Analysis
- max time kernel
8s - max time network
131s - platform
android_x64 - resource
android-x64-20240611.1-en - resource tags
androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system - submitted
13/06/2024, 15:24
Static task
static1
Behavioral task
behavioral1
Sample
a63dbdf5dfce0388b660f70dc5aeb161_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
a63dbdf5dfce0388b660f70dc5aeb161_JaffaCakes118.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
gdtadv2.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral4
Sample
gdtadv2.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral5
Sample
gdtadv2.apk
Resource
android-x64-arm64-20240611.1-en
General
- Target a63dbdf5dfce0388b660f70dc5aeb161_JaffaCakes118.apk
- Size 26.3MB
- Sample240613-ss6ejsvajd
- SHA256 228b47232fdbd86a57675f74fb8fcd95a403e87ce1a49f7ead286136607d4ad0
- MD5 a63dbdf5dfce0388b660f70dc5aeb161
- SHA1 59ad2c2b99f880176953b0cfb0b7f67eb72c6d06
- SHA512 515c36627ccf84eef8324a29c9c9d58bbc1f32908d165acd5a84328b6bf68768bb8536dbeb004add0412848c68afa1cff28f27663b6646f986134b399fa77a56
- SSDEEP 786432:oVKOyukixlBteFegQk8yuegXkn1UPm7v6e9AuG5D9UTbvd:oV+eZte8k8yKkn1UOwDal
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.bujiadian.evoa/[email protected] 5019 com.bujiadian.evoa /data/user/0/com.bujiadian.evoa/[email protected]!classes2.dex 5019 com.bujiadian.evoa - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.bujiadian.evoa - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.bujiadian.evoa - Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.bujiadian.evoa
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.bujiadian.evoa/.jiagu/classes.dex
- Size 3.3MB
- SHA256 8673d25ba018d6132c82120d2f680be6e77acde70f9efa75ce29ab2591749966
- MD5 e56051a25fb72c941f4cfb5927eda8a4
- SHA1 8e5b2525a7f2ca70da83faad0b4d7308cceab225
- SHA512 4c9951e89dd991851a3d0566a11b7a3ad9a389660a61252126254319b26c44ea2acbdc1f425ec3c6182999fb4ecd1660a4cfe835eecc4249d166269ecd64ca14
- SSDEEP 49152:t+Q7ZZ/JIoojuRoDCnHzCU/RdoinjyKqTlbp2RNL8DDMwd:JRbzbNV6lYuDn
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.bujiadian.evoa/.jiagu/libjiagu.so
- Size 456KB
- SHA256 707cbb7d210699b111f050a382224f04ba2dbf72ecb4ee8f420d5759b6a23681
- MD5 7e7125a1193cfa8a696c1b8a6d2a103e
- SHA1 af193df6127a47f455ebb7d5b792d2e982f4e004
- SHA512 91a62f00c2a9dc3c28348ef512ca56ab44d999e11dd806d565109159e79f25833c9141023ad639c7f5132acb8038ca0d7cc049ca2118534570d3ef1b36798b03
- SSDEEP 6144:lDjcsfgPhZt6JPe6xK2MiaDKApynUKpZ5wuPUrgNYQE4J5uKRz+EHwCNG6maDqY7:dfCZt8e6w33yn/P1YA2sz+EMqOm
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.bujiadian.evoa/files/.jglogs/.jg.di
- Size 340B
- SHA256 26f6857fc1f2f3809ac4e696b0dfcb79db34f5689929f1e4e5b7ec230b996b8a
- MD5 15767834cc617ebfdab4dcd77fdbd199
- SHA1 16551bb897f76a58c57faac8d19de7ff3f397d63
- SHA512 afbef4af74a0093fb6232366f595d1c6ca90f023eb8b21058ada054372ad5c35c481554979ea4d9efc690504e1303fb6368333fb44af91c2556f28128919b613
- MD5 SHA1 SHA512
- Path /data/data/com.bujiadian.evoa/files/.jglogs/.jg.ri
- Size 314B
- SHA256 9076b2960dbcfa94e7ed041b0ab90f1eb3f97fe7496a8338930c44e92c05eb99
- MD5 5b310272555c08e3e0e0132cdbd52b8f
- SHA1 5f39b7708eb10723ec9cf7ddbf5167c686aced48
- SHA512 7897e74613cbe04e199c5afa72937c5d2c568a403afd8232f1d2d9f37714cbf2ffdeeff9ea90b0bab7c78a167011f2e38e261d812d38761a833142340d96b65f
- MD5 SHA1 SHA512
- Path /data/data/com.bujiadian.evoa/files/.jiagu.lock
- Size 27B
- SHA256 bbcc0072a775bb7be9e70e2020d78ec6db9020a951840816831306a18abccff4
- MD5 e56c14219a160b1e7baeb463dd79f015
- SHA1 1c030775eb22571541602fb2eec96be13f659fd7
- SHA512 30beba15bb519c8bf3ee84fce830486697822a3b33e4abb1b02879d655dc1c5237623a21d8982980d06e4b4286edae99641ba32954ceb51a464382aca3ebcdb4
- MD5 SHA1 SHA512
- Path /data/user/0/com.bujiadian.evoa/[email protected]
- Size 5.5MB
- SHA256 9878d5cebd820ca4af15e598a853e4984020310a3b213d35c5dca736054d7123
- MD5 b83decacfcfad48788e71233cc34789f
- SHA1 4c2e1ae222225f530d171f7486652d121b3e210e
- SHA512 f11648213df07aebe9201901e73bc3b7c89f05a62de67edc76ca0a77561455a53d06aabdf7fe358107a89f1504013536faca2945119517eabc144c24b4bdc40e
- SSDEEP 49152:RHVJx6g3ci0BVXqOVjRdtFY11+CnHzCU/RdoinjR:RHVf9GdtIzbNF
- MD5 SHA1 SHA512 SSDEEP
[email protected]!classes2.dex
- Path /data/user/0/com.bujiadian.evoa/[email protected]!classes2.dex
- Size 1.9MB
- SHA256 9aef35fc4046d4fc4e4a4dafb8bad2338e256ba77974838de2dc54e47c113d87
- MD5 77ab39414fdd063964933a9a80e0ad4c
- SHA1 26e5a06b1a4d3c760c38aa1a3d020c1110be878e
- SHA512 c074eb8bd30cceb509052d4a7d20ea4f19f2ca186552120b552f0938eabcd2245459151fc4ca690833fd0b9e68d3c7a803ad336822b74d391a12971533575431
- SSDEEP 24576:+MbTpqlxEsBcw5kcQxyGc0mGeOXrpk9OVhvwd7vm1IwwRB2zP:lZq4s95CcGl+OX1HVhvwfu
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/360/.deviceId
- Size 48B
- SHA256 36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
- MD5 4c4c5285293d5141f582aefa4e038669
- SHA1 e01852a72e5a8e6f7d63a21426b515118196047b
- SHA512 097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399
- MD5 SHA1 SHA512
- Path /storage/emulated/0/360/.iddata
- Size 32B
- SHA256 a390b3b9ce31d33bddf925c8da20b87a5cb3dd53158871f87b2a6d3fdd3bce92
- MD5 1094ff8b379326beb47f631739a04dce
- SHA1 6887aa655fd9ce86da8c2eb896424ba8d2b19c55
- SHA512 5df9926acb0ab9cd0f379efba2353a3d0a583642452d33d4cc48a071c5fa811bfe2e54196148da800e2019c5dee978051a760b4ffac502119771117d6efec468
- MD5 SHA1 SHA512