b2686dc9279e5309c40650883eea736ffee276d3bbdee2b4a0684e03c9dbe962

General

Target
a6018ff9527e22cd2effbc12aaa51601_JaffaCakes118.apk
Size 30.6MB
Sample240613-rq4bqsseqd
SHA256 b2686dc9279e5309c40650883eea736ffee276d3bbdee2b4a0684e03c9dbe962
MD5 a6018ff9527e22cd2effbc12aaa51601
SHA1 373822e640b9db96f95b68e63d2e0e1b5584fe3e
SHA512 1d7e7389746790957e897d8f912bf50e09b6ea4b2840d846012dbf644b9f93c9a5b9fad6a25b0bd13234bbfae77eab3a314b79fd733e36e6d2548ce038de2f12
SSDEEP 786432:IJrXor1cnP2FPQV8gwhB0TssLRsV5gnh6z0GhH767dH:uk22hQO7ULOVanhnaHW9
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.fg_shaoke

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.fg_shaoke/mix.dex	5123	com.fg_shaoke
/data/data/com.fg_shaoke/mix.dex	5123	com.fg_shaoke

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.fg_shaoke

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.fg_shaoke

com.fg_shaoke
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5123

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bugly_db_legu

Path /data/data/com.fg_shaoke/databases/bugly_db_legu
Size 60KB
SHA256 19c263ad0aa3e7f030e63283970bb40373cdcc0feeae9f8133a6b28506cb16dd
MD5 941ad2aa929a7b9124ac98e59c8eba16
SHA1 d356aa76be9d9aa32ddb2b9a20ecc66c809247c2
SHA512 0d7dd7c509f495f5ce01d8834d1686e769eb0e1428cdf803b5112ffbb42b15a5112d056271fa8ee34224cdb38678b9a92c803bebb97c998186a1c274a21a4e4c
SSDEEP 24:TLmt+qqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGS6huxESEH8vURgKqSfdbKgk:TzfrQiw6uMg6/YBg72meposSpEEUhBK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.fg_shaoke/databases/bugly_db_legu-journal
Size 12KB
SHA256 4f54f0090a754ff56de5180ed05392c6d03f6125d438e2b4d3139c9b3a80c092
MD5 f3b74de351aa1e7f0d117a189ceea696
SHA1 64c3f072d7129dc0b694158c7211d6ab3a02736e
SHA512 de8538e1aad0d226d12108d7f036a0e7ed4e8e3a9fca2401f07c30b3978f67e6f3dbad39c912649f41d2de88cd1ec878abc8b63eb965b58d6e81a0b48b540015
SSDEEP 24:7+t1rfqL1tGqqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSV:7MRfqjfrQiw6uMg6/YBg72meposSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.fg_shaoke/databases/bugly_db_legu-journal
Size 512B
SHA256 af3240f2255b308e1d15980c2671ba121237b7534b03def19edec63f6ba77a29
MD5 a6def0b71e61aff67de285c77619e581
SHA1 945dd263ace5de2ba62210921e5f07a639d4a8a2
SHA512 d0029db69c148a001ca50ff2d79da4ea5a8450ac6df171e4aa5aa080c8070fbd4118f39e365db0ea9e708308cbee230f59734fd50cc766984d26e634153ebd35
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/data/com.fg_shaoke/databases/bugly_db_legu-journal
Size 8KB
SHA256 59b673fc99e3ab10f42b3ba7ff479b396d2f1025a0d9c0a141155edf371185dc
MD5 835b3005119b9b1b885369398a1887c3
SHA1 9b8cbe356afd55f2523a1d5bdc1ff969a3057d39
SHA512 685af53eca5db198b65289c06d60b5ee528a15db4a8ee72578850b4dff3e7bfd38e2fb55f234828026ddcf635bec2d37682fa1c68012e3a945aa7c1d5bf04d87
SSDEEP 6:7+/l9qn1lg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKm:7+tMqLiuWdwRmBEyPbp
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.fg_shaoke/databases/bugly_db_legu-journal
Size 8KB
SHA256 cfd522809c22d5af6266ff8d4f340498b508e51bb0de905ddfb985f2a4ea2877
MD5 77dee6b93b561f97d2a16d107ee79f32
SHA1 b433c467f7238dfcbaadad9978b80d08e8a984ac
SHA512 ebdf3a5be9bdf1c7f6aef42e88a3f7149ebe374f2b5b3a27f678af04dae31e58e10764972164f799c5bcbc729262b4744b18382437e7a865de66282b13de6d4c
SSDEEP 6:7+/l9MOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKpa/E:7+teiqLJdTRmBEyPb2qE
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.fg_shaoke/databases/bugly_db_legu-journal
Size 8KB
SHA256 e3ee2f770463bd90d2d1d6e720775a6a01b4f0070453696a232de614e8cfcb13
MD5 d2d6ef7f4b29e525d664ce1a0f4402fb
SHA1 bfc689005a95cb136527cf9f368ffa6000af6e81
SHA512 f88aac53fd70946419a0d7a57fa519bf78968019379069ced1f907f3e877c595c564b592a946c5f8f85d3e33ebca87aae901954c10318204171a9ce7d72727c1
SSDEEP 24:7+tRqLTt/qqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSJ:7MRqDfrQiw6uMg6/YBg72meposSJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.fg_shaoke/databases/bugly_db_legu-journal
Size 12KB
SHA256 9defabe820db46bb9f0ec4457fbd4c9cd93eaaae4f3835ebb986df0da0a07a0d
MD5 6a15bd217eff0cb080bc443f1a79b5aa
SHA1 19631780dbe2b003758db48181f52bb2f8134493
SHA512 fc222b644c18943447724edb6b4b5895d422b8f3b3f18bac162c56fbe4efaf40edb7f4f93abcf5475b4df960eadf3895f202b35e97d68fa831598de6881256f7
SSDEEP 24:7+tpqLMvtslqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSL:7Mpq3DfrQiw6uMg6/YBg72meposSL
MD5 SHA1 SHA512 SSDEEP

Submit Download

mix.dex

Path /data/data/com.fg_shaoke/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads