3d9db4de30932cb36bbc631f70ed516d93c90e51d481bd48b94bdfb83f8a66ec

Analysis

max time kernel
8s
max time network
141s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
13/06/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a37b4ad34f51957f3ecd532ab535e3ea_JaffaCakes118.apk
Size 6.7MB
Sample240613-chldma1ajf
SHA256 3d9db4de30932cb36bbc631f70ed516d93c90e51d481bd48b94bdfb83f8a66ec
MD5 a37b4ad34f51957f3ecd532ab535e3ea
SHA1 25dd7bfa664931081aaff4739ca79d696e45f3db
SHA512 86df591c7dd60706fd639bfcade0b9d68358c3065b8f84151e17c53d2ec5aba7b22a50be5a7b0b04dc99758baed8c3cc5cdb831d642e8763d289610e07da780d
SSDEEP 196608:qjoH3ZX4Qs01H8mGaNUXKSWjiFDNaFkR75N3VAvl/l1tm1Sqi:qj8ZIQtNUXKroDWk7NlAvNl1tmM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mida.messagehelper/[email protected]	5027	com.mida.messagehelper

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mida.messagehelper

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.mida.messagehelper

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mida.messagehelper

com.mida.messagehelper
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5027

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classes.dex

Path /data/data/com.mida.messagehelper/.jiagu/classes.dex
Size 3.1MB
SHA256 56cb5bcc778f899d96aa6ce005615e17f94a79d05998bd11ae70f64aaa457e79
MD5 a48506bd2578830c5df386e74aea63f4
SHA1 648910706f768e0cef01feeb805e4579c996eda5
SHA512 9be724646a8504ee031b8836e6d29b43b9e75f70e5af6f4c9fe933eb05af3e19e4b3537a7986d828c4e223de833f567d4c336d8cb0ffe0576a3bb5f0e51fe7cd
SSDEEP 49152:l33SgN68SQaI+QJT+7MQQtua24wBQRHsZASkP92HE6GDx:BTXhl6gQbq9wQx
MD5 SHA1 SHA512 SSDEEP

Submit Download

libjiagu.so

Path /data/data/com.mida.messagehelper/.jiagu/libjiagu.so
Size 455KB
SHA256 78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e
MD5 e5a53000766ebc433b27d6a66ec4f555
SHA1 2c8f53f1c03aec2005bcad67d731f07261dabde0
SHA512 370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d
SSDEEP 12288:XfCZt8eDxO+LCDA89hC2KL/MqEvnapbMt6hVPZWJ:Xfw/O0Cc8zCD/MVvUHnRWJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db

Path /data/data/com.mida.messagehelper/databases/MessageStore.db
Size 36KB
SHA256 ecb0e8c93a782292a1dfe20a90e204d1c1c804e2773f1831c9ca34826aa62071
MD5 15669eb47bb19111cb64fa7508b227d7
SHA1 c7585424afeb0fc7051697b771eb3d81e0e3aae3
SHA512 13c2cb45912090ba0b670b36050eab5954e22d57b79e141d2236035dc1ea2000960d93ebc544fc4dee48765335a3d52baeb5d31c8a40407224c624fffebbc11b
SSDEEP 12:TLGPi/W7X2EkamDfVcsg1jWuQUmKiayaA9HlApc2o/0XyNTSFbyc34wyACumRmBH:TLGPi/UPzmD6ZWaJyZ4M0yAN9GSgGQe
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db-journal

Path /data/data/com.mida.messagehelper/databases/MessageStore.db-journal
Size 512B
SHA256 ed2d3d909387855243138e1fb75fb386acfc47db3c3dbe98957735d5adaee43a
MD5 2060291837caeafcd06d32089d4728b7
SHA1 c7252b3cac5ceacb767c3183a2bcbca6a3db2039
SHA512 1f0c1b6c1c5a57408039af97793a59426cc165cbd221580d0f6fe2f214040a7a5ef07e1b7908dd5bfe85fa8edef377f35bdcf8f0b9f594f3a9ee7e5a0c2a1f88
MD5 SHA1 SHA512

Submit Download

MessageStore.db-journal

Path /data/data/com.mida.messagehelper/databases/MessageStore.db-journal
Size 8KB
SHA256 b6a571975c07abfda935162e5ba1b725681a42ae662606dede816cf66d2c3c77
MD5 dc2b91f01b6f7efd36f11974754d4dde
SHA1 ddc1ab37e8e74c86faf9b6e4eb73a27bca237539
SHA512 ca8f774754a4247bab41e0bf81038147c0447d7ad1c4f9096212f657142cb7abed145697b0c3634ade0808e6aebe3691c7daee3a5ba191accf89358aa30bd01f
SSDEEP 6:7+/l9kWn1Ag9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKgk:7+t0qLiuWdwRmBEyPbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db-journal

Path /data/data/com.mida.messagehelper/databases/MessageStore.db-journal
Size 8KB
SHA256 ca132b535d95d7320f09689916e2a7e76ade8d17d932108492d39fa9d5d05d35
MD5 073846933c3423f11093f800df7f4260
SHA1 6bd521183efba3655704f51b7ec31e37a9144fc0
SHA512 ab3a33dbe63bc4a68d09b34256448e2e372a3394f1612c2f1db5da1b0dec43ffa4e6c09211fe7e9272ba90a673b1c21f8728913ba01de8b4a4cf1b3e3242d5d1
SSDEEP 6:7+/l9m4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKib/q:7+towqLJdTRmBEyPb1q
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db

Path /data/data/com.mida.messagehelper/databases/MsgLogStore.db
Size 56KB
SHA256 05be88f05e9bfd4d6496caab584a704e7956fb87036529a0c8028f1e2bda309c
MD5 9cec591e3ef91ae568f4cb6e7c2a8745
SHA1 ccf756b6b465ad9ad7ff6bfbeb4e8345ba3f6ff7
SHA512 f824b3268338787275c184bb740d152d53c1d8e57a044f587530735ef04d021a2671cc2aebb17ae3b497a0ad171060da484a565bfa62d32ed334ae5ffb538f51
SSDEEP 24:TLsji+931pd6O+Rn0H46Dgn8tN8X48XeqS8XRu8XM8XMWlsl4qSlXmlIl18f8Dqo:TUF33QO+t070OCJfhF8GIUWZw3RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db-journal

Path /data/data/com.mida.messagehelper/databases/MsgLogStore.db-journal
Size 512B
SHA256 379ef7c85864178d662437bff1f05e4926866a9a3e6e520c3e08dfcbac76e40e
MD5 83fc34762bf24c50e79ed414fc86c401
SHA1 4706155abb2383c6e70a612ae15214698681a0bf
SHA512 da11dc940401ebb32a16fd81f92626806cd27b4ca844c8da40a9d533632a52e999870ccdadc20d4bbc6c5dbe45411442d574e3aaef3cb0efa44149b209ee8f2e
MD5 SHA1 SHA512

Submit Download

MsgLogStore.db-journal

Path /data/data/com.mida.messagehelper/databases/MsgLogStore.db-journal
Size 8KB
SHA256 3515571e04f6ac9cd5d413d115d549f4380299bd0f1ae43a0cf13e3742c9c785
MD5 5010a8feea503bc91f12599c547e8d7c
SHA1 ee81a05a551b35c69b026dec884e66bf35181eb5
SHA512 7f71aa9394fdec4c464ce413b014a49145a5593c45767c7dc92ada3039f58be9346de68dfb469bd855d738c45ea3b9240fbb1ddb418c8b94156a0fff3cd9212e
SSDEEP 6:7+/l9cgFn1UFg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK5:7+tLQFqLiuWdwRmBEyPbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db-journal

Path /data/data/com.mida.messagehelper/databases/MsgLogStore.db-journal
Size 8KB
SHA256 c93a083e6688fe343ed551246b1eb55a1be16aea2976392fb66b2cfe23473c19
MD5 84486613fe2fd6a54b929bba639b503a
SHA1 c9341072224ffe81e6a2c6d9d446470ee34c7b09
SHA512 dd02eb207262768335e11858e1d8078ef3de294a66e8af4a1d3ba3365d45b3e672a49e58a734b3b94c3bb41b70203919eb9f2cfe3043efec63f972e76871ce03
SSDEEP 6:fgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK3QM/V:QqLJdTRmBEyPbqlV
MD5 SHA1 SHA512 SSDEEP

Submit Download

.jg.ac

Path /data/data/com.mida.messagehelper/files/.jglogs/.jg.ac
Size 32B
SHA256 2eb29f397a57d51aab4235cd83188c4fb457cd2a3312d9f553e7fca932f95ba4
MD5 a22ca5f04b5f5373e4430a6abb5120f0
SHA1 900a7b6852aa6970a80a7cd505284d3a76ef99d5
SHA512 fe09549e0d4aaf1451591024d7c554c72c0d58152a03dc22f7b1f5d2e367384cdf143392ea6065b779c695abc48828a540969ac433914affe888940c02060259
MD5 SHA1 SHA512

Submit Download

.jg.di

Path /data/data/com.mida.messagehelper/files/.jglogs/.jg.di
Size 340B
SHA256 b70e3f850361399e9f93f5c7df754138cf9f90a244d0c20e8b64819909367d5e
MD5 38635e4d6e36d18b279327db1ed5460a
SHA1 5ce373ca593175c58d172be8722360cee8f3de9b
SHA512 ed930ba9a0670fc8b65a2ae7d22e7550e184771357768a50bfb4670e30bb0be06520d0963afde100b09fd97093a52a1a2f9f85d972265f8086b31b0e9be2de4c
MD5 SHA1 SHA512

Submit Download

.jg.ic

Path /data/data/com.mida.messagehelper/files/.jglogs/.jg.ic
Size 32B
SHA256 2b04c4d44f8b02135aded1671117361f42bc562e3282c3f31e7ad840cedbcc26
MD5 4cdc92a556bd47669da56f8b7b4938f3
SHA1 71ae67e5ea5d7314b35058486086eab7938dec32
SHA512 f6d7bbe2af574a7f86a3a0e382b56ebb86c8330d4f7f9232a14cee971ef618ad516521768bc661611aa703904374f5535ba58787069da8cd8a50a9c36ccd2b5b
MD5 SHA1 SHA512

Submit Download

.jg.ri

Path /data/data/com.mida.messagehelper/files/.jglogs/.jg.ri
Size 314B
SHA256 4808f82a72c109f3f4b5cedfd7084275c4974b2600485b5dc5ae45b474fe5cd5
MD5 6dc592d71009ccc38b91e30ff298e574
SHA1 dac35ba37bb330672c6ea3612b209db8f3c3e3cc
SHA512 aab90f48ffc030e8b77d399f1430b29ee69476521b633189a34ed559a9fffd52a00461ed051fa0cfbb8ff716f1e60254b34449de9f6fb229dc37c1095d8be75d
MD5 SHA1 SHA512

Submit Download

.jiagu.lock

Path /data/data/com.mida.messagehelper/files/.jiagu.lock
Size 27B
SHA256 fa32caac54cdc88c91baec288175ca143220faf8c133a0c53b4c136007ed2f1b
MD5 617fc6d934487e528902b97b681f95e7
SHA1 14b11237c54ed4d37200b8e10106899938d79db1
SHA512 cedf2dc1095e26a7b64941d6901999c53a81e13d8850a7f61e52eae64a6a666addaa6276d4dafd42add9d21a3e57122ec67a15ad205510fd79827c1939fb421b
MD5 SHA1 SHA512

Submit Download

[email protected]

Path /data/user/0/com.mida.messagehelper/[email protected]
Size 5.9MB
SHA256 cec0c50334c9a527d2dc2e1ba010850beaf2e63eeb914c0c333e54ba21d07b8f
MD5 40c3f0229a49ec43ebe166338a4832ce
SHA1 f873387967223971c406c5b85928bb3f87c973ec
SHA512 bc6efc3e3d76305333f6ecac782f59967adb7e19e997179806c170bd9080c5c7186b5ffd2ccc2568e5c15748f8612125765f06c8b0feba4e6444ec65eb8655a8
SSDEEP 49152:SzynAzsKiNJ+JtK6268Axunz3Yf4bsM+zZGE3OMkdM2CmzmiL8a50GaoAmDAdFS4:UynA/iNJ+JtK62k0VEdFST9rq9wQx
MD5 SHA1 SHA512 SSDEEP

Download

.deviceId

Path /storage/emulated/0/360/.deviceId
Size 48B
SHA256 36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
MD5 4c4c5285293d5141f582aefa4e038669
SHA1 e01852a72e5a8e6f7d63a21426b515118196047b
SHA512 097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399
MD5 SHA1 SHA512

Submit Download

.iddata

Path /storage/emulated/0/360/.iddata
Size 32B
SHA256 c6b3d486f899038545c1a5ca50e11cd314662be5cd963e2e283cdb1fbc1a666c
MD5 fc2563cfc2e516c666a3f028767d663a
SHA1 ad2cdfd86c1a4a90330985bfaffdd223a2a8b62b
SHA512 fbb81518883e67f53df0a6bbaad8ea098ab997fec143d0d501274a06df9cbe03e294a8e43317737821bfc21a212792f6d58fa886da22fa8dcbcd516c1ef01a24
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads