Overview

overview

8

Static

static

1

a44c26ca83...18.apk

android-9-x86

8

a44c26ca83...18.apk

android-10-x64

8

a44c26ca83...18.apk

android-11-x64

8

Analysis

  • max time kernel
    91s
  • max time network
    178s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    13/06/2024, 06:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a44c26ca8354ede2009cdfa561ce6b28_JaffaCakes118.apk
  • Size 2.6MB
  • Sample240613-hpbewssdkr
  • SHA256 d0d7333f7f5b147e11c6ceb83549312d160d5f2244b3553b5623592a9ef6615b
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
collectioncredential_accessdiscoveryevasionimpact

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
    evasion
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.yxxinglin.xzid60525
    1⤵
    • Checks if the Android device is rooted.
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4446

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ua.db
        • Path /data/data/com.yxxinglin.xzid60525/databases/ua.db
        • Size 24KB
        • SHA256 6ee00073d75c3f0f352b3b0f574b261771a94641eedd63a86b8cd224ce0bb240
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ua.db
        • Path /data/data/com.yxxinglin.xzid60525/databases/ua.db
        • Size 36KB
        • SHA256 1fa1b6e6bd75bcef64d35785e2fd6f2e73dcdf92dce73c8b2a8fed49746d53bb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ua.db-journal
        • Path /data/data/com.yxxinglin.xzid60525/databases/ua.db-journal
        • Size 8KB
        • SHA256 dc2e4affd67f1f0f2aac81f110f1b86bde9c55053dd62b5ac495584c2fd700d7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ua.db-journal
        • Path /data/data/com.yxxinglin.xzid60525/databases/ua.db-journal
        • Size 16KB
        • SHA256 7398f730681d1e02d10522d2c69cec14c475f51593fee7605a4015a160bf9d93
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ua.db-journal
        • Path /data/data/com.yxxinglin.xzid60525/databases/ua.db-journal
        • Size 512B
        • SHA256 e1ae04e8e4e8778e67130fce52d864102f74e6a61f63af54b573de77f2db5296
        • MD5 SHA1 SHA512
        Submit Download

        ua.db-journal
        • Path /data/data/com.yxxinglin.xzid60525/databases/ua.db-journal
        • Size 8KB
        • SHA256 af606081f7073561fe705e020ff8db82ec5d72912676384b4467000a52f13d0d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        a==7.5.0&&1.0.0_1718261673980_envelope.log
        • Path /data/user/0/com.yxxinglin.xzid60525/files/.envelope/a==7.5.0&&1.0.0_1718261673980_envelope.log
        • Size 1KB
        • SHA256 26ad4842052abea72117cbca4e78c1298d0df5f8e7d5b7a8062fc601e621078b
        • MD5 SHA1 SHA512
        Submit Download

        i==1.2.0&&1.0.0_1718261668943_envelope.log
        • Path /data/user/0/com.yxxinglin.xzid60525/files/.envelope/i==1.2.0&&1.0.0_1718261668943_envelope.log
        • Size 2KB
        • SHA256 e2aa0cbfb22e6fadc8c5bfeeb88c2a0efb147c1ca290225b2e084631cfa56804
        • MD5 SHA1 SHA512
        Submit Download

        exchangeIdentity.json
        • Path /data/user/0/com.yxxinglin.xzid60525/files/.umeng/exchangeIdentity.json
        • Size 162B
        • SHA256 fb0b083f3c8f500d43bf6ed64529623c2ecf5683171050d55b055ec95be7984f
        • MD5 SHA1 SHA512
        Submit Download

        exid.dat
        • Path /data/user/0/com.yxxinglin.xzid60525/files/exid.dat
        • Size 62B
        • SHA256 a5a4fa8ecf0ced436bf04e257bc36adff124bd6ba10350ef2b1664ddf7bfeeeb
        • MD5 SHA1 SHA512
        Submit Download

        dW1weF9pbnRlcm5hbF8xNzE4MjYxNjY4NzAx

        • Path /data/user/0/com.yxxinglin.xzid60525/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE4MjYxNjY4NzAx
        • Size 1KB
        • SHA256 eae45834e0d0fb8643e8ca2a7abd6cd1061c2a8fcfa434be406c6cc3e04e79c6
        • MD5 SHA1 SHA512
        Submit Download

        dW1weF9pbnRlcm5hbF8xNzE4MjYxNjk4OTEx

        • Path /data/user/0/com.yxxinglin.xzid60525/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE4MjYxNjk4OTEx
        • Size 1KB
        • SHA256 ac208ffa77dfead81ffe87a19bc2f69940610cdd7a058aef0d3379fa7d3de80c
        • MD5 SHA1 SHA512
        Submit Download

        umeng_it.cache
        • Path /data/user/0/com.yxxinglin.xzid60525/files/umeng_it.cache
        • Size 348B
        • SHA256 c2a0025fce17ecbaec91f8f75defb976ac3252eb70baab51fe540d23cb09a6cf
        • MD5 SHA1 SHA512
        Submit Download