63677f1c7764f87b1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        accs.db-journal
        • Path /data/user/0/com.yugou.og/databases/accs.db-journal
        • Size 8KB
        • SHA256 69b2a498e2b91bcee5596c2df8314481298897fb3d9a9349e13ab335d5c79ef2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        message_accs_db-journal
        • Path /data/user/0/com.yugou.og/databases/message_accs_db-journal
        • Size 8KB
        • SHA256 2a7e624508f83b0bbaa9d724be5a8398c8faf99a5d7207ec34e7adb70f5fce6d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 111B
        • SHA256 83974c13e9f970c58d5202ca2da3c654769e35674f477d80e336367ab54fc3a9
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 213B
        • SHA256 84296d92ffb7bf22452df4888e3c62c7707c279a5dd3e3914de4534785389001
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 111B
        • SHA256 a219c9a77fbfd6f5284930e3599d842a33ca3497befb7e9e3005210a7d11aba1
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 167B
        • SHA256 ad67dda6cf536a14e545b72faca67813c9c9a6df4c64c214af05e0af323c7311
        • MD5 SHA1 SHA512
        Submit Download