68a2b554d412a6b3188b96cab2a0809fa8ca25624746f7ab103772d3ec3273ba

Analysis

max time kernel
179s
max time network
185s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
14-06-2024 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a79c793cbc09ed25249020f4218440d4_JaffaCakes118.apk
Size

31.5MB
MD5

a79c793cbc09ed25249020f4218440d4
SHA1

c29ed075213e751615d54e1baa886e3a54a6190a
SHA256

68a2b554d412a6b3188b96cab2a0809fa8ca25624746f7ab103772d3ec3273ba
SHA512

77091e30e526faec3a5673e1c8fffe55eb13db8a05466309103934eaca1f6dadd2586a8afb45ead49bec2beabb5c7fcfed92ffb996a19e1a049e2c614b54f942
SSDEEP

786432:K5vMHxGFeWdQcjen0Xzx8wiqOiuwBdmkPwvd:K5vMRlOjen2GwJN5Rwvd

Score

7^/10

collection discovery evasion execution impact persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

T1424

Processes:

cn.cainiaoshicai.crmcn.cainiaoshicai.crm:pushcorecn.cainiaoshicai.crm:watch

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.cainiaoshicai.crm
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.cainiaoshicai.crm:pushcore
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.cainiaoshicai.crm:watch

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

T1421

Processes:

cn.cainiaoshicai.crm

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults cn.cainiaoshicai.crm
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

T1430

T1627.001

Processes:

cn.cainiaoshicai.crm

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation cn.cainiaoshicai.crm

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	cn.cainiaoshicai.crm

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	cn.cainiaoshicai.crm

Queries information about active data network 1 TTPs 2 IoCs

discovery

T1421

Processes:

cn.cainiaoshicai.crm:pushcorecn.cainiaoshicai.crm

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.cainiaoshicai.crm:pushcore
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.cainiaoshicai.crm

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

cn.cainiaoshicai.crm

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo cn.cainiaoshicai.crm
Reads information about phone network operator. 1 TTPs
discovery

T1422

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cn.cainiaoshicai.crm

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

T1624.001

Processes:

cn.cainiaoshicai.crm:pushcorecn.cainiaoshicai.crm

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	cn.cainiaoshicai.crm:pushcore
Framework service call	android.app.IActivityManager.registerReceiver	cn.cainiaoshicai.crm

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

T1603

Processes:

cn.cainiaoshicai.crm:watch

description ioc process

Framework service call android.app.job.IJobScheduler.schedule cn.cainiaoshicai.crm:watch
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

cn.cainiaoshicai.crm:pushcore

description ioc process

Framework API call javax.crypto.Cipher.doFinal cn.cainiaoshicai.crm:pushcore
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

cn.cainiaoshicai.crm

description ioc process

File opened for read /proc/meminfo cn.cainiaoshicai.crm

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	cn.cainiaoshicai.crm:watch

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	cn.cainiaoshicai.crm:pushcore

description	ioc	process
File opened for read	/proc/meminfo	cn.cainiaoshicai.crm

cn.cainiaoshicai.crm
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4327

cn.cainiaoshicai.crm:pushcore
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4358

cn.cainiaoshicai.crm:watch
1⤵
- Queries information about running processes on the device
- Schedules tasks to execute at a specified time
PID:4463

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.cainiaoshicai.crm/databases/RKStorage-journal
Filesize
512B

MD5
96146791e4b9781871fd2e7e97a265b7

SHA1
2b954d7a9aa1aca1c263f9c48cc944c6672f7e0e

SHA256
eb626ba106c431ff8dc76c6951e937e3cb7f72f3e4922ce113c01f3bbac0731a

SHA512
5991c6eb377e495dba434056a988b648ee54853d3c4d2d5d1d0380efa228808930b5de22d82a799f2968ca33af5e7742e64823ae3f7f63580c6f82c36c6d6c05

Download Submit
/data/data/cn.cainiaoshicai.crm/databases/RKStorage-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/cn.cainiaoshicai.crm/files/jpush_stat_history/active_user/nowrap/a974d32d-7a39-4ee8-94f7-6654ac143ffc
Filesize
159B

MD5
8188f6830d9992356cfeb44648f65761

SHA1
5bbaaf7cfd7fa08d8407e5d0c659e4dae0b7ba2f

SHA256
032edf2de6cd2ffec7e6f49cad1043220c7d6fc82c0c864b09a08850bc0c9852

SHA512
d3a44d10ca09a1f5e1a96b4ae6e611acf3f74394127781c16ef708a9c22363924148707385b07dec081c3f50615ddbe758acf9eedd19a18a2a185de11a3fa69a

Download Submit
/data/data/cn.cainiaoshicai.crm/files/jpush_stat_history_pushcore/normal/nowrap/d732aa48-15e3-42bf-9a81-063d4f951aaa
Filesize
112KB

MD5
8f8711a38435effc4d016d3ca20a8baf

SHA1
10929b88d33c7def7d6cbf6d75414ec26cdd741a

SHA256
723434080416a28bbf642c4eace68d64d5c1482b8bcaca69687624c1f3682d00

SHA512
43c5e82936ac0c841f42173ef7399213d9128dfdca01881615d948246ff1d8004cb7329f5e97feddeca7c57bb70d9c7beacccb5d682e8cd8d5e162ef62df3b13

Download Submit
/data/data/cn.cainiaoshicai.crm/lib-main/dso_deps
Filesize
148B

MD5
f88e6fff3b8988cbd3ba224b8348e10e

SHA1
9520eb3132a98915627f0bcb995fb7341a202c0e

SHA256
355b6702577660073d741bd609dedebe0a98d66a4c804cee9763b94ac1dc9f51

SHA512
d37c76839bec00038697a603dcccfb7474e5c059d6048ec5dce62e900af2fd60ff4899d41f4228a657c17686cdbb6a4d9368f1ce00bfe855c4e8f1021138a754

Download Submit
/data/data/cn.cainiaoshicai.crm/lib-main/dso_manifest
Filesize
119B

MD5
abf3560e5348dae4d123642bb14c6876

SHA1
67142c7be3a99b7a7992a4e96b90e5fbba828dcc

SHA256
744c0ab9e66691efd597ec71e0f6f133893142b3e815fad066630b83dcd503ef

SHA512
f539ee635bdb309d7e1dd9dd62bf8f6694ae52ec28935f6c6a9740f8497357759142813a2a5da893585c7e2af8ed9b45af62f402a45d2b4fbf151f0f114027cc

Download Submit
/data/data/cn.cainiaoshicai.crm/lib-main/dso_state
Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit
/data/data/cn.cainiaoshicai.crm/lib-main/dso_state
Filesize
1B

MD5
55a54008ad1ba589aa210d2629c1df41

SHA1
bf8b4530d8d246dd74ac53a13471bba17941dff7

SHA256
4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a

SHA512
7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

Download Submit
/storage/emulated/0/data/.push_deviceid
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit