44d86e0f74b58fda5f94f6e405b6caa1604bf662dd729076722179f0a3e31033

Analysis

max time kernel
126s
max time network
178s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
13/06/2024, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3d2fe6d79b860f55f655ab3ce029859_JaffaCakes118.apk
Size 29.2MB
Sample240613-e43wxaxgpk
SHA256 44d86e0f74b58fda5f94f6e405b6caa1604bf662dd729076722179f0a3e31033
MD5 a3d2fe6d79b860f55f655ab3ce029859
SHA1 cd62b1eb431bbc891c8b0c7ac981676ed5262487
SHA512 fbeb724380cb370294109000d54cad113e781e7a0971b9690a467db7c2780060d775230eaee83d808c547d1e518dcdf695a05b5f90b14eaeb2eac100a3badc56
SSDEEP 393216:v1ENEHZBmSE03ywoD25s06zKFfFyg+W9NEubWWQ/zqFy29OMlh7SWCB5yA7RHDUY:tENwBms3R2wj6mjT3WFreygRSOASglt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/storage/emulated/0/im_sdk/jar/yayavoice_for_assets_2016010701.jar	4357	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/im_sdk/jar/yayavoice_for_assets_2016010701.jar --output-vdex-fd=60 --oat-fd=61 --oat-location=/storage/emulated/0/im_sdk/jar/oat/x86/yayavoice_for_assets_2016010701.odex --compiler-filter=quicken --class-loader-context=&
/storage/emulated/0/im_sdk/jar/yayavoice_for_assets_2016010701.jar	4314	com.tencent.tmgp.kwsz

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.tmgp.kwsz

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tencent.tmgp.kwsz

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tencent.tmgp.kwsz

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.tencent.tmgp.kwsz

com.tencent.tmgp.kwsz
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4314
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/im_sdk/jar/yayavoice_for_assets_2016010701.jar --output-vdex-fd=60 --oat-fd=61 --oat-location=/storage/emulated/0/im_sdk/jar/oat/x86/yayavoice_for_assets_2016010701.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4357

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

douwan_sdk_db

Path /data/data/com.tencent.tmgp.kwsz/databases/douwan_sdk_db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

douwan_sdk_db-journal

Path /data/data/com.tencent.tmgp.kwsz/databases/douwan_sdk_db-journal
Size 512B
SHA256 5b6bb0711d97d4f2d89333874a9be1c0f714ed0046895c15621ada77688bf2cd
MD5 09cb4bb1112b35dfd2805cc610b51ebf
SHA1 42e13ff117c1446ac9a88513ba04f8630428c46a
SHA512 cc2c7ed36d5d323a37590ad94338eff26776a457eeba92b2ac7b081477fde117f10076f96ec9c432618e60d0348ee29b32799b7cb7d4e70dd9238061b9a259dd
MD5 SHA1 SHA512

Submit Download

douwan_sdk_db-shm

Path /data/data/com.tencent.tmgp.kwsz/databases/douwan_sdk_db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

douwan_sdk_db-wal

Path /data/data/com.tencent.tmgp.kwsz/databases/douwan_sdk_db-wal
Size 32KB
SHA256 641f846c99812c08d1f91152dcc3005364c414a27b7d681f532486b68f51952e
MD5 3d76cf1815966afdbdcd59b7effb0c02
SHA1 7800b5ba581aa308ff94561aa8d2bd8d92b4952f
SHA512 222728802ad0475a3bc27704c55ced4d538e87cd88206a83b69c2ae57481e473302186001753b60103eb4c58d19f9769c0b5d20c01a1ce4eddc3ea191483bece
SSDEEP 12:KIlzdTRmBEyPbP/Y6SKpOwClR+DBoyNTSFbyifsUxF6bUEQO8Mc01DQp65RmBEyd:KIlzyGSP/YwnDXfUxZEQM106qGSP/x
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmge_dz_zjh2.db

Path /data/data/com.tencent.tmgp.kwsz/files/cmge_dz_zjh2.db
Size 4KB
SHA256 3eb0045059f4e661b653f7bdf03d07d54a3d3f6afd8fdc398a12b2a1f979a698
MD5 e4c82d14c3403a7a1c47aca9d05e4468
SHA1 3a35a13fd12fd91eb5e9bb1758dfdc8cae32cf71
SHA512 e8cd42cf4130b71fe1e33d6190a268dc6de9f5cfd7c2baeb405020ec61dcc33e232247b315d053e19a4e4a259d37236cd5da3c1fb1a0044049bc8d99ace2591c
MD5 SHA1 SHA512

Submit Download

cmge_dz_zjh2.db-journal

Path /data/data/com.tencent.tmgp.kwsz/files/cmge_dz_zjh2.db-journal
Size 512B
SHA256 b44923e182e968ca5fca444547b04d43a97ff154c4d470b2b9ae6accb0bbb281
MD5 992f99e29512e8fbc4e8dd3946ca9cb3
SHA1 aa284c338e311809cd86e11c74892083dab29422
SHA512 2fece32295497c5e62130896bf0f8003840d52f0a883d2336707e199b9d79d0c32b3d3cda3ce8883f065577b5c0a39b2650fa27aaaf8f70e5286ede391b082e7
MD5 SHA1 SHA512

Submit Download

cmge_dz_zjh2.db-journal

Path /data/data/com.tencent.tmgp.kwsz/files/cmge_dz_zjh2.db-journal
Size 1KB
SHA256 d57c3760ab544ce74b5b94758fd075a564912d160d42a1b1227902d45c8b6620
MD5 c3a0e0f88c563335213e57956ca6f0b8
SHA1 25f49ad9567073406b91902f3808ef1174b0fc9b
SHA512 7e85b8e70f3015e7f6fe5f08f752e6700ce59561e72f658e8199fe2dd784f1ce9bd9cd9a9fe5fa4d624ae0536c41c75732be1daf516df624e85aaa077f1f3864
MD5 SHA1 SHA512

Submit Download

cmge_dz_zjh2.db-journal

Path /data/data/com.tencent.tmgp.kwsz/files/cmge_dz_zjh2.db-journal
Size 1KB
SHA256 4f3ce8413a395248d3a878499d9bec6dbe96963f47284aae760c118058112775
MD5 f839afc815e131687b36d7d7a625f49a
SHA1 132e850debec99086b14cb988f18a2a514c7582b
SHA512 e5542888bb09b8e881b202ffcdcf2a2605774fa52abaa12b60ba05380eaee5f7b7a86d71f768376c6a46173921474f3563929ceb9056b5f01685a25439e40e79
MD5 SHA1 SHA512

Submit Download

DQ.DAT

Path /storage/emulated/0/Android/data/code/DQ.DAT
Size 58B
SHA256 8ead202bea235bb2cccccfe9461907396f1fb72530d8f725aa23e6976f27e91c
MD5 a77192acedae46c912e4db3efb8b1cde
SHA1 97aa1aa00fb3665a9c8ce9354290fe149ae12a94
SHA512 c2f2c8060113af632a34c1bf507eab37ce112ef14827c260a36a76251de041b04159c6cb2175de2c9f565351842bae3c7d52c3cc5f36f89ce3c473be25df3fc5
MD5 SHA1 SHA512

Submit Download

DID.DAT

Path /storage/emulated/0/Android/data/code/com.tencent.tmgp.kwsz/DID.DAT
Size 32B
SHA256 0e154c832275749acc780f11f7e02a1d7a7d52988633afa27ff9acc484cc99fa
MD5 d0e31b2f6aebb7a17d45106bc26cc18b
SHA1 a87e57b79faee95377b05ee9ced3872c93ff24c2
SHA512 13cbaf6552788e13c753bb1e7ef7e1fcb856b2a7fdcf29ae162c315530122eff1ea29d960cf7369cc43eb336d5ba55505275648f473fabb9e97a78217901f85b
MD5 SHA1 SHA512

Submit Download

yayavoice_for_assets_2016010701.jar

Path /storage/emulated/0/im_sdk/jar/yayavoice_for_assets_2016010701.jar
Size 101KB
SHA256 dcaa91eff71efc7908a49d6d902d1a7d8d2abb29a88bdf03675fd95c675e9bab
MD5 0b22ed5fcd4f905a0b39d4f78fb0ec7e
SHA1 3aa10186628a28d243af9fbbeee2ee907c216f0e
SHA512 a84415e5806aceaf242d5217938acd247d2a6a9e96a8b855979b63955e87420ef45cc8c81e7223a83168efaf4efb54caf13c7f0b734d19c78e6f64d5bff1f431
SSDEEP 1536:Fc1j+Lay3St/1ZnU62CFr6sMPW2OW6PpogiUCgYRLuMS7RfMKId:Fc1Cuyi71Ut6r6sMPWzfmghFAL471Mz
MD5 SHA1 SHA512 SSDEEP

Submit Download

yayavoice_for_assets_2016010701.jar

Path /storage/emulated/0/im_sdk/jar/yayavoice_for_assets_2016010701.jar
Size 235KB
SHA256 aa4db8d47b4f11eb3be99ff4614f1d430a3059b49bfde9fef4b5f4deb2540131
MD5 3ec171bb3ccae4bb6eac709aa75cb3a5
SHA1 2f1adaf0c7394b83ec4d27467dcc6a8ba52844cf
SHA512 610872a3807bfa66330c0eeb62f484aaee5f1134b391d7f3994ad0252cd34b7fbb830fa1969b058ffb6390535b8ce9250f3366fde1a3d3e21e11f013fdab1c66
SSDEEP 3072:DbTHi14QqFWO4V/U4/yxeL02IWq8nH9r2TDEsqlxcs8zqFLdkZAK+uj8Z8:PTHi1+aU4/yQ52EsoUD+t8
MD5 SHA1 SHA512 SSDEEP

Download

yayavoice_for_assets_2016010701.jar

Path /storage/emulated/0/im_sdk/jar/yayavoice_for_assets_2016010701.jar
Size 235KB
SHA256 e860a621acf780073ba87936d5712ffd71c16718ed8baa60160e5548cd6089b9
MD5 e3fd9eac3ba54aa6d99d0eb0604ecc6e
SHA1 e79f63e5e4f5ab98c3bf55851be825b63b0849da
SHA512 ad2d6e4e8d684f596901a0cf4fbe21e2e6f49d97bf781a0cddfb376b2d1fc2fbe8fdb3e1179561a412d8161f181699d7376b04bdf031d56f412c2dcf3148cf03
SSDEEP 3072:DbTHi14QqFWO+n6ypyJfWJyx9oNV1kwIkeXnr7Ar2TDEsqlxcs8zqFLdkZAK+ujV:PTHi1+8efWJyfyBeEsoUD+t8
MD5 SHA1 SHA512 SSDEEP

Download

phone_uuid.tmp

Path /storage/emulated/0/yaya_im_sdk/uuinfo/phone_uuid.tmp
Size 32B
SHA256 10282664bbd3543587087ebc276576fdc11954d6c29f9f3d3f75f5e4a96f8747
MD5 dc00586326570127602dcb508df27115
SHA1 f597a810ef40b22e3476fb577ac93a493493ee78
SHA512 c9ed97ee03dfafafa97c10f3abde27cb0cf50ba80a3696310ac1db43a09cdc8e34a7524066612cc4a7a2bedc88fa65b450307702f94b13c43045edf204c241c6
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads