a1d337f952170db754d2f214d5c6aec1b019b9a94acb5decfb00e968c1602a1e

Analysis

max time kernel
154s
max time network
177s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
13/06/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6283ddec94a1519f8920ce384012a82_JaffaCakes118.apk
Size 20.1MB
Sample240613-sd5jpsxgpn
SHA256 a1d337f952170db754d2f214d5c6aec1b019b9a94acb5decfb00e968c1602a1e
MD5 a6283ddec94a1519f8920ce384012a82
SHA1 c1e8837053e544493b41aece8e0c92f604940f27
SHA512 fd08f313dbecaed459b7d65d7832eea15b00f483142af65584f602e6829aee8e352d3ad526993c625095c374dca06aa3c3f99ebeeb5c6afc015d2035e5a9326e
SSDEEP 393216:BoXZ1Gg3GpMLtzyt4Av1o5jHYvDxgu0rOImqq5WvldD5WwUkpVWXJh0AQKZoe4Il:mp1G8G2tutP1ol9a92ldvW5rQe4I9duA
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.liuguan.wzzj.huawei
/system/bin/su	com.liuguan.wzzj.huawei
/system/xbin/su	com.liuguan.wzzj.huawei

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.liuguan.wzzj.huawei

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.liuguan.wzzj.huawei

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.liuguan.wzzj.huawei

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.liuguan.wzzj.huawei

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.liuguan.wzzj.huawei

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.liuguan.wzzj.huawei

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.liuguan.wzzj.huawei

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.liuguan.wzzj.huawei

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.liuguan.wzzj.huawei

com.liuguan.wzzj.huawei
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4273
- ls /sys/class/thermal
  2⤵
  PID:4415
- ls /
  2⤵
  PID:4449
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
  2⤵
  PID:4468
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
  2⤵
  PID:4489

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

be7b7b05-7ca6-433e-b4b8-e26585aa3a9b

Path /data/data/com.liuguan.wzzj.huawei/app_06851326-179e-4f06-8472-d5e78a1ab259/be7b7b05-7ca6-433e-b4b8-e26585aa3a9b
Size 94B
SHA256 ad9558493bba19053823079b3ba169d3dece407e2e8d9f959f512ac36d2ef1e6
MD5 ac66d58ddabc53ccd1525b8f0d289d0d
SHA1 9e2185a6c12f88bb10443202b73cd3f2c41f7005
SHA512 98416daab37637a35deffe2aff7fb08c3d155f3a8e945f4d7aab4cb385928c688897b4837618554a2c9bc59782d79688673fe8484b69bd98d2dcd9e66ed22878
MD5 SHA1 SHA512

Submit Download

ua.db

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db
Size 24KB
SHA256 6a4c6e43148e24a514145f0d1dc6fd2aa32855474ee3e459bd472e638c2166f9
MD5 f4a62088849a4e8a02d11d2383c97ba6
SHA1 b537ba1136006e08d970f876540b30adef22bf07
SHA512 a63197c94d124f1b455efd2275b6015108b28aa58c2151e0e41821a189da872adcb3953a9a72a28e4f1a805cf5b0c310f76ae391a21cb5593c62195d93c5762c
SSDEEP 3:pqbqXGoWjWdXtamLUycjOLVFFkq5kt/HQSWdXtam4LWqW1leGn:pqbqejOUmgIVFeCkt4JUm4LoPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db
Size 32KB
SHA256 c0c148fe7d91b55d20d3c5fdd5f9ae45530263399cd1cd2dca887f2449e66bb5
MD5 5fc8d08d762de1cfa5de595e828b4f2d
SHA1 969cd879b7915595463c16ab8e8ff27de9f88828
SHA512 f8cc0b965c9ae7812479fe2ed271f5215bc13e78c0c988d376209d60ba51741a2de85e156e17fd3d65e545fa36ec80b3527299b7ca694b97172d9cab7bcc224b
SSDEEP 3:qqTqWGogt/UoC1TMUWdXtamLUycjOLVFFkq5kt/HQSWdXtamn:0nogtmQUOUmgIVFeCkt4JUmn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db
Size 32KB
SHA256 481ee03d59d2a32e35e37ff8b742f174eb3f7eb7f292f5f15a2242fb4e98c265
MD5 9bc3617be0a6238397c3b324ff4848c2
SHA1 5cb5ab2bf1ed4c9e38a7b8ccd9033e9f2b4fdd93
SHA512 00568cf2647c1fd6949fce08740e233800ed4bec8ee1a418a23bcad7ab043687ab877739f95383eaed9a3fd1df93e172214ffe3ccd67369915019c7f5b586cbf
SSDEEP 3:o1Clt/71alt/:oCXYX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db
Size 16KB
SHA256 826fa464313a83c5f34ac1a954f0a454eba98b3da701829b61e6a864de67c7ac
MD5 31abb278ffa6e9648761327849932203
SHA1 045bbcd63dc067acaecfabe7c1e12a1e32130fca
SHA512 4d6e4b44375f4bd4402b471d2201360d8591ed5bcd174ca797867a0cbe7e78f0c4bb5432da08a4e5ca981779953c616f2653cc5eeae1ca8cee456923e4387a2b
SSDEEP 6:pqF0UDZOUmrk8PXqAOY+hROvuILhFT7zMSE3vN8mX3YVFn:zUDZOUmrksQfOtfTu+ZVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db
Size 40KB
SHA256 c821fbe5f760f9087a3e1618936eab77433afb71558cffc0624ba2999bb33866
MD5 a2c8ea957c4597e5db4c0a0d8e0c5ed9
SHA1 60e20b2855a3cf0725332849c7717c6d98875e1e
SHA512 780de46a7729ff1aad53afb51388c1cea55a8bb2f8a9de6e76c979c4bae0f9d58c83e772c443a2cb8b8e507a9aa399f0ad1400bcdcdb916d17f6c73061172b36
SSDEEP 12:TTSQwRr+o4PD65N5PPJhb9gBcIkJbglTSF7VAWWpNtI7MJ+bvRmBEyPb3HOwIQeQ:TTqRrL4PDiP/b+cLglJWcKbEGSvIQeQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db-journal
Size 512B
SHA256 6d38315524ef5a4d87de5cc0d2b5487397709e608fdfc359aaa0037433b532c1
MD5 dd5fd07eaaa9e7a82c208db120a42f6d
SHA1 6c9ba2dd6319cd48216d1f3345cb5939eff3548a
SHA512 f7a917a9b0172aac34ede114ca8432525dd48ff59c0ce78999af9f26ae763aba71e5c508c4c0e309a3bda1f8d3f23b66ff15c0b52a5bdea03ffc3a1cb3aa83be
MD5 SHA1 SHA512

Submit Download

ua.db-shm

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-wal

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db-wal
Size 12KB
SHA256 c816b3fd2c874f0c32c31917f1b4f327d39c24e99f23c817d6260cae0b12eee5
MD5 bf019e35a9387321c2e8a5d2c1008bc6
SHA1 493c8d798d9808de115f59cbca708d418839317c
SHA512 df8eb452a5d92b31d13f364640fe0d34e15655dd4537f0a4cc4cb1f43bea01fe3fb4eddcbfa9e12ace11c762fa0f8ca8b6e9044516ba30c5e69ccac5a1a25e05
SSDEEP 6:KQCoyHNpnSmetmQUOUmgIVFEpqCkCkt4JUmn:KltpnSmoUOUm/VskCbUmn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-wal

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db-wal
Size 8KB
SHA256 a4b8e00070a56b02e026f63f9cf6071543dd65aa5454b87cd16f3f3c0caf76c0
MD5 2e46f37fd27f0b45dd6ce77baf289462
SHA1 b5e7e5a9f0f84d59681a91d35c77940c10492fb1
SHA512 5de28ad8d41cc100adc5e054eb961953e8df981be8ae49afcebd42a21bc7dda60c41d4cad2b2860a90e3fb9c7b4b50c9c79e53ff545a9c7e65eeb0a175814181
SSDEEP 3:OlH/l6OVnNXBEet6In3Ql1Clt/7lvqM0WJ96lt/:KoIn/jn3Ql1CXV3bJ96X
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-wal

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db-wal
Size 4KB
SHA256 b456b43db596fa3d2cb6d31519faa292da466a8948653433bbc17cae75ce6c95
MD5 1aa8919e9fe38a6266321736a57ba097
SHA1 07f4078a303a6feeef0651619876ba8a448fe6de
SHA512 ef7ce18990a855a0bdc779d11b2274b7226299ae33722be26d4115494d9fcd1003a902fea138ce40e03e0d690b8b4f95a7e7cb777df0b42a10b064bdc2ea599d
SSDEEP 6:KuaNr66/lzMOL4g0UDZOUmrk8PXqAOY+hROvuILhFT7zMSE3vN8mX3YVFn:KuaNLiUDZOUmrksQfOtfTu+ZVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-wal

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db-wal
Size 52KB
SHA256 12dfe52b6249e51a83f8270c27eebfa46039ba9b3279d74f36488cc85fbdc18e
MD5 5e057b49dae6fbb0d2deb64d67896e9a
SHA1 621534e4791bf842552b6c29fbbb7207c277a11b
SHA512 9b04f808cf73d2db6b073eae0d38656ff55cf03b02b670d22fc56ed104b3fd5778a34a437aa1bfa64b1e4249802b1a7ea22c40aed3486197df643f1806592a52
SSDEEP 24:KBzyGSP/LpjNTqRrL4PDiP/b+cLglJWcKbEGSP/V8ozUXSqT:szNSP/VRGpwDeT+EsebTSP/yM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-wal

Path /data/data/com.liuguan.wzzj.huawei/databases/ua.db-wal
Size 12KB
SHA256 f0d969960727c99004512e55ae0e2798fdf9a1c86ef7534af64e54ff694ac6c7
MD5 79640e724d240ad4b8710b6ce8d6a2a4
SHA1 e48f7c9e714b566536947e4b2404d3f0c7114747
SHA512 924ff3519a594b362882a4bc417a3ceabe53b9bbde98c16dbfc1ab9d16f10990d1ce646d8b5b7d13c4b909f6d9549ec99f8394934332d9a13711482414075567
SSDEEP 6:KMJ4519/nqejOUmgIVFGQ/vkt4JUmtjl4Wilo+Pn:KM2XRqejOUm/VN/vbUmRlGlhPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

i==1.2.0&&2.0_1718290944342_envelope.log

Path /data/data/com.liuguan.wzzj.huawei/files/.envelope/i==1.2.0&&2.0_1718290944342_envelope.log
Size 2KB
SHA256 5a6de684dd2d6a70368751092f1dd0ac29cf938c933b37b6ad418bc6d9fc8dec
MD5 ab733a3ebf3121a302a91fe37a4975e2
SHA1 546f07b4765159da66fe84ffbf4ffc06b4fc1ad9
SHA512 4dbec2fc69da81ab7d8a6f277bf1e45884ae01c85acf17e6e7de87b138a6075f69c899c17ce105e4b4e5a2201df8cd2d1028298cf88ae8d12146a3554930739a
MD5 SHA1 SHA512

Submit Download

t==8.0.2&&2.0_1718290914280_envelope.log

Path /data/data/com.liuguan.wzzj.huawei/files/.envelope/t==8.0.2&&2.0_1718290914280_envelope.log
Size 1KB
SHA256 f7101e5d58e6402442589015351700d67671152ac42f38b5d40a80ed4f1b0dcc
MD5 41c7e468b51b8ae6417f69732d5039f2
SHA1 d76509c23d331c7b5ea6b84bedac950ae95399a7
SHA512 9b6722946c6f42f3e9c5d6d71d50bff51f7ab9b76c70185b42213f710675a53073de2527d741f8d77e22113e2e736e29532a9f9e83b9c26e8c8fe0e0b4d88009
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.liuguan.wzzj.huawei/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 3f0220679756d4f568b3943d1f159b396f8c4dce601482fe10df52917caea7ab
MD5 6b7d66f6a8bed3efac09db540b7b71fe
SHA1 89910780cb9f04d3278bf88a776a3b61ddd62dfa
SHA512 f81361d8a0f61adadd0d2af80d0a4f5d66d65252e81013f8def32e0ec2eb0f38f308f8bde880eb062a6ddf3cdac251e5171e439b2f30300d8f56c64a5fecaf06
MD5 SHA1 SHA512

Submit Download

exid.dat

Path /data/data/com.liuguan.wzzj.huawei/files/exid.dat
Size 56B
SHA256 dad8c770924e24209f6041c7b16dde5c5eee5bb08fcac074d1d6cbbaa0c1d831
MD5 346ca878e2b07459c1bb5df41fd8f4c5
SHA1 60362bc1070d5dedb1826d8d569981a9d0bdab7d
SHA512 20c3395a49fcb64df2007f54f91362c4ec9ed9a7ce4a466f14fe9f143d37de43d7ff292165b4bd183322c4559c6f3a4e8899142831df296b73598142ff28d74a
MD5 SHA1 SHA512

Submit Download

dW1weF9pbnRlcm5hbF8xNzE4MjkwOTQzNDg4

Path /data/data/com.liuguan.wzzj.huawei/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE4MjkwOTQzNDg4
Size 1KB
SHA256 8484988cebfd3a8cd6b2c5254c684b10d6d6281eb43cfbff88985e1e1cf5878e
MD5 ad446ad8637524a1799b3837049dd5f9
SHA1 3252facc89ec730ff89ecf1fcce3f174e7c4d285
SHA512 4c4bc9adc0559a147698df3877d59af5475a42c904ac83de9dff42822d2aced263ec8269f31bc6b080f3a47dc7e618e72b968ce099f949d54ce75a5cddac5a32
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.liuguan.wzzj.huawei/files/umeng_it.cache
Size 498B
SHA256 14e022ecbc6b35bd17185b8682330783ea6f910bfbb0885b0e964a2d95092253
MD5 65b4672b143559c428d6be00f1ab7464
SHA1 da1e75d278f104d217cf4185541b50258e5a291b
SHA512 d23720fb986a271c277404d40ced4238a654f3c716cf22eeec57428af1569bdc693f435882a9880d4032eedda8a5e338a58b899054be4892927ac6fe58bed8c6
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 ceaee0e71ef112b36479750bdc0fd49c0c989bf11571d3afbd6773266db865a6
MD5 941faaf004d89265bd344c4362eb5ec2
SHA1 401a37bf540631aa477948296eb71dbb613eb835
SHA512 e21f496995e07af991cc52e73a1a9fd0a21d994e55eedb9316601b432099cd7175ccb4bcbd3e74a38e890b02672b2af7793438c1807af15f3958e5ba14a93b2b
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 213B
SHA256 e0b4afb7c4e8fc8a288a21f3fb9cb769a38876cb91d8d5cc96541e44a0686861
MD5 2fbd523e75ec93f97df39ecbaa35f429
SHA1 a0a92f0cc9fe17bcd39c8ca0594dc0ddd215f577
SHA512 aa6025c9dcaf349fd7a49c976aeaa6fea8b277dc565b4e2e3c36105f17b03986b7f2d02d457eb7f60c846e16a618ce88bdd243e407b99a0905027c25e08f86a9
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 d113596aea6937f947d24749bd92af0bf466395ad1e6aa09f95075d46b52c4ab
MD5 f2d9d00061118bf8594f42c25a822393
SHA1 e75233665cfc60ab84a99d2df86d821e52ea2d3f
SHA512 0f8b0bae9d5f7e0265dfc07704314f1b25196d03e2b71e695374e3df865d2f453deaf6fe67d568782291b78cfc510db898ab3239f9e95849542a87bec505362a
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 167B
SHA256 ebd93634a9a4a9b9a0b716601af4d7cfca5c96b4ba230b90500e42553e241e06
MD5 11d497c58b104773c28446dc93e62a92
SHA1 b6edc6899bce42b4265610431d197adfbcda27e7
SHA512 493530ada15ea752531265870eecdf05f6ffec7e9d9632fdd43ccfaefefa4eadf65771f2a70651b1999824178c8b9b532f9792373b8013964f9ddee0ef6d531f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads