fc40e73f95616eaa81b98a97e2db38fb1c67143fe09e2f674f7536ad397f293b

Analysis

max time kernel
8s
max time network
136s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
14/06/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a787548dde1a38f8a062d8f608fa8b22_JaffaCakes118.apk
Size 13.3MB
Sample240614-bvh9cstdlr
SHA256 fc40e73f95616eaa81b98a97e2db38fb1c67143fe09e2f674f7536ad397f293b
MD5 a787548dde1a38f8a062d8f608fa8b22
SHA1 93591a210e14e30c564557f66e6fb053a08b62d4
SHA512 1dbd28d1c52c2323335794852786bb49b8eb97111c8cf9dc166be5b1ad4f982792b08f7e20e68337fca9fd0bb3972a1c6ef1cda8adfb1d63c588a83f580b8419
SSDEEP 393216:rIGlqjvGSotGj7H2xQbFJj2pDz1IzoqJrAGmG6:rIN0G/H2aJUDJIzoqdH6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.bootmode	com.tieniu.lezhuan

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tieniu.lezhuan/.cache/classes.dex	4236	com.tieniu.lezhuan
/data/user/0/com.tieniu.lezhuan/.cache/classes.dex	4236	com.tieniu.lezhuan
Anonymous-DexFile@0xdff67000-0xdff73338	4236	com.tieniu.lezhuan

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tieniu.lezhuan

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tieniu.lezhuan

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tieniu.lezhuan

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tieniu.lezhuan

com.tieniu.lezhuan
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4236

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37CF018B.dex

Path /data/data/com.tieniu.lezhuan/.00000000000/37CF018B.dex
Size 48KB
SHA256 c433c8e3f847da2b98ee8b704ea3b7d0f38d6249626dfe26a22bef0c08e5fa71
MD5 75d46252620a12dd7343e91c8ba209bb
SHA1 6615b67e21963e5689685f8494f442dcd729d4d1
SHA512 9ae5f0ae0a77bc8c9a27a43252ba01d4bbb69a326eb028d2e887d701b202b66a7065765f2f0214d2b0701493634ff33c2104becdb80bf7e8c2657175857b7af8
SSDEEP 768:S+kN3Frp+DG1P9hHLshodDXDp4htUGE3+cru2lR120gp3IVH8a9/G/BVRhBA:SLlFrp+Di91o+jYk33OI1F8bBA
MD5 SHA1 SHA512 SSDEEP

Submit Download

37CF018B.dex

Path /data/data/com.tieniu.lezhuan/.00000000000/37CF018B.dex
Size 48KB
SHA256 26fd97dcb56a0ae4ffee7b9514cb697de101ad39e3b2af2933b1eadf409b740e
MD5 4e93a7a07efedcc6e3c741526d2d89a7
SHA1 e25833d7a51783c17978a7c5e7953d7cf1df80f5
SHA512 94a5e0b50c0efc69b79fe9b46513537b798a45d00234a7fe1c529e7d5eb153704ec9966a0e0819983f726260579707d7b82e7b31f845fa7602e06c078b98319f
SSDEEP 768:UPCXMYnJAwf6VsN1IDQNMQZko817lnFxg62z2QcyueNaP+h4qRgR:UPIJAwf6VLQaQioo7ln/2YIQmh4sY
MD5 SHA1 SHA512 SSDEEP

Submit Download

1004

Path /data/data/com.tieniu.lezhuan/app_crashrecord/1004
Size 228B
SHA256 9736d75130985cf554449b83e454f39ab7389315455edbbbf8f703fc0b85e860
MD5 790a593dca076b2eedd3e0641a99d6a3
SHA1 34ce949b11d9f1473e1ff2cc49722485000da4d2
SHA512 d067a4fdd07a5066e753db568ecd9bf29abe8c974b72d7952b3da09bdee11491b1042d7f4319267c7368dd4378d5597ebc34ac5d0865879078327298306c6ff6
MD5 SHA1 SHA512

Submit Download

1004

Path /data/data/com.tieniu.lezhuan/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

bugly_db_

Path /data/data/com.tieniu.lezhuan/databases/bugly_db_
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

bugly_db_-journal

Path /data/data/com.tieniu.lezhuan/databases/bugly_db_-journal
Size 512B
SHA256 75f7f1fbf051b491a2d5158b2daa4ff2f9534b1d1cefaba0b179eb9d8582e996
MD5 c744823fb594f38bc6aa05e4c61e5a6c
SHA1 1b3b4c152240f432bc7e977276b753175f3190f7
SHA512 51ef8d0a0f4605c917d3a423644f706199b9b0d9f5e56ce3ca57c1db2945e34e6ee6f8864aeb388b8e6d0a3c22bf2b642a52e63da80b53bab565e55df0de04f5
MD5 SHA1 SHA512

Submit Download

bugly_db_-shm

Path /data/data/com.tieniu.lezhuan/databases/bugly_db_-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-wal

Path /data/data/com.tieniu.lezhuan/databases/bugly_db_-wal
Size 68KB
SHA256 cc84cd3c4d5dbad4ef724e2949a4a560f6f17aa5d9dd991da863119dfb73acad
MD5 b35b23b6a7aceb6767a162f79a0c57c0
SHA1 4337a154e9865d2251a7d2106f4a90131ff80e22
SHA512 54ec6e0b437258748e2e40b5a2201a93365f1a7ffe59c7324cf4a2b0a4c02d5c07f4668608314815841947d68eab6664f68a49d984aa002334f506f8190a4b13
SSDEEP 48:szNSP//k485WuAriStwwuMN5meposSP/Y3sBTtfxDa9CCi9cpcUK7:U0P3s53AzwPFj4C39cyUK7
MD5 SHA1 SHA512 SSDEEP

Submit Download

npth_log.db-journal

Path /data/data/com.tieniu.lezhuan/databases/npth_log.db-journal
Size 512B
SHA256 ffd07e3ee6bbb534e9a2c88738e6c1fa43cd2a800b882944609ab994e9e61983
MD5 a872d1926c9a4f81f610f0bcf20ff6c1
SHA1 3ec65e8e6e19d30ce77a9d37b71d4393f0b70af9
SHA512 2c23dd5748c405b66e54fab0b4ab407cec91a9407ca789654a600bd8308c2e7f881fa82c3337e772a35f4e455719d27d9064d2e3a8398cac8a60ad89a48f668e
MD5 SHA1 SHA512

Submit Download

npth_log.db-wal

Path /data/data/com.tieniu.lezhuan/databases/npth_log.db-wal
Size 32KB
SHA256 61eb70a27acd5d980c9ba4fbf8dd705f68be19d12e2b29feacdd9dade8970b12
MD5 8c1e684fded173830528d0f55726bf92
SHA1 45d35e219bc0f98b5ec986a0510e7b41db25e806
SHA512 c824c4b3b0e6ce6667464934c53f2dfa75479959b89262bab2108216f0adecd7e6fb5c276d464631c3b7b5a5fa0b1d48f248175b3807a15e32246bbc1244eebd
SSDEEP 12:KmDzdTRmBEyPbP/EKXYOwClFM8DOqsyNTSFbys3KVD9CU4LCRmBEyPbP/k/xOxk+:K6zyGSP/EKXiWM8K01CblGSP/kY
MD5 SHA1 SHA512 SSDEEP

Submit Download

classes.dex

Path /data/user/0/com.tieniu.lezhuan/.cache/classes.dex
Size 8.8MB
SHA256 fd1e58d3cbe1c5455b44ba3121714b89b3d2e32ae72091086bf98db568a5310e
MD5 ef6530bcd430bf2fa1052fd8a5b44338
SHA1 56c20246083e6b2701082a88d009ccb94818c7f8
SHA512 fc6b510fe0830716562ef4410d7afdb4dd41e735b7d70de65167d50f1e564f951f0a7deb3a34230e3822342c38f7c17b933cbadb1b90805a2bcb335209a84bd6
SSDEEP 98304:sePMb5Wt6drw3VvihvC0i/DVHbymeHK623v4d2Xfwv:sAMb5Tw3VviIVHbymJ42vwv
MD5 SHA1 SHA512 SSDEEP

Download

classes.dex

Path /data/user/0/com.tieniu.lezhuan/.cache/classes.dex
Size 3.5MB
SHA256 398766e9425b7b36aa611e37eeb92a46b78e32e6e520cfb67228c2e123eb6bcc
MD5 9b22b4707bab4e8b1d3ba73f8217c8d3
SHA1 9af93dac3abc6167c52af36a539e335dc82d296e
SHA512 e3e4dbf0f741230a0d45a373e571d69d3b6a0f7d644612009e17cc0d7777854582286362f7930f1fd4c54416207dd01f792b70a45c605979bd72f83d84a27f9d
SSDEEP 49152:fAfssXMt7Kj3e/0vaw+BQUb3DMrryH4wODoNxp:fSs/SvYQUPqwODWz
MD5 SHA1 SHA512 SSDEEP

Download

clientudid.dat

Path /storage/emulated/0/Android/data/com.snssdk.api/cache/clientudid.dat
Size 36B
SHA256 123c433394c1aee10b33125d6cbb197bc54855a536a88567e68b257a55c5a534
MD5 cc8d694c16beae421742400be2b59725
SHA1 94dcfc432e1569d2030e54914c8194e7ad5540c6
SHA512 f3402e8ea8d3afa983e2f409ca12144bc9f44789b64d04d426efee1ac4967971b5b9449cb4bac771b90ff98c46de9cae821a0a8d0f07243b56ce25364d84133b
MD5 SHA1 SHA512

Submit Download

5ac714da7be6d534dd74c84a097f98e0

Path /storage/emulated/0/com.tieniu.lezhuan/config/5ac714da7be6d534dd74c84a097f98e0
Size 344B
SHA256 11e46fbbe530ec0e8405fbf05a12ccbe41a71d07a5a8375c3d3fd1cc5c85c4c4
MD5 81c233ab39a49c5e1804695652694a44
SHA1 bf4f2988a1c6c395c13540e2bf28bf2fa4f9eb1b
SHA512 d8f4be78a6ac599f81824722d47a93a387e09d01bee21faa47def64ddd14cc2d1efc6529bcbcd8fc92012658c6a27fe2cb02cf85ecf6deb7b9c2ca1699c618bd
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads