4ae4b3415ae9ae46c936cb4fa5edd0fb7dfcbb02ea67c6cd09c90e56ace43eef

Analysis

max time kernel
8s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
13-06-2024 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4a357b326ea4f57576f6a95a6f7fcb0_JaffaCakes118.apk
Size

30.0MB
MD5

a4a357b326ea4f57576f6a95a6f7fcb0
SHA1

632699f195b89bbdcbcb36fae558ba8f4f91c7bf
SHA256

4ae4b3415ae9ae46c936cb4fa5edd0fb7dfcbb02ea67c6cd09c90e56ace43eef
SHA512

d874e5bd6b3a8f8ea7419a3b7c43d88c1a3c16f2270f2960c5d91380121d0f48110884ba5402c05bb761fd2d02233840a58e3f8c8fe9dbbb505dadd00a372e35
SSDEEP

786432:XceX1A9LhKGdb7eCNtn9reMaTFGf+ljdpSR9rglB3CIn:seXCZdbrn9yEfuKRdGNbn

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 4 IoCs
evasion

T1426

Processes:

com.meilishuo/system/bin/sh -c type su

ioc process

/system/app/Superuser.apk com.meilishuo
/system/bin/su com.meilishuo
/system/xbin/su com.meilishuo
/sbin/su /system/bin/sh -c type su

ioc	process
/system/app/Superuser.apk	com.meilishuo
/system/bin/su	com.meilishuo
/system/xbin/su	com.meilishuo
/sbin/su	/system/bin/sh -c type su

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.meilishuo/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.meilishuo/files/break_dex/break.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.meilishuo/files/break_dex/oat/x86/break.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.meilishuo/files/break_dex/break.dex	4317	com.meilishuo
/data/user/0/com.meilishuo/files/break_dex/break.dex	4346	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.meilishuo/files/break_dex/break.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.meilishuo/files/break_dex/oat/x86/break.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.meilishuo/files/break_dex/break.dex	4317	com.meilishuo

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.meilishuo

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.meilishuo
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.meilishuo

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.meilishuo
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.meilishuo

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.meilishuo
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.meilishuo

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.meilishuo
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.meilishuo

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.meilishuo
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.meilishuo

description ioc process

File opened for read /proc/meminfo com.meilishuo

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.meilishuo

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.meilishuo

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.meilishuo

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.meilishuo

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.meilishuo

description	ioc	process
File opened for read	/proc/meminfo	com.meilishuo

com.meilishuo
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4317

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.meilishuo/files/break_dex/break.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.meilishuo/files/break_dex/oat/x86/break.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4346

/system/bin/sh -c getprop
2⤵
PID:4384

getprop
2⤵
PID:4384

/system/bin/sh -c type su
2⤵
- Checks if the Android device is rooted.
PID:4418

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.meilishuo/app_crashrecord/1004
Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.meilishuo/app_crashrecord/1004
Filesize
228B

MD5
6e3457431b0cc0d956ad62c62df62f47

SHA1
dd65aaf66ff8b083a2437b32aec81a5f3bec6231

SHA256
18697e9f8a293eebad187e7c22cc73cd4610ef984a73419145a915981086b98f

SHA512
e9ec73faa184ac5a0025c47a8069f0edd95734bbb3ce3ef0303086d4ad1bdee53e7553adf5a5a683e93ad72c9bb2b922c596f2ccf8cb881fd9cd4fbb098185fb

Download Submit
/data/data/com.meilishuo/databases/bugly_db_
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.meilishuo/databases/bugly_db_-journal
Filesize
512B

MD5
3333164ea402dc82ff60c27e6bac185a

SHA1
112c3fbb4894bd7a2fed4aff96e749540fd3989a

SHA256
fe915f38683cd5fdbea010d3fda432425a4d2adb177c86141b251b3021fdd2cd

SHA512
52522123dba4cbbff57cde9f38d300cfe8dbd95136d95badbce16739cee1c56a9f4848a5649e3cd2cfb50b16deeaf9c196beb0b5769a8d18ababc14e619f59da

Download Submit
/data/data/com.meilishuo/databases/bugly_db_-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.meilishuo/databases/bugly_db_-wal
Filesize
80KB

MD5
978680f44bd374b3a191fcd66603253e

SHA1
74f37d7406fdf66dcf472f60cfbb8425886fae6c

SHA256
698adf46e2c12ad79d176f48c1501cd06585cdaff578fbe2f344a0e1d9020251

SHA512
f2d7c36a63f3042cfee70780637c5ab71dd361c2a9eae34838ebbf9036cdc85522c84e6dd6196bbfbba49af1ab439bf380f00eca917ac7a88b265d99fb479f71

Download Submit
/data/data/com.meilishuo/databases/mg_analytics-journal
Filesize
512B

MD5
26474ab7fe2ab1aae3fa3a89e2e38513

SHA1
9a072e12bfb01deb391443ab48b9b57e2d0b4085

SHA256
b11fa610cd0e6bfe1b72fe1d92f0504c2fc9cbb3a9bab32957dc342ad8027290

SHA512
dd39822ec2def51050883974a507188a4654a223cc60b54312d2209c5e489016746f6ca84e2d00e5a31ab29828edb8998d1a773e0ed3d9084ad90ae968cf8166

Download Submit
/data/data/com.meilishuo/databases/mg_analytics-shm
Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.meilishuo/databases/mg_analytics-wal
Filesize
32KB

MD5
2d57b2a57858cdfb31084b5974e41494

SHA1
1c8e8b6dc9ff5e0f8ef1c2bedd32403d40ae3759

SHA256
5ce84a2e1c42cb43ab20c1754eb8577e6ab572ff1f35799d753b107181071ca5

SHA512
2d47a7868d480a758ab9eece64b760c77272472783588dadaf0eb353a5eec08c64e85d1bfbe9a420d7033b94a0563f6cdfba1cabaf25cd1b6284d82ab78f1223

Download Submit
/data/data/com.meilishuo/files/break_dex/break.dex
Filesize
476B

MD5
155ca590d5bd04c31927f2a4e5391c43

SHA1
4eeb069a030d9d1c1982c757d89df2874eb9d427

SHA256
b8923495c36fba52b2de736f558c37b97c73f736fd48a6dfdb7d8ce6ac2ad1c4

SHA512
ecf86837599c28fdef876b2fb328e2cd14ebefa6a81fb4fa6b52df442f0979a9e559800389833f20e25f7d91d979d29f1f67ed733189af7889228c751d536360

Download Submit
/storage/emulated/0/Download/.mgj_enhanced_storage/old_611_did
Filesize
15B

MD5
748d9beeaa1899252a7365b780b95fb0

SHA1
2158cbe9044f2b138df0094615afe6616e526c9d

SHA256
59290d2d5a77605f8140feb82e44e8438115fb2f93dc56ed4c225b88c21baaa8

SHA512
cdeb0c4cebf1cc96ebda6940763a940df76120ee991bc7f003480caf055a970f16e4a19ef2ba2c56fa056d539b981e16542ec7239a7b91dd3828585bc2d1e440

Download Submit
/storage/emulated/0/Download/.mgj_enhanced_storage/sys_did
Filesize
32B

MD5
2c6c5b89331a8e07c365b9c85bb8b068

SHA1
58d1cceb2ff615feb95be0501045417b17de8d41

SHA256
16e6a0f283abd53b0304e6622380617412d28ff20fe9929e6d92f39ce3b81648

SHA512
062227ed797d41820ba651cd3711e4ae12c641e4419ec40910662a6afd813c05c9394fde5155c3e7cf118a171fa80f21e3106b0363fcadff01c3b0643f86dc98

Download Submit
/storage/emulated/0/Download/.mls_enhanced_storage/mls_did2
Filesize
36B

MD5
98f1daa54b05ea14dc525b27c05262cb

SHA1
9f306dfcbe40ecbac54cba457c1620dfe5b33e84

SHA256
7138b955d650eb54f7f746957a3162c9423e6b32213a97bef0ac15208f73babb

SHA512
e123f862696e9572a2644eebf75fb938345450e468962565443ca89af3f30382850cd5bce4ff0299f238af7791f09c224bb5c7ebb6e89f67bb27cc5b2cad1406

Download Submit