22534caa7e5aeb5859cb614f9f26eab6acd3a5b750e7d7c598a2e3e91cfdf7f5

Analysis

max time kernel
9s
max time network
140s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
13/06/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a610a90f0f044b87492a8ba9281a21ba_JaffaCakes118.apk
Size

12.9MB
MD5

a610a90f0f044b87492a8ba9281a21ba
SHA1

63215896bc2147d2eef379ce483a70d383b97d19
SHA256

22534caa7e5aeb5859cb614f9f26eab6acd3a5b750e7d7c598a2e3e91cfdf7f5
SHA512

e3f093a5c98bbbbce9600bec9db8fcb3b58c0dd4b5f43d75130b6834810c667763ef86334f9227297fe84cd35dcd3b1d6ad7c1c76feab8cb3b26f7e321d2b5af
SSDEEP

196608:qW0+MGPU6IxYZ53u33Ajuh8Zl0DAsMy7WRBSHD9/434QkFyUUzaRRTytWTvK6:8GJZ53uHAqh00D4y7WqHJw3zpzoFy0G6

Score

8^/10

discovery evasion

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.lushi.zhuanbao

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.lushi.zhuanbao/.jiagu/classes.dex	4463	com.lushi.zhuanbao
/data/user/0/com.lushi.zhuanbao/.jiagu/classes.dex!classes2.dex	4463	com.lushi.zhuanbao
/data/user/0/com.lushi.zhuanbao/[email protected]	4463	com.lushi.zhuanbao

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lushi.zhuanbao

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.lushi.zhuanbao

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lushi.zhuanbao

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.lushi.zhuanbao

com.lushi.zhuanbao
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4463

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lushi.zhuanbao/files/.jglogs/.jg.ac

Filesize
32B

MD5
b9c64f04129ffc89111b5e5d879dc0d3

SHA1
7fd48d28f8720e82108283d95d14b277731825a1

SHA256
9261dcf52bcb9f2c8cbeebdb93f6f6d1ccecf1da6a5600d06afd3c78003ad89f

SHA512
1c3c28f3939fdfb3a06729c5d9d77f1c7a58b8850abbdbf89ac2eaedebcccbef5db1804ac07ad56224f9e060b2f2eb7e90bf7b450b89bd4bfa939646237ec9e4

Download Submit
/data/data/com.lushi.zhuanbao/files/.jglogs/.jg.ic

Filesize
32B

MD5
c45c23630cfcf468ad03b4e9877aa5f2

SHA1
cf30d569f48cdca48b50e4081915ea9fb9afe1a5

SHA256
db2142b77a6511c1f110f2e65c5b13e8456309d106e33b99ad7a7e3eb2f9fdc6

SHA512
a17cb02f69eb27f0ff3215380b398f8f16c8f3ea9fb787a5004ab6fcd0263fcf819f8e8fb19e8d529fcadc57b190f0191ff1c3ae4da5ed03316c29a5bc63dee2

Download Submit
/data/data/com.lushi.zhuanbao/files/.jglogs/.jg.pk

Filesize
32B

MD5
7185cffb69741d6fc9101133221a287c

SHA1
c1f4fbde37dd4ae43c7f8b50c5cc079f4bc51f0f

SHA256
a7dda74b143acfce1a566911a709d137d0118dfca53b03375cad84ed90d3631a

SHA512
eea9e239065ae3965f8e4c531f189934563ee06692fd2ac8c82dc348069be784961b33bb7432c75715814ed92e04202cbd8b7194497b9f7ed6d2ef35ca0c9ae2

Download Submit
/data/data/com.lushi.zhuanbao/files/.jglogs/.jg.pk.h

Filesize
64B

MD5
678d244849ea46b0e5e7ad988a147ef6

SHA1
38f14e5f8f54898430708498a61f83d137626e75

SHA256
8384b8c5a2aa1a042b8bc6dc8fa6da78260ecefda622c520bdcfc765142e6314

SHA512
11f8772a9f83d34789dcc45b27f021b57be73ad58daa92257a131979d9df7cd95303aff24292b6b8a469a50483d0973691228271a57b6c1d31b03fda162f68b5

Download Submit
/data/data/com.lushi.zhuanbao/files/.jglogs/.jg.rd

Filesize
32B

MD5
1d2ea4b5d937561a94a9a3a39976081a

SHA1
6e745905dd297b4ac6b2d423777e84cba406bfa9

SHA256
472d7e167a6f26d7223a7ff84053df9b1d083484ba1299223551bccb31ad7537

SHA512
109deed33298ff01e28dc7d44c04eca3dfbc94c1a7ed034920c60be4ab543f501485f65e9a963857b3480cb85191ca6714a8c94c5f7a619733f9e1e1e99fb224

Download Submit
/data/data/com.lushi.zhuanbao/files/.jglogs/.jg.ri

Filesize
307B

MD5
9ded96b8458c4212cf823ce2220ca259

SHA1
0b83f9620dbe26bb12b5ce6010f1a226af135754

SHA256
1dbd6f1331dd750dbac581a9f7e214f6291356a3f0d5ac14fccc2d6766e8b050

SHA512
b31b97901de9d208ea0592145f23eae44e12b74bed8f8ce200a8d8f1cc409b0253e7a855aa64d30bb8666c5446ef6c4202d2ab08b84a20444c4f8c23026addc9

Download Submit
/data/data/com.lushi.zhuanbao/files/.jglogs/.jg.ri

Filesize
314B

MD5
cca1cc9f7e64c9bcd170416ca00e0f42

SHA1
f4f1aa2bef1715c211026b3d10b7b5e68e9f9ed7

SHA256
63bca11bfed66858ffba770db5bb15f67f6570f0578a87f1c90332f8ca7ad372

SHA512
e2452db5d28b63a05e0c34f4623d72012670597b472624924c5491162e3ad4a6cb950e30bb6d4be8f60e389a87c5b5efe6e03020f5e3d79611418dc61c171ac1

Download Submit
/data/data/com.lushi.zhuanbao/files/.jglogs/.jg.store.report_pid

Filesize
32B

MD5
ef5deb235397f07548506e64c37f7677

SHA1
00b24a7cb177ba9db01d6636058c72477f0bd7b9

SHA256
af7b021d73886155de7f474f254874043c81cbe14983c6340dee71714ac23cba

SHA512
76ea307987f6e0c8c9a03bdea8a32c9b93f44f6a8de6891aa6ffb3e3a4590d6ded4ebffdc98c3fae2edca7e1ababd44d5dba5996a19d7e60125fd6c28f673be9

Download Submit
/data/data/com.lushi.zhuanbao/files/.jiagu.lock

Filesize
27B

MD5
759dbffaff5c238ad6406f4518026153

SHA1
de6693ddaefb9f4d8e1be3eee029c54b64aa92a9

SHA256
7e7c2994535356a62738f73e971b574ccdc9dc1d5a187fcbd726168ca8873ad5

SHA512
2ef94a7fd5a7fec5f0adbc056d37c7aa601a1dcb392927b73e5846532bbaa13daa1269e0bc803a77046f59abd2a44e7a909b6d9f8580da4edfb01edb19d951ce

Download Submit
/data/user/0/com.lushi.zhuanbao/.00000000000/37CF018B.dex

Filesize
48KB

MD5
75d46252620a12dd7343e91c8ba209bb

SHA1
6615b67e21963e5689685f8494f442dcd729d4d1

SHA256
c433c8e3f847da2b98ee8b704ea3b7d0f38d6249626dfe26a22bef0c08e5fa71

SHA512
9ae5f0ae0a77bc8c9a27a43252ba01d4bbb69a326eb028d2e887d701b202b66a7065765f2f0214d2b0701493634ff33c2104becdb80bf7e8c2657175857b7af8

Download Submit
/data/user/0/com.lushi.zhuanbao/.00000000000/37CF018B.dex

Filesize
48KB

MD5
4e93a7a07efedcc6e3c741526d2d89a7

SHA1
e25833d7a51783c17978a7c5e7953d7cf1df80f5

SHA256
26fd97dcb56a0ae4ffee7b9514cb697de101ad39e3b2af2933b1eadf409b740e

SHA512
94a5e0b50c0efc69b79fe9b46513537b798a45d00234a7fe1c529e7d5eb153704ec9966a0e0819983f726260579707d7b82e7b31f845fa7602e06c078b98319f

Download Submit
/data/user/0/com.lushi.zhuanbao/.jiagu/classes.dex

Filesize
5.9MB

MD5
4f32113d809dd75b14e5667c8f45e6d2

SHA1
ccd07779536ac42369fedd9867b6171acaacb706

SHA256
3b6fb7085882bf08371c6acd9390725f0b536a64a45225d26e6cc54d70ca1cc1

SHA512
18fcc76d8b8953b04c00668bfb9d8341076edf3acdc008b92080fbd9942887550d2294a9278606da89c656147f5b5b42d9bd84d058707cbd7acaf02173d41466

Download Submit
/data/user/0/com.lushi.zhuanbao/.jiagu/classes.dex!classes2.dex

Filesize
5.8MB

MD5
0141652b34bdac808871b61f484a565a

SHA1
5bbc8bf7134b6f68f6ce517884dba68922a420d7

SHA256
b417af1130ba5bb7e14fa4aa513e6bda377d9b8d236ee662be29047d2f1ae94d

SHA512
671a30df30b4349236606fc33427afe3fbcc8cd53b0bb895bc58328f93df3187f2befa9fe9ab2bb2af9d38a7f10e25ec354045e9ac06badbd484084db259b02b

Download Submit
/data/user/0/com.lushi.zhuanbao/.jiagu/libjiagu.so

Filesize
558KB

MD5
98736de515958ae37ae93a0a0e997098

SHA1
72d0f9d43f7c9bdc9f19d13834c0872f5652c0f9

SHA256
335091dfc73a9f792cb720389c5d94eb6642764a38d70d4b6b7a8afd34038421

SHA512
cc4974ce398bf7f4a20160ad30e4c4b5821ff0d7f2cc9fa0aead73ddc036585266edf429add276b53d6db8dd24a344d709469b9c839451deead6b621e70c92cf

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/bytedance_downloader.db

Filesize
20KB

MD5
40b7d099fc8c4320b1bb8dbc6e03151f

SHA1
bb556886aaa719ae155b8e499f530fe970e6e5c9

SHA256
02fec0e756afa49755e14043766cf3ff533addef9567b0243e06beeab805ec0e

SHA512
dd476b16caee9c451571a95c98fda38496c8a75a4f5e778b4900e122ce34a7b474831c6ca84d1b42e83af4e6cb0b693ef0fcc8fe5c3e4162f7effc6c85f6fe3a

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/bytedance_downloader.db-journal

Filesize
512B

MD5
eef756c5120e6a8d7f5c022137c6ce09

SHA1
3ee4a9513f5db0070559ead48fe64db8a281b18e

SHA256
ee69ec897667e609ff631e3cbc236cff18e24fa1618d8c52c82493f7a37eef9c

SHA512
4dc2750cc80cdeb227a585c139519364adf4e509762791fa15ab20ea42b72d6349c9aa77e4b2cd50931738d7090ea6c51082b3bad43f1bde4ea16a7eaa323c0b

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/bytedance_downloader.db-journal

Filesize
8KB

MD5
0ff90e0279cd9c4626968c6a119e0056

SHA1
44f6e3ade94b897de8cd78c2c7c588d8da560413

SHA256
1c65a7613dab903fec69a212351d68e5d51fcd6f6e2bf50c5d4c71cdd9bd6338

SHA512
54323be9abf4c348dbf746239b316e63b3b7bf126b414687659ad1e4579b51853bd42b9d6e4ee94e4c9ff6e818f1d429001416d96e5b03df64b8d1e9ec9fcf40

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/bytedance_downloader.db-journal

Filesize
8KB

MD5
e9671b4a17097bd01d88143dc00967a6

SHA1
164006f4dd6f6bbd81552be53c4dbfc08ad31c64

SHA256
fd83d84d46e312908785a33648dc3f0a7705f52c4801304adc7a31597e056d74

SHA512
ebc422a017a7769aa590b6ab2ed4376eaa268c26171b1a9dac17ba733e17cd3106dae5ba96d4463c6c45d4146226b0b475bfef27df17edbee63a33520af549b5

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/npth_log.db

Filesize
20KB

MD5
8dc03e147a44099e46adcc75eb340610

SHA1
4e087fa92230d55aba4de0ea71719afaa66ec108

SHA256
e7a10f4213b91e5144fc5e5d61ea6b81484ec79506ad7f7db35ca992a9634a7e

SHA512
d823aac6b0f8ecd90106e1b10b8fc5399798dfc09e63729b88b525a8a43ea301fdbc3977eed3a1fd21723c0e1f4c78585db9f9fb3402787eead6c724087d790f

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/npth_log.db-journal

Filesize
512B

MD5
b28afbc0c5c1b411c62fb95cbc979f56

SHA1
07c28a618d3b0ab1ceabaf84b0350a5580b8f5fa

SHA256
7e77de2cfeee67ba85fa7d7a630c2c3b531f28ea37201ad59338e61e318c7c89

SHA512
9d9581382c05e00b138128a5e0ffd875c0170cfb5d05408048738b2c3366e45b8723db830a05e92c6da8d481a46afe487ae8804a74a29c0779f1eb5b83d716b5

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/npth_log.db-journal

Filesize
8KB

MD5
943cc34989c91573e93b0cf4a1be62cc

SHA1
3bb3544e65746033a32082eb410d03c0e57d2a32

SHA256
4cc69c13f028074d19a5190d2379025c9163455c1d3054d2a9e8a34984dbe57b

SHA512
f2e3e79460b8efd1e79a0bbe469b6e9db2950a2615a5d21a8ba7246909be26914e8464f979e88d18911a578eea42b7bbd8e914d9c11974a5bb32446946eabcb1

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/npth_log.db-journal

Filesize
8KB

MD5
8aa13be3bcb09dd1f6c833cc0dfd63d5

SHA1
6bd683e2596378eb59e78a92a73d5758eec48a1b

SHA256
31d9868d2ab32fb2fd127c0519f4350bc2669fa02c446876162c65f790c9ed0d

SHA512
b1d746c31b0d92985cf881680ff4df5df26825b5e75d445de1f284a0e0d5d293e0fd35282d0b37b69a97b7c03c09f244d3401b95ca95fd4cf0e3369c9de8febb

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/ttopensdk.db

Filesize
12KB

MD5
171aedf968e17a2744d2585715606cb9

SHA1
bbeddeb3b89fcf809619c35b4a318a80e7d5b029

SHA256
d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e

SHA512
78a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/ttopensdk.db-journal

Filesize
512B

MD5
940dbfaf912a15b7c489a452d816a7e6

SHA1
25ca93f527dbf4a90fbd70330d303ad1d2a8c0d1

SHA256
22c813ae948fd206b6c4f1d5d1887e943a5fd607954e1da2e1fadbc3c0e88ad5

SHA512
eb8f879b53c076b3dffce7d23eb5a52f7df997d9dbf80e2ae17354ac266033b1ce82611a328ea6a213fea35c53f53b5c6f7730d561b51878913d1bdfb4d39281

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/ttopensdk.db-journal

Filesize
8KB

MD5
662cf49db594d4aff1f18c9e6ab72dbd

SHA1
eed8bc2d41dd1474451f73ae5ff9a86039a57503

SHA256
7b1ba1cedb3be14cf04c89b9b3215223737907e1406003fc9366063c62490ddc

SHA512
3bd8d0d561150eae172dd7337964709331bcf8a7ba42255f5825540b753aa37b95bc93fd20f82f932889a6e5066affa80a7ab5495c8e68b90b6a604a9e78d4a2

Download Submit
/data/user/0/com.lushi.zhuanbao/databases/ttopensdk.db-journal

Filesize
8KB

MD5
f2b991d2b7cec708d3fb0b4cd4574814

SHA1
f4b9bb5477f0f749346d5fe2a6d31acdc887e14c

SHA256
ee6dfa263b219b4370b8c57ccc6e331eb47c9bf22a082b402d4905f37f733979

SHA512
338089d53792a8951f9ef16977064e9242f9141f19bdfb0a89a4279277f3f195c4c77d76639522fc88103809b7a2f54451e0689dc62ea752f9af8bf99a0e047c

Download Submit
/storage/emulated/0/com.lushi.zhuanbao/config/5ac714da7be6d534dd74c84a097f98e0

Filesize
344B

MD5
4ac291fd990a7997c603129c524cdb10

SHA1
8445b41c0033079bb9227cadc3744d3b7f9a4d19

SHA256
bad46e50382b73c66bc73a63a90c66f198d7a387ebb890279eb8ed1960e5dbf5

SHA512
f41a4b242355e4108cd04f2d66b5b3f7ed94383c4a18b1a47e0ad4b7c3edaf4649721130ba3cbdb8252e5854d5914fcf297d56d1defe9bf71ea912695005f695

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads