Analysis

  • max time kernel
    164s
  • max time network
    185s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    13/06/2024, 15:55

General

  • Target
    a65dc4619f17c2e969f5259b30185a14_JaffaCakes118.apk
  • Size 20.9MB
  • Sample240613-tcxcdazalm
  • SHA256 ef923ed8a901bfaff4636cc27b62a50d17839af30e96eb0350e3bb7f95b73a39
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

Processes

  • com.xisue.zhoumo
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4653
  • com.xisue.zhoumo:pushservice
    1⤵
    • Queries information about running processes on the device
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4731

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ua.db

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db
        • Size 40KB
        • SHA256 5dc7460e67ed8400bb5706b1f4c7338ec6f4a76767a725c4b48ab73680bffc95
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db
        • Size 24KB
        • SHA256 55582e03cc195158477257090be584193e673e304045accf8c9d492da2f67ab7
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db
        • Size 32KB
        • SHA256 ed082092f0e694cd0d70df4a38a0b52ea2f1c82bdb23ab4a6b3354ff894ef583
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db
        • Size 32KB
        • SHA256 d177640c4c49926b145f1693a9e0e64f9f5d508f30a1d623410064d04913f1ef
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db
        • Size 36KB
        • SHA256 a78d4b1c84bfc25ffbe3e21e4bd04df9561ab35bf74482848a838ce3cb65d8d6
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db
        • Size 36KB
        • SHA256 0a4f0a5a3f503d164f6d38c9f9cf349bbb5003d952f6d81e153f0b5d7d5446a2
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db-journal
        • Size 512B
        • SHA256 981b5e05c89e3b60aea3ffe57b403c0eec3de90558cb67e659d4496e9244fb5a
        • MD5 SHA1 SHA512

        ua.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db-journal
        • Size 8KB
        • SHA256 960ec27f7a4ffa044beac3017978f9de0fdf8e71543a97aef5a0a2460cb2babd
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db-journal
        • Size 8KB
        • SHA256 96dc63444eb31adfe4679d62526d85ce1faac7486c0e1796701713cbb8417640
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db-journal
        • Size 16KB
        • SHA256 28e8d141fceb663f0a6dc1da7bfa1c52e2c87d444d98dab2d91c0809af1a6440
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db-journal
        • Size 16KB
        • SHA256 ddcfc2bd804208b1441025781cc72123ce4e2ab64619565b010efc0a9f9b736b
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/ua.db-journal
        • Size 12KB
        • SHA256 2ba2199ab401c4341669912e53f2dd58d549acc97194c4e69f0616be25a076dc
        • MD5 SHA1 SHA512 SSDEEP

        zhoumo.db

        • Path /data/user/0/com.xisue.zhoumo/databases/zhoumo.db
        • Size 52KB
        • SHA256 dedfa5a736985d82a291376639459d60108fef7643e5a849c2e38133fa463ae0
        • MD5 SHA1 SHA512 SSDEEP

        zhoumo.db

        • Path /data/user/0/com.xisue.zhoumo/databases/zhoumo.db
        • Size 52KB
        • SHA256 0b5b27bc0c4e85f09095a48bb53ffb67e53e2d392de5c01aaa3cab692f7b1ef4
        • MD5 SHA1 SHA512 SSDEEP

        zhoumo.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/zhoumo.db-journal
        • Size 512B
        • SHA256 7e49b1afca549a2fef6377efa77a0af9fc1df7f2f46eaabb9571e53624e210be
        • MD5 SHA1 SHA512

        zhoumo.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/zhoumo.db-journal
        • Size 8KB
        • SHA256 2d306295a9ea5d162199082e4973d0a5b2e6cc99fb97343c456c620bb8a53e93
        • MD5 SHA1 SHA512 SSDEEP

        zhoumo.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/zhoumo.db-journal
        • Size 8KB
        • SHA256 8d7e582608a377e862f6c396dc0b90617e221e8cc01e3d6f534b8fc2f36bc804
        • MD5 SHA1 SHA512 SSDEEP

        zhoumo.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/zhoumo.db-journal
        • Size 16KB
        • SHA256 e44352c6597e024a25c6a7b1355a851d32652363641663f7b8ef805a091a376e
        • MD5 SHA1 SHA512 SSDEEP

        zhoumo.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/zhoumo.db-journal
        • Size 16KB
        • SHA256 f466f20e31c1657761f86c842930e2111ba290b72a68c16de295fe7635af0a4c
        • MD5 SHA1 SHA512 SSDEEP

        zhoumo.db-journal

        • Path /data/user/0/com.xisue.zhoumo/databases/zhoumo.db-journal
        • Size 16KB
        • SHA256 45f13fe4865922bd296413d1bc3f8d821675247a539bebffefefe42ab786afc6
        • MD5 SHA1 SHA512 SSDEEP

        a==8.0.0&&6.2.6_1718294151217_envelope.log

        • Path /data/user/0/com.xisue.zhoumo/files/.envelope/a==8.0.0&&6.2.6_1718294151217_envelope.log
        • Size 1KB
        • SHA256 af272d463921bbd754ef33f47e0d533eaa481943c4aa1bde535455b94157ff5e
        • MD5 SHA1 SHA512

        i==1.2.0&&6.2.6_1718294151977_envelope.log

        • Path /data/user/0/com.xisue.zhoumo/files/.envelope/i==1.2.0&&6.2.6_1718294151977_envelope.log
        • Size 2KB
        • SHA256 2b9784ce4ff9441e7798fee27052d9395f2e439a5113a740e576f19a9988d817
        • MD5 SHA1 SHA512

        t==8.0.0&&6.2.6_1718294149882_envelope.log

        • Path /data/user/0/com.xisue.zhoumo/files/.envelope/t==8.0.0&&6.2.6_1718294149882_envelope.log
        • Size 1KB
        • SHA256 6281361294a39a5148bb06604520e2320d3911aefc5aab359a1beb6cf3c24802
        • MD5 SHA1 SHA512

        exchangeIdentity.json

        • Path /data/user/0/com.xisue.zhoumo/files/.umeng/exchangeIdentity.json
        • Size 162B
        • SHA256 0ec4972c13d3f013de80d7924c1c42623c90d40741eeb66787d88a6e352bc0fa
        • MD5 SHA1 SHA512

        TDtcagent.db

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db
        • Size 20KB
        • SHA256 f821b15bd7f478da36bda62f1607d40e80b0540dd6c14e11e9c37b66866e8ed6
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db
        • Size 32KB
        • SHA256 3d0db07334f474275cb063c5dcfcf30cf4d7e6c5f47c966cf05950b627143f59
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db
        • Size 24KB
        • SHA256 0b21fb1258a5cb805d533bcf1ada0e5354d143f560f74eedde20503213c921d2
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db
        • Size 28KB
        • SHA256 820d1baee966e39f7acd1a87c6a616dc976606423e3b762ae613b1009937cf28
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db
        • Size 28KB
        • SHA256 045427862f70ac2dd064fe2e0258676bf2fc5e7147ee86ac73a045a2c4aa981f
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db
        • Size 28KB
        • SHA256 d42dc7e32b4964faf3102f2bc674d386ccbd989ad6c09b7d4e670dcdaf3b4a97
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db-journal
        • Size 512B
        • SHA256 dc602eb507bc65201b2683c32bfa157d19b3d47f8054e0150281af46b2ea585a
        • MD5 SHA1 SHA512

        TDtcagent.db-journal

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db-journal
        • Size 28KB
        • SHA256 bcb7edb790b1231a3ef383fbce8942404edd87e6231097bb16872bb1448e4c61
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db-journal
        • Size 12KB
        • SHA256 c95ce9141f01079e5a3ec3c4662ea399a04bd49d4314f835ac3c9af4aea3ff9b
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db-journal
        • Size 12KB
        • SHA256 e73e7d0725ebb1c88605fd9560e09a2064d12a3da71ac21f28f3f15148244e38
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db-journal
        • Size 28KB
        • SHA256 49caa2141971dd933149d4fa63460207f9d33edb297ee84441c2fb43b35765fe
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.xisue.zhoumo/files/TDtcagent.db-journal
        • Size 12KB
        • SHA256 fc8b702082df17a36b44807cabc405ef5e43e6f8c723eb5e434f7194e15b8a93
        • MD5 SHA1 SHA512 SSDEEP

        exid.dat

        • Path /data/user/0/com.xisue.zhoumo/files/exid.dat
        • Size 63B
        • SHA256 85649c6b02223b76a8a7f842d94724481a55084ad03e3fbec293c9f779a735f4
        • MD5 SHA1 SHA512

        index.android.bundle

        • Path /data/user/0/com.xisue.zhoumo/files/index.android.bundle
        • Size 1.1MB
        • SHA256 449074004f61c6b5e8dbbeba0b326f10b20ea6f0b12cc975102629fe5794f758
        • MD5 SHA1 SHA512 SSDEEP

        init_c1.pid

        • Path /data/user/0/com.xisue.zhoumo/files/init_c1.pid
        • Size 14B
        • SHA256 03345568e4b1e9cd456a4433db9c349f578b67f0b3f58db009dae236c3c140ca
        • MD5 SHA1 SHA512

        dW1weF9pbnRlcm5hbF8xNzE4Mjk0MTQ4OTI2

        • Path /data/user/0/com.xisue.zhoumo/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE4Mjk0MTQ4OTI2
        • Size 1KB
        • SHA256 b5051bccc4ed123fb94d5ca5dc92f0996d2a90c5bd95057aee225e21a287ffd7
        • MD5 SHA1 SHA512

        umeng_it.cache

        • Path /data/user/0/com.xisue.zhoumo/files/umeng_it.cache
        • Size 350B
        • SHA256 015d47ac3ccc7b034638f1287795c293e3139119a469881d93a161c7e4298f91
        • MD5 SHA1 SHA512

        bundle-all-d9c923c565.js

        • Path /data/user/0/com.xisue.zhoumo/files/web_offline_res/bundle-all-d9c923c565.js
        • Size 670KB
        • SHA256 c535873ba376c849d823d7257a4165ebd90ef2ed8a3910cbea5a9b94467b2ee8
        • MD5 SHA1 SHA512 SSDEEP

        common-78c65107ea.js

        • Path /data/user/0/com.xisue.zhoumo/files/web_offline_res/common-78c65107ea.js
        • Size 29KB
        • SHA256 4e6427be15b8290052ae6b2c110beeed5a4576fb3b5ec55f1b479737f9e32911
        • MD5 SHA1 SHA512 SSDEEP

        common-bb2cf9c5e6.css

        • Path /data/user/0/com.xisue.zhoumo/files/web_offline_res/common-bb2cf9c5e6.css
        • Size 39KB
        • SHA256 c18e900b3fa91da0a1dc1aa3b33a8c67d356123eef6a0a9ca13dd0bfdeaa252e
        • MD5 SHA1 SHA512 SSDEEP

        components-bb6850f505.js

        • Path /data/user/0/com.xisue.zhoumo/files/web_offline_res/components-bb6850f505.js
        • Size 4KB
        • SHA256 df256e414856bbb90790f7ddde65ff2e305224a634cceba74221d85fa5f0783f
        • MD5 SHA1 SHA512 SSDEEP

        index-3addd60c58.js

        • Path /data/user/0/com.xisue.zhoumo/files/web_offline_res/index-3addd60c58.js
        • Size 6KB
        • SHA256 392b5976dcf99c66a92e75ac20fdb39e84fcb6024aee26fe963e0e6a7c7fd15c
        • MD5 SHA1 SHA512 SSDEEP

        index-ca064cac4f.css

        • Path /data/user/0/com.xisue.zhoumo/files/web_offline_res/index-ca064cac4f.css
        • Size 1KB
        • SHA256 a3ee814f38625d4f2bea30450fec1aaf4485c5cc824d16e93b21a872798b4582
        • MD5 SHA1 SHA512

        ratchet-1f0626a020.css

        • Path /data/user/0/com.xisue.zhoumo/files/web_offline_res/ratchet-1f0626a020.css
        • Size 19KB
        • SHA256 411c3a5b998b69e6507791f525f149b0b90d3635b0e43a6c3e7aaf8fee08efb4
        • MD5 SHA1 SHA512 SSDEEP

        tj-cb998fb3ed.js

        • Path /data/user/0/com.xisue.zhoumo/files/web_offline_res/tj-cb998fb3ed.js
        • Size 6KB
        • SHA256 6b020dd39a7e6d6b77ff6708c20b95b4c53751931b8b64092754ec185b1bd8bd
        • MD5 SHA1 SHA512 SSDEEP

        dso_deps

        • Path /data/user/0/com.xisue.zhoumo/lib-main/dso_deps
        • Size 388B
        • SHA256 a1537868bcc1aa329ae15e37d1d38742ed69d79caf9c4cd5fbf8956dafa641fe
        • MD5 SHA1 SHA512

        dso_manifest

        • Path /data/user/0/com.xisue.zhoumo/lib-main/dso_manifest
        • Size 170B
        • SHA256 4000251c80efbbc9e4a97b9a2d0910ef3ec0065158aa095e5c78ee32d5e3ffd7
        • MD5 SHA1 SHA512

        dso_state

        • Path /data/user/0/com.xisue.zhoumo/lib-main/dso_state
        • Size 1B
        • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
        • MD5 SHA1 SHA512

        dso_state

        • Path /data/user/0/com.xisue.zhoumo/lib-main/dso_state
        • Size 1B
        • SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
        • MD5 SHA1 SHA512

        libbspatch.so

        • Path /data/user/0/com.xisue.zhoumo/lib-main/libbspatch.so
        • Size 56KB
        • SHA256 2b25118e643c09801877a5b3c94674c083880f906e219e4b0f6990002f42fab6
        • MD5 SHA1 SHA512 SSDEEP

        liblocSDK4.so

        • Path /data/user/0/com.xisue.zhoumo/lib-main/liblocSDK4.so
        • Size 31KB
        • SHA256 86d081062f482ef15257fe875eebe0eacecf62c53254369f3761d9a3ddf1d83a
        • MD5 SHA1 SHA512 SSDEEP

        journal.tmp (deleted)

        • Path /storage/emulated/0/Android/data/com.xisue.zhoumo/cache/newlocationCache/journal.tmp (deleted)
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512

        1718294157

        • Path /storage/emulated/0/Android/data/com.xisue.zhoumo/files/carrierdata/1718294157
        • Size 378B
        • SHA256 1d2f85e3da54c827789102022f09341f9b857754838ab82914c963fa742f0319
        • MD5 SHA1 SHA512

        1718294157

        • Path /storage/emulated/0/Android/data/com.xisue.zhoumo/files/carrierdata/1718294157
        • Size 2KB
        • SHA256 af074f539f7d43e3a7207de2ba89a05afe615b683936f4770a8637e48415e8a8
        • MD5 SHA1 SHA512