Analysis

  • max time kernel
    177s
  • max time network
    137s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    13-06-2024 09:22

General

  • Target

    a4d33d0dfb3592b46b83bbe3e01ace97_JaffaCakes118.apk

  • Size

    27.6MB

  • MD5

    a4d33d0dfb3592b46b83bbe3e01ace97

  • SHA1

    5527fca6770ff41a5a50e0f057821942e39cfddc

  • SHA256

    d25f8085f2fe28b84ebc39be7e4afa6d166326d3e10e87c68c6bf0405196ca81

  • SHA512

    4a31b2216ba46873b1ee4838c315f68c53c7cd4edb72084030645e78eb5fffbc3dfceefa1a2ec4bcde5bf82bc87fe60fa2bc17d972300efde8df0eeb13536059

  • SSDEEP

    786432:v9DcedEoCLwHsN4FDsNfAaBd0uqJjE+S3VluTbJJDha:vWedEoHHM4FDkAed0uR+S3VkvJJFa

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.ZGZ.LJDM
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4176
    • cat /sys/class/net/wlan0/address
      2⤵
        PID:4263

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.ZGZ.LJDM/databases/ThrowalbeLog.db
      Filesize

      4KB

      MD5

      f2b4b0190b9f384ca885f0c8c9b14700

      SHA1

      934ff2646757b5b6e7f20f6a0aa76c7f995d9361

      SHA256

      0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

      SHA512

      ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    • /data/data/com.ZGZ.LJDM/databases/ThrowalbeLog.db-journal
      Filesize

      512B

      MD5

      828f186287247bca94afc6850451c862

      SHA1

      5a5a03cae32e5a7aefb79ede65538372311b1e4b

      SHA256

      871b3e96cbcb41bdc492c5a0ce8f146e8b7deb4f2ae9d7ee615f70e6791d6c7a

      SHA512

      eba4990a8605c846cc3e3bc2489a46709fec967cc82fde28f328f867e7a243732136532c2792ac0b1e01ef48c7d07f85c4f1da8102dd4ae1e0d8965b1e78a4f5

    • /data/data/com.ZGZ.LJDM/databases/ThrowalbeLog.db-shm
      Filesize

      32KB

      MD5

      bb7df04e1b0a2570657527a7e108ae23

      SHA1

      5188431849b4613152fd7bdba6a3ff0a4fd6424b

      SHA256

      c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

      SHA512

      768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    • /data/data/com.ZGZ.LJDM/databases/ThrowalbeLog.db-wal
      Filesize

      32KB

      MD5

      a22d19e747e5a5ce5e3b498ec3b56106

      SHA1

      2b3ec85379821e5c1b936499a3f551498f1eaae6

      SHA256

      eb5af2d2fda6580b05b4bcdc781bac5db34f03fb1c6fae8885f22dd6b8be2035

      SHA512

      4ac2a5c0e699e8e9cadaa2d207fdeb552b281fce87827b7d402757a6fb29f012dfc332d48df121d5b2cad19286b94c7a5403bde8c50ebe1fa08ce6ee4e8f6d8b

    • /data/data/com.ZGZ.LJDM/files/Mob/share_sdk_1
      Filesize

      23B

      MD5

      8e24e79baab91c4d0604eaa9006a0cb3

      SHA1

      e427afc94a4b957a7096f73e395a10ea404c076b

      SHA256

      65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d

      SHA512

      45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae

    • /storage/emulated/0/Android/data/.mn_410185822
      Filesize

      130B

      MD5

      f321656a466363e5192773d92000e401

      SHA1

      3a6abe9be1a6f4deffaa98fd27f3449c888d3c4a

      SHA256

      53efd5207de6ed80429ec3c7865eed2b64023a0ed66e0fd29e7f45b708a1751c

      SHA512

      fcf6884bf5ce8d10b3a3dd461fad96cb6cf0bc4129e01788de112551230fbc4d8ea6961b04411d1c7816e248437c4560277069d9c544e5450612abc0e2c0171d

    • /storage/emulated/0/Android/data/.mn_410185822
      Filesize

      146B

      MD5

      86a4f4b192908e82bd1ce962772f7026

      SHA1

      cb00bb33e67bdf93450ea7b2875cf1d27c501be9

      SHA256

      ce7dd571eb75f2950737c99a2e5afa4b014e55628ab13fe44ae9815c20bc35d2

      SHA512

      11f2d0521590f986fab52112bf9299e3c995a04c210e72f97cee6875f9b05760d1fffdf617b5d89bbe99e09a646f3e508225b2530522fe6d9cd4b2abb2f297f5

    • /storage/emulated/0/Android/data/.mn_410185822
      Filesize

      194B

      MD5

      ca90fb304c512195eab2b4f0acc1d551

      SHA1

      e2906b054624bfd49821fbd458b8955d4b137518

      SHA256

      af465d60b900c276d2ac62c8a640831b5ff70fe268e064fba09ac854f66f407a

      SHA512

      f8f5d260440ec7b0ee4be83f404b94598a7a707d555a5a03a9740581fad3dc4944b41b8735248c90bcbc4de894dba249ead0315733dd689f20c3c9d19ae862d5

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/cache/UnityAdsCache/UnityAdsCache-4f818bb66d2fd978c892419f17c9c0c38a836a124695a7bd4bd92f4d416af799.png
      Filesize

      37KB

      MD5

      7b4413a8b4d6681b399d70c76ff214c9

      SHA1

      c5c5208e060ed19bf83fa01f9fb00e3366ac91d9

      SHA256

      bf5d0631e1aa5ca3a98756b9975a6c19711179622d7065e6744257b7da797f2a

      SHA512

      f501e593393735a6f3a92526c2d720b8472a4ea93c1c453a0006379b7f2dbd79bc94ff46932b6551f4bf226dcafa0f26c6cd3c00851694c67885faef634ca19f

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/cache/UnityAdsCache/UnityAdsCache-5719a001e3258b1a6b0750417b76b62a7027e74cca1d4c787ae6cb60c602a0d6.gif
      Filesize

      4.7MB

      MD5

      f35994e5d85dfe75505980763abe085c

      SHA1

      9cfac4eb2bb38592a7f53477f458701f6e15187c

      SHA256

      216b35596c4ba2408b6b80204b3f117a483d781a9d7932a9aabdaaa490978d95

      SHA512

      faf8e14c3f022ae4b090f3b57a1326deabebb5cd9d25dfe56fc2af37c49443c116e4dfade7255e162c1ffe83ea2f6d9d50e0c6f5366a9080feb2d6d7b7f73a64

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/cache/UnityAdsCache/UnityAdsCache-adb8bc1739c4cbaef818604f935e6e7b937a3f3e6442eaab68c768af5046f14f.webm
      Filesize

      1.9MB

      MD5

      788db55ed6640ecb4a181c06a9c0184e

      SHA1

      2bb25019024b76e65ab84e27f1bce45b37c381d2

      SHA256

      2aad3dc0d7b195194dbc29a7a32f13463024589da688c27fb0712c7c430b243c

      SHA512

      407544b0f49dbd9ff46df9b56b21bbe90b7c7a4db00b8d7f65b7a6ee30db6cdcafd17d197e5b9928cc994114295436e9bd1a92f593f7c0be6ae4f101012b1ded

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/cache/UnityAdsCache/UnityAdsStorage-private-data.json
      Filesize

      41B

      MD5

      16d3e6eac0e79222a9b368edac765b34

      SHA1

      48d5e621fcdd84108f5750d6905180b622715b11

      SHA256

      3a518b70256a689906d6740062462e3124aad6e55c5aa47339a87a56e4933ee7

      SHA512

      d0aaacf86100135241426e2a0e9ba44414aa456cd708124e2f9c3a8037e008870cbcb506d316e4fe7cfe1d6dc3073393989a6f3c29f7cfabd6b0f65057afe747

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/cache/UnityAdsCache/UnityAdsStorage-private-data.json
      Filesize

      507B

      MD5

      7f6ceba0beb3b2f3e8837a0eae0cbe74

      SHA1

      c34a72a96df12daba5246516feeb28702c3f0cee

      SHA256

      575fa37ab53f9c4fe84ee9eeac441b4427b921c0b4f4a9bd75ea1e158e2ba969

      SHA512

      1a0e2f0561e844bb229c3035e032ba78bfa7c5399048bdac4b7ec24e244478db5c384f7775da05b2debdb608a804801d8d61c61758c37a23096a58c9d59b69a8

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/cache/UnityAdsCache/UnityAdsStorage-private-data.json
      Filesize

      1KB

      MD5

      033d13184f9cc0b3c6b918b4901b9da0

      SHA1

      e41c8e0781001a3e386bde17c505ce0e7b1269b2

      SHA256

      a559cffa17ced0923cca4382fcd909df5e6371161baa2c072dbf43c6f4947cef

      SHA512

      7ab057f7c41dc794df4fa436695ab5e9b7101c1c09803e511d842efb0f2be6504255fad85b9f2b32caba5433156c9ac7707943413c458473850ad747612a748d

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/cache/UnityAdsCache/UnityAdsStorage-public-data.json
      Filesize

      2B

      MD5

      99914b932bd37a50b983c5e7c90ae93b

      SHA1

      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

      SHA256

      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

      SHA512

      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/cache/UnityAdsCache/UnityAdsStorage-public-data.json
      Filesize

      108B

      MD5

      6a742982993a4c7aafbe6dde4fbc6e74

      SHA1

      03886bbb6cacbd36fad5a6b67e41aedc744c58e3

      SHA256

      6dc0f8206e8689a95db9eb194babed18110f507d23ef45e4469a7a646744d13c

      SHA512

      d3ad962e709caf663826e99a333dfb04259ffc122e93949bc0b82d5c0c72b77ad43f0975abfaa9624f7ea074fbab70d3d5241eb1e1072de6781b78ef86357811

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/cache/UnityAdsCache/UnityAdsStorage-public-data.json
      Filesize

      212B

      MD5

      21d7a6598aca5854c3ee11394a9bb078

      SHA1

      218dd5e8fe0d4f7fc434cc23661a2df4186d22c6

      SHA256

      792612eecde57108a0d2a375674614b2736d9388f61987b179832f256a5d9bab

      SHA512

      a8aaa5d41668cc94f4cbd1a3de87430d15811f5e2b71c307dec0bb7023713be60eda7a275c5f8d5167b6f8f80fe05a7671c674f18f1bf042543c6aa4749da942

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/cache/UnityAdsCache/UnityAdsTest.txt
      Filesize

      4B

      MD5

      098f6bcd4621d373cade4e832627b4f6

      SHA1

      a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

      SHA256

      9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

      SHA512

      ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/cache/UnityAdsCache/UnityAdsWebApp.html
      Filesize

      1.7MB

      MD5

      3076a84e1972a5a81586041672ed9bd8

      SHA1

      b0e11eb35e632499bd1bcd74e2ea1df896330bb7

      SHA256

      ce2385e2076153cea782da30e8d0696705145cac3365ad895e932d4936d367c4

      SHA512

      64067f2e2fd04c3decb7dc431b285b54b10ecf24d1e6cc6a3355d652af31bc00f45d4bc55f14be31beeb35d3c2dadbf79ae76243cd59eb19a725f073d261b116

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/files/Unity/888a558f-1c02-435a-aadc-6af9ff50c168/Analytics/ArchivedEvents/171827057500000.050ad520/e
      Filesize

      63B

      MD5

      7af279833464c9d08cd2f6619b06bcc9

      SHA1

      18035bbebba1488f23882b173559c47a6ecbc808

      SHA256

      312f67a9111e35e04b3eb60419ca537eaf402d80abe66c706feecdffc842f636

      SHA512

      48d05214d8aa6812d7dd5956ab6555533c96f299d57bf2539ed8e4cc65c572b3461f9b535341f3f36e33dd21a50e170a25dadb036da6f302e863d69553237265

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/files/Unity/888a558f-1c02-435a-aadc-6af9ff50c168/Analytics/ArchivedEvents/171827057500000.050ad520/g
      Filesize

      1B

      MD5

      c81e728d9d4c2f636f067f89cc14862c

      SHA1

      da4b9237bacccdf19c0760cab7aec4a8359010b0

      SHA256

      d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

      SHA512

      40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/files/Unity/888a558f-1c02-435a-aadc-6af9ff50c168/Analytics/ArchivedEvents/171827057500000.050ad520/s
      Filesize

      334B

      MD5

      68e90cf0db8a1ee1b3d1b80a220b1d76

      SHA1

      3f4b47a197add6d138dfc5a87e4a029aad7b577c

      SHA256

      a0f9819e3fa064717d06cd7cae89311577a953d5a04e9582abaa41223b184241

      SHA512

      8fb0e1184e0620b77c7ab4b1f3ded46a2f80a641502d9c408e7f74769a989a2a54fe6505e82d51d580fa0e7f4d147d6df4b1a13b92aa1d001a443ebb7796b32f

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/files/Unity/888a558f-1c02-435a-aadc-6af9ff50c168/Analytics/ArchivedEvents/171827057500001.050ad520/e
      Filesize

      103B

      MD5

      5937dacb777d6a00a2cbc06cc0c95921

      SHA1

      bd51789b7ea1326e529dca27cdf14cac0ac0ab9c

      SHA256

      13d74bf7dc63947d2031c8a2542d4550e9fa66975463b37a00a2d56c49f636c1

      SHA512

      d0973b0b36934dc01fae3693e9e2a611df3b65826efd8584f8dc792f6048dc8b0dc54d4e94334d42af398c7f819624daad74a861bc904d6bc8fb6e9b7334bc42

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/files/Unity/888a558f-1c02-435a-aadc-6af9ff50c168/Analytics/ArchivedEvents/171827057500002.050ad520/e
      Filesize

      990B

      MD5

      9805d3ce9bfecfe854a7f7a00290dafd

      SHA1

      4ac4206f5cdeb541cecb21d5fefe5c9182766177

      SHA256

      4ceb9ff95715e35310a786b65040abcab2e8b69a2dbf0ce371a43625b5b792a1

      SHA512

      69c7d2cb009736c2ee4ec1d2ff0877087430d274967ff282716c34030d027d330ed02a0baf1409377037b6696d1526a051b2031aff8e22004aeb2942fdf8fdef

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/files/Unity/888a558f-1c02-435a-aadc-6af9ff50c168/Analytics/ArchivedEvents/171827057500002.050ad520/e
      Filesize

      1KB

      MD5

      d44d1b3a82a2b7dbb6776cfc63afc669

      SHA1

      2fe843a6ef6ed1f9a9c7db27f5a5957f384ac536

      SHA256

      a44e3b5cd760dfc751dbbee19f411f57fcdfb39c55bdca9c7a16b66a44f296bc

      SHA512

      36c0b3f0651c466125d10e8fa810f80468d086419312a5c73f291a150886af6bda4c551151171d5a60d46e9b2e011cf5e0c7f8402f16c053cb0fc99e13fad3c2

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/files/Unity/888a558f-1c02-435a-aadc-6af9ff50c168/Analytics/ArchivedEvents/171827057500002.050ad520/e
      Filesize

      1KB

      MD5

      0ef184d7a264d8be040e110b42e419fc

      SHA1

      0a18c05a7855ef9ee25a57715374431494d313c4

      SHA256

      f2a79468ca3ed8f0090435ae0956e6a6cbd7574740ed2be19ee27fb15ef4dd75

      SHA512

      519d3d0dcd6ef754d43f8e75f1cf87c71107dc4bedb3129c6512d95369861629c44277e8e99c29de3562e5db5ce4df9f90a175b3193d20d70fbd90b564be7e34

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/files/Unity/888a558f-1c02-435a-aadc-6af9ff50c168/Analytics/config
      Filesize

      293B

      MD5

      8673a8ac0b06a9d056d08d62f857ba4b

      SHA1

      a351bea1932270bafbe468584058fef20dcfc31e

      SHA256

      83b3f90c4edf1f122c8faf9784ca0aee4dd017c65493ac181c1814211703db96

      SHA512

      edf28eb7fcef654f139285d308f817ee230d6f064a4c865109d6dfe6f73c11f8f35737c8159c8a302118237ab980899ba5773f547cc9da4028643a53b08e324f

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/files/Unity/888a558f-1c02-435a-aadc-6af9ff50c168/Analytics/values
      Filesize

      150B

      MD5

      d8fc1b9a301f869aca4f22cccd9ed634

      SHA1

      728f5f638df4b52b0078203353090280aebff074

      SHA256

      ec856ed8b74781fc23222648ec6d4b319feeeab324ae5757383ed0bd8941722c

      SHA512

      ff824166760a50a4dae40e42b7fca347ba35a8e405087389c5c1936030269bb60336e577313484e4c41e5c944c13bfd94a648cc4e66c54bbdc87e5c32a192f98

    • /storage/emulated/0/Android/data/com.ZGZ.LJDM/files/share_photo.png
      Filesize

      311KB

      MD5

      9d40302c8e609177702b1a73a7170c15

      SHA1

      06ed6d18a62421c2a3a9396409987aac938fa505

      SHA256

      665e84a74cee1425b324bb27973e12d2fd78d77543f95a6d75df9e3eb70f880c

      SHA512

      e12418a5223fb7b5e19008bc6763880ea1901c5e716b26c00eaf79f42aaea361b718f456b8290a0ff7a3dbb4e45cdb8572868712deaa110158137b8c22967b3f

    • /storage/emulated/0/Mob/.mcw
      Filesize

      80B

      MD5

      853ba6ebddabc41a5059bbef30c8497d

      SHA1

      c5a6573cabecc62fdb3c0fd133c35f0d9d23ea2e

      SHA256

      d397b9d5628850b59e6b1d036dc14b867a9fda949e15fe0b5eadee4d9108f66c

      SHA512

      f6c8526b4cc4eae05136ba77fc4483b99c9ab2d03220efb6de92df5de569414da7e33d0dd5df7e2dd19e9e7ef5e4a657abc818345445a3ebe2f7c1faf4945c9d

    • /storage/emulated/0/Mob/comm/.di
      Filesize

      57B

      MD5

      70a42cba408700f9a6c01c7941a8829e

      SHA1

      eab01cc2c0671538795fb0b1146017dc099d0984

      SHA256

      499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

      SHA512

      8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

    • /storage/emulated/0/Mob/comm/dbs/.duid
      Filesize

      132B

      MD5

      735e94c74dfceca0985456e98b79cd5d

      SHA1

      16d0bb664027cea445a23b8cd5e8779dbd99bbe4

      SHA256

      f92cbd95d1aef373a38247c12c95897e2b7eecc1a21988259dadc105f78f52d2

      SHA512

      3e327f51f3d915f0d375220e1682639d09a6c14551dfb02c0defae7b469d8ff9222b5a9a735dd3ab0cac0f140671b2626461fd1335d15e7167f610bb2322d73d