cb6be086fa5346c5d6ba3c252c5dd25bd46598ac712d7a85f67fc38d1b58a828

Analysis

max time kernel
8s
max time network
178s
platform
android_x64
resource
android-33-x64-arm64-20240611.1-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240611.1-enlocale:en-usos:android-13-x64system
submitted
13/06/2024, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a51a8e0628b04f7d7ba07586aa9566db_JaffaCakes118.apk
Size 6.1MB
Sample240613-mmvszavepf
SHA256 cb6be086fa5346c5d6ba3c252c5dd25bd46598ac712d7a85f67fc38d1b58a828
MD5 a51a8e0628b04f7d7ba07586aa9566db
SHA1 57174cffe361aa69eaa9895c1b1810e8690a16a9
SHA512 0094c8d2ecc7517760c64ca241699df63d28472ad6309f2527d0de9c0e8b33d33b97cbdda932d620bb96983172f05f5ad1c04c26524ed1b791085c6c31a1ea3f
SSDEEP 98304:pKxOv5CPjg/v5X8DPsR1hE1xC92IvxoYwDQEojAh2BSjk3PW3Wn83:xCSB+w1hE1xMxNw8EI2gO3ic
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.rhinocerosstory

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rhinocerosstory

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.rhinocerosstory

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.rhinocerosstory

com.rhinocerosstory
1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4264

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

rqd_record.eup

Path /data/user/0/com.rhinocerosstory/app_bugly/rqd_record.eup
Size 344B
SHA256 e9bac4ec0bbb0e280470e2462b495437a09b046e7a579083b34c522f4a53cffe
MD5 9497ebb9c09c32bc8e382a94501e4cef
SHA1 a053a034d2ff1c11990fa615c995119f4e23b879
SHA512 3fe840916eff4a37a108445b3af83d2753dd4bce192fc9ff7cc4e1747f21f126587d7abee43f1007e869ad57504c638be82494ea3414dca1f7da7e46ff88f490
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.rhinocerosstory/app_bugly/rqd_record.eup
Size 550B
SHA256 808369a453fc6a8b8e14e0b4d9167f38d5bb197d6f19c3d9bc8839a83062eccb
MD5 7d1d8ebd3d47936e9d3ec27f95843dbd
SHA1 81162e370d619b7add57cda9e359a1e1aebf7530
SHA512 c4202f43e1b24f81d85284a507209e8d82bc191b3bb8971786529a9fcae4ae5723cd3e229d41ce20128a5923bd2ee91f2d4822d96ccfc5ed7cdb19a337c68391
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.rhinocerosstory/app_bugly/rqd_record.eup
Size 1KB
SHA256 198573abbca62b2e8e910fd7a64e9ebe703102eb02a0ab9377f963810fbddf6f
MD5 5b63e3071124c95a2e3c219afe5e0429
SHA1 765dbf7c4ddaf239aec91fee825a10de77a7c903
SHA512 fdcfb80a2ec3ad57f491ef6877b1a186702f560e5afc4d174e32193d30b8f2b95871160a15fdd1cd71e7555ebb88bd4481baef28781aabd36bd678bd91285570
MD5 SHA1 SHA512

Submit Download

tomb_1718274939702.txt

Path /data/user/0/com.rhinocerosstory/app_bugly/tomb_1718274939702.txt
Size 56B
SHA256 7fe875398dea7537a57a77c5275cbc8647aaf63ab6fd9148443b65df2e1d0647
MD5 bd0f8f8f3ad93fa07623422ec6e72003
SHA1 c3589295e7a4ddcf35bcd7a2c13bfd381783821a
SHA512 2ec3e073321262b667afbf98fe4e9f51e4c0c58baaad506b120239031f10699d699b94470bef13007bd6199df3d3b03f1eaf147c0cba5178aee7e267072b1c0b
MD5 SHA1 SHA512

Submit Download

bugly_db_lejiagu

Path /data/user/0/com.rhinocerosstory/databases/bugly_db_lejiagu
Size 40KB
SHA256 03c72b24f9d94aef08b937337554904b159d8aea98d300b5bd12304d67c5d061
MD5 88d43f0d46cc497e095bafaf01c25881
SHA1 9810a58976c8c01f095e02c9211b14cf7648fe7e
SHA512 4b8395ef4b60810af5f58208fb1c3d4526bb208413eeceb4b03841875da9a9b2e326cddcef677b759f5168417e7e749d0ba464082174d69bfe94c1471d2f3388
SSDEEP 24:TL8Nu2Pn8BBtuvp8lBz3k9bKlGSvPQd8dqHiKVKPTKbnQQ:ToN9v8BvypqzUNtSwdzGTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_lejiagu-journal

Path /data/user/0/com.rhinocerosstory/databases/bugly_db_lejiagu-journal
Size 512B
SHA256 b19614cd65c0ee99b78f44c87febdad055e910880cd38fdd64ca29c7c5791022
MD5 e460609aaa2152c26926e1fa47cc76ff
SHA1 0961eb22e0de763e0a8e546237f53ad3deced545
SHA512 14b57c7375fa1f56d1ccd36b77aab4da0a23f9958c4863e779f55da31809bda61e56c031197e199068541f993312a7fcdfe0ae36c2d15d6e66057a99e613b35e
MD5 SHA1 SHA512

Submit Download

bugly_db_lejiagu-journal

Path /data/user/0/com.rhinocerosstory/databases/bugly_db_lejiagu-journal
Size 8KB
SHA256 b5741e42b3fec789974d3541803b9ef61eb12a90672f4c3314be3a64f66fc8fb
MD5 8bce06b4feab4442d64fd858c77ac63b
SHA1 87276bbd3c614dbfd602096af70dbf9b0dd4baa0
SHA512 2dc2002dce3375fcf5a64b774be5b23b32ffeadd3aa579d37c8f021e55060e9d541b8f11f41f4e85e09cdc3f2c4a25b972cc2966199acb7284d4b780d49cbf85
SSDEEP 6:7+/l9RGVGn1YVpg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKz:7+tuPqLiuWd7RmBEyPbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_lejiagu-journal

Path /data/user/0/com.rhinocerosstory/databases/bugly_db_lejiagu-journal
Size 8KB
SHA256 f81bbcd63d2862a555d96382efacd3309cfa9ad9bcf7b313268c24ce556b5db2
MD5 0d942a5de1abbf4008bc9bfa70837e88
SHA1 8d363ea01cbb22274fb920c6134e225b01cc68c5
SHA512 bec8305487a57c954d28a21cdaea418b89ebdd6cca23bca067ebc40a8768120057f6ab06f999b470643414cecc31c0456a706a23b923e0bdfa7d53d4eec95aee
SSDEEP 6:7+/l9jKPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK4DdU//:7+tB+qLJdKBRmBEyPbv0/
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_lejiagu-journal

Path /data/user/0/com.rhinocerosstory/databases/bugly_db_lejiagu-journal
Size 8KB
SHA256 bdc7870695c6fe800ca3a6416690fb1670a781375446ceb8aef9a8f71e659830
MD5 496320a1461753d26011787840993363
SHA1 4eba7d355dead3fddbcc78a77e8cc1d7ef13b1cc
SHA512 b9b1deff4be2bb8c297defc07f8589df1dad82d2589c9863f4b3aaee56a955817dd856984513b56a9c4ed6d8e45c1473a10b72b1cf99692e934c4732c6428b44
SSDEEP 24:7+tzdkWqL5Cu2Pn8BBtuvp8lBz3k9bKlGSa:7MzdkWq9C9v8BvypqzUNtSa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads