e2f4cf12c2da182b17aae2fba3481c933ed598a2c82c93756dc23a5285a4bfd0

Analysis

max time kernel
5s
max time network
180s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
13/06/2024, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6f924cddb35d01871883372d0545225_JaffaCakes118.apk
Size 13.9MB
Sample240613-2skbratepb
SHA256 e2f4cf12c2da182b17aae2fba3481c933ed598a2c82c93756dc23a5285a4bfd0
MD5 a6f924cddb35d01871883372d0545225
SHA1 89efcc85da49af4c80130cc5ec1ae688e139b7f4
SHA512 bbfc493f8bd7092733cc00330a015a66255ccd6f0710391c9267c5d6a573eb7a5847d13f96894a4cebd512272676bf8cfcfbbe64029249fa1c7ccf9d3b5af9a9
SSDEEP 393216:XS8LT/rNqWAxLRVCvgrpW0cS7FMjnX15bgn9INByUT4O/:zLDr0XTV/9WvX1eCf5
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.ikongjian.decoration

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ikongjian.decoration

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.ikongjian.decoration

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ikongjian.decoration

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ikongjian.decoration

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.ikongjian.decoration

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ikongjian.decoration

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ikongjian.decoration

com.ikongjian.decoration
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5030

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1004

Path /data/data/com.ikongjian.decoration/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

1004

Path /data/data/com.ikongjian.decoration/app_crashrecord/1004
Size 233B
SHA256 03cc242260332e7e676e29a087e4b0f7f967cd5320bd73a8df9ca3577830a63f
MD5 39e1f16bf74c9e825dc13b25c9e4c0a2
SHA1 250fa0a2e7adef224213876f735dc251f0332169
SHA512 3717dda27180753e1d2b4953611df578066c8c71fd7cc5f74e98658ec008b3936eea6e847eff0fa752c4e952f5d868090e9d568d109aae1d4ee6d536974d90ae
MD5 SHA1 SHA512

Submit Download

bugly_db_

Path /data/data/com.ikongjian.decoration/databases/bugly_db_
Size 52KB
SHA256 30b89ee68ea527810da5c1afcca6e033476676d648b7133e7c372347f446d6a8
MD5 8d779bc351bca34ccd2d2809e41b443c
SHA1 f2d08dd7bb15bfb63759fa9a305d46e7a0ffac09
SHA512 f852654be6d55cb30192a0fbab2ae1ef18166489b95b5a8ce8913fc242e4478b98b7cd49ad8aa11b400ee2e12ddcbed5f0c1d87a22cb373f029cf5f94df2f231
SSDEEP 48:TS85WuAriStwwuMN5meposSyzw2YRlryCi3K:d53Azwy3Yz+33K
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.ikongjian.decoration/databases/bugly_db_-journal
Size 8KB
SHA256 ede0bb10e4aa00e09491ae80d5b53c092dad971ac465ebedeb3b12ceed296b07
MD5 2ea9bc1bf2a27c5e314507acdffaede5
SHA1 1ff79870bd0fc91a9f9e06c6c3eeebbd8aa398d6
SHA512 41f714b44f8c71bab5d77f91c866587dac0931987a5188fb587dd804702fd3d24edf881802b880218dd0a6261266165b41196cc74069ba2e66d7999e0575c729
SSDEEP 6:7+/l9ccFn1kxg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKh:7+tfYxqLiuWdwRmBEyPbO
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.ikongjian.decoration/databases/bugly_db_-journal
Size 8KB
SHA256 f89eda93e10f36dba253008753f6bb43f1fb6936cc89ecaa23b4a441d3ec9bd4
MD5 a41df95beaac51a75ea759f1bc3701bd
SHA1 fb92e3aa5efd80e787c70d27cb89645bff518f36
SHA512 947996045cca5b8f95019058e29091dd8478d25948b23a60ebb8ba3b559f24e387778f178679ca7e78e071f70ee1f200356dba7264ce0682c18fff5744b8a4dc
SSDEEP 6:7+/l9YgHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKDU/4:7+thqLJdTRmBEyPbC04
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.ikongjian.decoration/databases/bugly_db_-journal
Size 8KB
SHA256 d465deb6025e34e2fb0fa1db3e81bd6e916384612adec173ab4c01dcf3f1f172
MD5 bb9fffce8241776365ef3e3cc676d3a4
SHA1 ab3ceac926a4c85de6e5711b00627d4195e07b95
SHA512 2eb94038b8b589270d1c38bf7c006caa1f133b9da2139e6ad594a4d7b9587a78d1db571d6d195340fa12394c8d7e0c22e2478b98eb97f6a7e965373468295752
SSDEEP 24:7+tE0qLL6Bq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSQ:7Mzqy85WuAriStwwuMN5meposSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.ikongjian.decoration/databases/bugly_db_-journal
Size 8KB
SHA256 f6e5f2856ed57bbcf979826a66c090229abb822a9d5767e5fbae1ebd94436379
MD5 318330f5161268c70543fc0b642d0ce4
SHA1 1513754d18006e75e77ae86c9d82fa9edce22d15
SHA512 525a6dcee2b8243e35e7ac2dad676711bbb2df1c50832ab73afaaf3f62778d8c924bf848b44ec58a680fdf188166ccd63c7fa83a45f57cd1970aa7678a6a61f0
SSDEEP 48:bRlryCi3KoqUJ85WuAriStwwuMN5meposSV:bz+33KoF653AzwV
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.ikongjian.decoration/databases/bugly_db_-journal
Size 512B
SHA256 8c5f479a4bf3e997e6a363248309155d1a472944939d59c6fb1cc09676bd0082
MD5 ce99de2b5fc97b762f219c87c53d822e
SHA1 56721dd26a7fffff6955262c701d00621e9c0fc3
SHA512 57947ed8653b23d875744f578051f9f8d15b7938638c97fbbebee80f367c2bf64faeef13052d04a1248986f513de945a4cc1509c55a81745ab9da473714bd3eb
MD5 SHA1 SHA512

Submit Download

domain_1

Path /data/data/com.ikongjian.decoration/files/Mob/domain_1
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads