Analysis

  • max time kernel
    177s
  • max time network
    194s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    13-06-2024 09:05

General

  • Target

    a4c44f081d43c5e76eb939bd64fb50ff_JaffaCakes118.apk

  • Size

    5.1MB

  • MD5

    a4c44f081d43c5e76eb939bd64fb50ff

  • SHA1

    7962ee6066c0f77cb62006afd05179e613a879e8

  • SHA256

    1e78e41b59fe2c16dc2150bf1b78f9b21b5abe63ab70a19208fbc6e5edcc3ed3

  • SHA512

    d49ad93f64fdbdad3782c372737529f990409b04ddae8a012581f3f20ebe402a8304c3cb6b58fe061ed5cac3b46cd48d1d0745d392738234f69845f46637c10a

  • SSDEEP

    98304:btguRn/QdPY9NiRKcoNrmtr4Vovurpl/DeBPGg4QPQfRKVtlzi3OfG63V8iRg:5GPiooNYRu1l/DeNGg4fRKjEL66iRg

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.shangleqiu.shop
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    PID:4305
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.shangleqiu.shop/app_plugins_v3/a.b.c.d.e.cache-10-10-100.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.shangleqiu.shop/app_plugins_v3/oat/x86/a.b.c.d.e.cache-10-10-100.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4408
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.shangleqiu.shop/app_plugins_v3/a.b.c.d.e-10-10-146.jar --output-vdex-fd=55 --oat-fd=56 --oat-location=/data/user/0/com.shangleqiu.shop/app_plugins_v3/oat/x86/a.b.c.d.e-10-10-146.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4449
  • com.shangleqiu.shop:GuardService
    1⤵
    • Queries information about running processes on the device
    PID:4334
  • com.shangleqiu.shop:multiprocess
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.shangleqiu.shop/app_plugins_v3/a.b.c.d.e-10-10-146.jar
    Filesize

    83KB

    MD5

    301cebffcfd9405fcbf67b851c22655d

    SHA1

    5ed5f2c21ae3d7141953f81c4f642ada82f801a2

    SHA256

    e51d9f4f9f55e1a3c9592ba09d9928ead3a41b9658c0fcbb06bb46c3176b1d81

    SHA512

    51dabd63fc9e58e70d9de4dd2be10d7e0e7d3c78451192a547f436378546785b8071f631c0eb95910512d705caa8c0212a9c9b346a639480eb01c2e2ebea505f

  • /data/data/com.shangleqiu.shop/app_plugins_v3/a.b.c.d.e.cache-10-10-100.jar
    Filesize

    31KB

    MD5

    d11e680da708e66c182ac4c2e01207f1

    SHA1

    ef4abe76f0b05a23e65ce440a53d81c9c722d9e6

    SHA256

    1b77977571eb01344fa4ee385ed6e912cdb2f4729d15da2db98ccd92dca2a0bc

    SHA512

    006bb40849cf6616a1d9f3083cdd5b5183a6b34f4df451ad5edec7b3dab4f4859897fa56c51defe49f4e44c102bbc5ee25b03ba1fa1505bdb44beeb90e4c465a

  • /data/data/com.shangleqiu.shop/app_plugins_v3/oat/a.b.c.d.e-10-10-146.jar.cur.prof
    Filesize

    243B

    MD5

    ab96091b1e1fef17461058eac229d3dc

    SHA1

    4e64f85b717f5c5fa85716f002b82beb00ef4dc3

    SHA256

    d0b37e00ccd61188fdeee180cf92982caaedcd91e5003b399455bae300de488c

    SHA512

    4cc57f082ce7d57d59ab982c71d8694670b66e16db5f13fa0d656175e3e583bcf1f2a2e5dd3d90116dc1d6858dad1b84dd273d98ba0aed4715c62cfd21d4e04f

  • /data/data/com.shangleqiu.shop/app_plugins_v3/oat/a.b.c.d.e.cache-10-10-100.jar.cur.prof
    Filesize

    128B

    MD5

    5991d32e2a6ebdfee7c655ce690736e2

    SHA1

    7008e8c5af9eaf9b49644815e3beaf9ed9ac0dd2

    SHA256

    329d7d20f22c4d7b79439b303782398b2f1be7a5c369911a2a74f1d274ab2bff

    SHA512

    56ad8c69bf36b342c735b267aea3cf214aab3325be44dd1fbf9244ce80d34753fefa95469008d31f59b78cb937f2c759ae75c81c2f204b294e3b72e71caec22b

  • /data/data/com.shangleqiu.shop/cache/ACache/-106815946
    Filesize

    49B

    MD5

    fb71b8395e073f73d504e0ad3ad5d929

    SHA1

    70e2e9c5a1c9b090332efb956ff9b39085edc7c9

    SHA256

    1ace56344bdd1d3f20ea7b0caf3a991a39c61ad26e9cee88eb3fbfa9fd4fb430

    SHA512

    c9a92ab65ab8738c2c107a3e8f290dbf2a65ed96dd256882ec6baf20724583880746697b361e96b91f631c2f86250eb38291fd8f7d5b6203b79be2897fb7f337

  • /data/data/com.shangleqiu.shop/cache/ACache/-1256049348
    Filesize

    31B

    MD5

    b95570cb89c3cb21c84d6d1a87e1c573

    SHA1

    bf09e1c02adbb4296d6508536e687814cc52811d

    SHA256

    6fafada4cf9f71dade3932c1b64c745f0315d27bddf5b4379d4588dca2a74dde

    SHA512

    c923e06daeb85efeec6fb9e7f954b629b2237d277d83486df665e0e7105b97027a7a6238fadb0aa45126d1bf26bfd7ec0f2ea715bf782652a62cdad280924da6

  • /data/data/com.shangleqiu.shop/cache/ACache/-1548376672
    Filesize

    32B

    MD5

    9cd57c3ae86dea081714577fcda1264d

    SHA1

    39f388b2860ec7ba6d176c42c01af78250349c19

    SHA256

    8fa454addada64b8d9e15542136c7f0c6dd66b71669f9e6589f844e05a2896a3

    SHA512

    bb019959ea3907f5797b8a9d7ba8408e6e3eb70eef92f693852a60197f76eace71b4f06a4eeb6fcf4fb705504de3cda8329dd3e0a28075ffc25049312758ea74

  • /data/data/com.shangleqiu.shop/cache/ACache/-1578142395
    Filesize

    186B

    MD5

    7d9619be561d44671cb2b25a09fef1ad

    SHA1

    158f453e878b4f973f7764b13179d189e436ce45

    SHA256

    9b1a71d854b2f945f289e933bec2118faf02e7b1cf30e86809bb3103fd34c933

    SHA512

    4dcb3c29891bf1dad35595a54edf4f4087f76c7188601eff5341162c9d1b2bba6c6ce2bdcbd4ed784edb8231b2c7e49db749e9b72d930409729f0047ef6ac884

  • /data/data/com.shangleqiu.shop/cache/ACache/-1795434967
    Filesize

    16B

    MD5

    f8f80ad2548f2939d74cb85702708757

    SHA1

    81c9dc6e0307300d5a463955f2150c73e3e0d639

    SHA256

    0ddfe620e22a99b3ffe3e37ac0402a9243b648e1efe77ee0f83e799a6cef8073

    SHA512

    c78419286ecfdf5fbb31a6ac9e648d1f7994aa9b831d7509bef00658880f75bbc3c77b3fe1dbe7c30e4d512ebe64a41701cd46a4ec207ee9fe09956a8904a374

  • /data/data/com.shangleqiu.shop/cache/ACache/-1813379398
    Filesize

    17B

    MD5

    26c276d83df2ecd7b9aaab972103b7b0

    SHA1

    0b71f1940d31c492a8a9576d39ad4857206a1369

    SHA256

    9984f3e228d14a1d8a710338f52f3c39513c9cf85138920f87f583ef04d30269

    SHA512

    d5f0db41dd6a0a5395fd855cd488cf7eb8246143466513445a5d12d29345181fb9582b3e3bb16508a830fcadbf130c9254255e808ab2f891685df1acf741e726

  • /data/data/com.shangleqiu.shop/cache/ACache/1256040752
    Filesize

    1B

    MD5

    c81e728d9d4c2f636f067f89cc14862c

    SHA1

    da4b9237bacccdf19c0760cab7aec4a8359010b0

    SHA256

    d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

    SHA512

    40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114

  • /data/data/com.shangleqiu.shop/cache/ACache/1391917710
    Filesize

    47B

    MD5

    fe7aa46943ee7a2a7ddfe309d7468510

    SHA1

    580593250eaf52f6841f1734ee433773c77b294e

    SHA256

    98df2ec897fe794cbdb5366333ecd17dd763d65857f210f310450de69874e35c

    SHA512

    6923de3c1ff867c94af1d88eac6a541db3a4908cbf2d1706172e52717a3ee307ba314274cffe6bbd4fc87599410a31ab089bcef65c17ed192e9bab58976bd47f

  • /data/data/com.shangleqiu.shop/cache/ACache/17195168
    Filesize

    5B

    MD5

    68934a3e9455fa72420237eb05902327

    SHA1

    7cb6efb98ba5972a9b5090dc2e517fe14d12cb04

    SHA256

    fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

    SHA512

    719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d

  • /data/data/com.shangleqiu.shop/cache/ACache/2110136299
    Filesize

    28B

    MD5

    570dbe5b27f3d4937a429874c4f1485a

    SHA1

    a6d32ba22f1d5f72304446d5882312424e8b877f

    SHA256

    c65bce40676fb2f02e0839bb615454b52f8c1f823c2a7343d534d6b4607559e5

    SHA512

    026c9f67d965121bd1fff50967f07dddb3bf4dc0e0d0e09195a39ba39bd8f743aef80a70d3c9979748370e5c5058d1e3a0ce220fd0c33295011f3ba5821762b8

  • /data/data/com.shangleqiu.shop/files/jpush_stat_cache_history.json
    Filesize

    495B

    MD5

    08ef92fd9fb88b428270b93ae48813d2

    SHA1

    56ac6d650a511cfe47579c4fcefe8f1b22c92036

    SHA256

    2520e131c6128163fe5d3944415052d765e2531144656280085da28a1cd2452d

    SHA512

    93db4ad38a5e127c27b5fb6031a49a784529925f548c275c350b80508efaa3b022e78305d10d58f3b50e935ddc0c20d3bf09d555606cecc8bd09547f4d5fd3ce

  • /data/data/com.shangleqiu.shop/files/jpush_stat_cache_history.json
    Filesize

    349B

    MD5

    2c3395f06dbbbc80097cc3e64dab8568

    SHA1

    db1cbd4a01e8ac63e561c8bd17c28bb42b7a8b34

    SHA256

    7d32a80e6d6f55f5e8f0ae5b80517270fe4ec81619ac891f4c6d74cec1e0706a

    SHA512

    8e25d744863d587bccfb7a59960c0dedf74d5d7c9c93171ecccc51ad4244e779ec629889efadd9c47d9f715159136c7bdfb2123dc1e19798a4109c02d55f911f

  • /data/data/com.shangleqiu.shop/files/plugins_v3_data/a.b.c.d.e.cache/cache/ACache/-1795434967
    Filesize

    18B

    MD5

    cf7a9ee135960978f36c500b6f89bf00

    SHA1

    8c4beeaf7f38283e8d2b615f42ae5bf1c37c10cf

    SHA256

    7bede90dcc8eb6aff78333e98db34110c4e64e20621a1ff93e360f0258f9adaa

    SHA512

    164406b4b1f23e1b2c6177cd41ed886fc07092711a13e780ac1a31e77e41b0536f4a538b1ceae5be414665da93bce564f0e0c8e3eb8d5f4a38fd9cd2acb4b8a6

  • /data/data/com.shangleqiu.shop/files/plugins_v3_data/a.b.c.d.e.cache/cache/ACache/-894512560
    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • /data/user/0/com.shangleqiu.shop/app_plugins_v3/a.b.c.d.e-10-10-146.jar
    Filesize

    250KB

    MD5

    2985be3f1dfa736fc1afbcad6a4fae97

    SHA1

    e37b014aa8820efeb38e22b78a9fd3b8865c0ff5

    SHA256

    5a4ba4f7f12fecd8e1ccc7e6cabcb8199f45bdc88da90ca4fd29d738e689c072

    SHA512

    cb1018bdd399eae6bc29609451acbe5cbabc2850749d697dcf3ff33bed3ce3c0dccfb33123b67f96f15d2f21913a0dffa2c62c1bceb740694f5ca7a8fe79d674

  • /data/user/0/com.shangleqiu.shop/app_plugins_v3/a.b.c.d.e-10-10-146.jar
    Filesize

    250KB

    MD5

    183255719912a3fb83c31cc30cd610d2

    SHA1

    05c213ebd1694ee60dfe2cdc9fe0d210d04aca76

    SHA256

    0424f362e34042b9bfbde76877713ddba5f23f44f456917bd01b01f3de16c313

    SHA512

    8a0581cdce49e2855c4972c51efab116e81dace43a09e9da476998441e1452e0e9888b5f7f9cacdc191f51d8549b5e2e3b138cd52b240f79d532fd7171f3ecc0

  • /data/user/0/com.shangleqiu.shop/app_plugins_v3/a.b.c.d.e.cache-10-10-100.jar
    Filesize

    87KB

    MD5

    8d4950b71650c8e83c4a7561b6d2863e

    SHA1

    162acadec50187d6aaeeebc11ee79cff5a3e465a

    SHA256

    58a42255740c6082d04d43acaf65aa285791ba1a8ea5118455927fa68c27444e

    SHA512

    be61c8fd7ee1079f9d10d60c917dfb09c06eb5e8a96bc738de0b9d2a88e007fd4b1718f3b541386d65d462af575f2f46d173a200c76a1f47cbf9f58e4f2c351d

  • /data/user/0/com.shangleqiu.shop/app_plugins_v3/a.b.c.d.e.cache-10-10-100.jar
    Filesize

    87KB

    MD5

    f1519e6fc9e8827ebd3a77d1ba18e629

    SHA1

    9ec36f0d8bb650df3804599b8598ace6d5da7d14

    SHA256

    cdc20eb19a67c060d60a9de1a594ad3c3874ed61009ed754f653517bc00a31ac

    SHA512

    1e7f3a35449fe6ea186dc09c14bbcb772970089fb131503b56be0ae3f6870157fd8ad284444fa9a3eaccf2b855868c50b4e151b39633a8809a914d92141be9f2

  • /storage/emulated/0/Android/data/com.shangleqiu.shop/cache/ormlite-db-date.db
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /storage/emulated/0/Android/data/com.shangleqiu.shop/cache/ormlite-db-date.db-journal
    Filesize

    512B

    MD5

    ee969e8785b59d25661e633d071361ff

    SHA1

    bef06ad3ef308d1e568f83963d6959e870b88309

    SHA256

    345601e915ad0ddd0a6501ff1e0a8d0167f16c8f009d25e86e01ebe48730dabf

    SHA512

    bea8ff15b086a925d2461852369d7ce5536d48c2193ffbc1c345786f77951e007edcb4324b87ccbcfbca6258cb1ead5d25d0a16e3371129ee82137a6e58cbdc4

  • /storage/emulated/0/Android/data/com.shangleqiu.shop/cache/ormlite-db-date.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /storage/emulated/0/Android/data/com.shangleqiu.shop/cache/ormlite-db-date.db-wal
    Filesize

    80KB

    MD5

    4b973275f70c65af4ace623420216c9f

    SHA1

    fde94a8a844512b82625e0bbc2a54a585a9f592a

    SHA256

    094864fd11dd3e4ca5df4d0a947a436d818140def52e2ffd8791cd0824d04f90

    SHA512

    430b49b3a474e72a3f631a24f4b49171c69aeac655e37d392ca62d0949b1498e0efae05a72dca5db868c5a19fa0b0f19392ce92a096e0aad4bb5f5513918c956

  • /storage/emulated/0/data/.push_deviceid
    Filesize

    32B

    MD5

    7d2d810bb4010d6c599aeebf79bfaabc

    SHA1

    7272ad454a94b309cd940904a1376701b23458ff

    SHA256

    b964fefa0e250e048c57f0ee05bbf4a5301016fdf346d6fee527e1843a8f0e3a

    SHA512

    f6a9d9a297cd34428094489cff5057c7f81beffc1363753688993169ff968953f07053006441f876c20ed8f024aac73a4435ca3e31ec2c20798c721775c0ebdb