fc40e73f95616eaa81b98a97e2db38fb1c67143fe09e2f674f7536ad397f293b

Analysis

max time kernel
7s
max time network
165s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
14/06/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a787548dde1a38f8a062d8f608fa8b22_JaffaCakes118.apk
Size 13.3MB
Sample240614-bvh9cstdlr
SHA256 fc40e73f95616eaa81b98a97e2db38fb1c67143fe09e2f674f7536ad397f293b
MD5 a787548dde1a38f8a062d8f608fa8b22
SHA1 93591a210e14e30c564557f66e6fb053a08b62d4
SHA512 1dbd28d1c52c2323335794852786bb49b8eb97111c8cf9dc166be5b1ad4f982792b08f7e20e68337fca9fd0bb3972a1c6ef1cda8adfb1d63c588a83f580b8419
SSDEEP 393216:rIGlqjvGSotGj7H2xQbFJj2pDz1IzoqJrAGmG6:rIN0G/H2aJUDJIzoqdH6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.bootmode	com.tieniu.lezhuan

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tieniu.lezhuan/.cache/classes.dex	4482	com.tieniu.lezhuan
/data/user/0/com.tieniu.lezhuan/.cache/classes.dex	4482	com.tieniu.lezhuan
/data/user/0/com.tieniu.lezhuan/[email protected]	4482	com.tieniu.lezhuan

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tieniu.lezhuan

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.tieniu.lezhuan

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tieniu.lezhuan

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tieniu.lezhuan

com.tieniu.lezhuan
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4482

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37CF018B.dex

Path /data/user/0/com.tieniu.lezhuan/.00000000000/37CF018B.dex
Size 48KB
SHA256 c433c8e3f847da2b98ee8b704ea3b7d0f38d6249626dfe26a22bef0c08e5fa71
MD5 75d46252620a12dd7343e91c8ba209bb
SHA1 6615b67e21963e5689685f8494f442dcd729d4d1
SHA512 9ae5f0ae0a77bc8c9a27a43252ba01d4bbb69a326eb028d2e887d701b202b66a7065765f2f0214d2b0701493634ff33c2104becdb80bf7e8c2657175857b7af8
SSDEEP 768:S+kN3Frp+DG1P9hHLshodDXDp4htUGE3+cru2lR120gp3IVH8a9/G/BVRhBA:SLlFrp+Di91o+jYk33OI1F8bBA
MD5 SHA1 SHA512 SSDEEP

Submit Download

37CF018B.dex

Path /data/user/0/com.tieniu.lezhuan/.00000000000/37CF018B.dex
Size 48KB
SHA256 26fd97dcb56a0ae4ffee7b9514cb697de101ad39e3b2af2933b1eadf409b740e
MD5 4e93a7a07efedcc6e3c741526d2d89a7
SHA1 e25833d7a51783c17978a7c5e7953d7cf1df80f5
SHA512 94a5e0b50c0efc69b79fe9b46513537b798a45d00234a7fe1c529e7d5eb153704ec9966a0e0819983f726260579707d7b82e7b31f845fa7602e06c078b98319f
SSDEEP 768:UPCXMYnJAwf6VsN1IDQNMQZko817lnFxg62z2QcyueNaP+h4qRgR:UPIJAwf6VLQaQioo7ln/2YIQmh4sY
MD5 SHA1 SHA512 SSDEEP

Submit Download

classes.dex

Path /data/user/0/com.tieniu.lezhuan/.cache/classes.dex
Size 8.8MB
SHA256 fd1e58d3cbe1c5455b44ba3121714b89b3d2e32ae72091086bf98db568a5310e
MD5 ef6530bcd430bf2fa1052fd8a5b44338
SHA1 56c20246083e6b2701082a88d009ccb94818c7f8
SHA512 fc6b510fe0830716562ef4410d7afdb4dd41e735b7d70de65167d50f1e564f951f0a7deb3a34230e3822342c38f7c17b933cbadb1b90805a2bcb335209a84bd6
SSDEEP 98304:sePMb5Wt6drw3VvihvC0i/DVHbymeHK623v4d2Xfwv:sAMb5Tw3VviIVHbymJ42vwv
MD5 SHA1 SHA512 SSDEEP

Download

classes.dex

Path /data/user/0/com.tieniu.lezhuan/.cache/classes.dex
Size 3.5MB
SHA256 398766e9425b7b36aa611e37eeb92a46b78e32e6e520cfb67228c2e123eb6bcc
MD5 9b22b4707bab4e8b1d3ba73f8217c8d3
SHA1 9af93dac3abc6167c52af36a539e335dc82d296e
SHA512 e3e4dbf0f741230a0d45a373e571d69d3b6a0f7d644612009e17cc0d7777854582286362f7930f1fd4c54416207dd01f792b70a45c605979bd72f83d84a27f9d
SSDEEP 49152:fAfssXMt7Kj3e/0vaw+BQUb3DMrryH4wODoNxp:fSs/SvYQUPqwODWz
MD5 SHA1 SHA512 SSDEEP

Download

1004

Path /data/user/0/com.tieniu.lezhuan/app_crashrecord/1004
Size 228B
SHA256 09a3a4b368a027e44e027c547091391d10f3ab506b01610db4ce7e40567d98c3
MD5 b1f3f8f76b326a9f5e635d8908fdf064
SHA1 2b698dcea405d178bb8ccdd9908b9e6ff8d212d4
SHA512 4a27c479c2d3a03037e78ae4dd18cc07599187cfb5541f1167466f581f1215717cf4611fb555c9a9d6ea90b9724f0eba579b6a471c45aec9cc5f351b5ef34904
MD5 SHA1 SHA512

Submit Download

1004

Path /data/user/0/com.tieniu.lezhuan/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

bugly_db_

Path /data/user/0/com.tieniu.lezhuan/databases/bugly_db_
Size 52KB
SHA256 50a0b2c070f101bedc819e3f46a0a20c0e270db0512cabc57be9b77678dcb972
MD5 ce81dd06c1902ad1c65ef4b710b5d089
SHA1 0179edaca200921f8db940f1262271fb0fedbf66
SHA512 fda8b1536d4fdd27a802ec248af1087ffa1418511b315432e90969409b07a96f624389e07c6d786832e1e00ce9b69e826bdbd3471e118b24153ba04cb246f5b3
SSDEEP 48:TgX85WuAriStwwuMN5meposSRja9gOStCi9cpcUK:F53Azwx4p+39cyUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.tieniu.lezhuan/databases/bugly_db_-journal
Size 512B
SHA256 cc3d1fe2bebfc09ca3929c5840a8d28fe0faf1face30abaaba6017fda9921018
MD5 2d49c556266885cd41e55f8faa972e97
SHA1 a73dc5442a0b8177d2cd67798e23cdc0486eb174
SHA512 5536246617ee905268dacf34b798e8a6d3e521a30356167740319c09985a68e4f007bace0186ef1fc9ffbf38510fa05ae0639d57e58c09d96da0fea35c9cf43a
MD5 SHA1 SHA512

Submit Download

bugly_db_-journal

Path /data/user/0/com.tieniu.lezhuan/databases/bugly_db_-journal
Size 8KB
SHA256 3d146f05e5ce510f646f703cead23da8c82932dc2be20fb473c8667a195238f6
MD5 7a1f620710b45b9a001ba51edf2b868c
SHA1 a3b615318d663d425acbf6c9d8c2f0988d35a7f7
SHA512 76ad98f5e6e4b583fc6d07218fe0a440e0c367b01553b9a64282fc610775158fdc5d3ada5ae9aeba13c362fe229860fdfa0b61606edec8f534dbefb235559df2
SSDEEP 6:7+/l94n1fvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKk:7+tUqLiuWdYRmBEyPbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.tieniu.lezhuan/databases/bugly_db_-journal
Size 8KB
SHA256 8bab50408b0b9f7ac0e11c290d7bb7448471b1ab73fa8a74660f180d3fdd8e38
MD5 57be06fecc389096ce378a1562eeadaa
SHA1 f60e8be5b5cf13eb6d8cbaef174587fcd033492c
SHA512 4609c8be222fa5205105b5c715a095ef3fbc3d123394b85753d641e1130cb065c6b0af8f96d5ef8a80201f98fe737b94901a5b1353d23a9af20a4ac5a3678e48
SSDEEP 6:7+/l9OEHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKy/G:7+tUyqLJdeWRmBEyPbZG
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.tieniu.lezhuan/databases/bugly_db_-journal
Size 8KB
SHA256 e510644a24ad09546ae3ab0fe36751befcd9aecc1659a2d6cb97ae46637e0c4c
MD5 fc85ad9aba113dce01d8338d541b9104
SHA1 860da8ecf48bbafd8a6c377143e10d55387a3df6
SHA512 86ebd390c22b5fe1af1b56e157c1c40240728312830ff6fca637f95255b86d1b5ebf95ea2302dbbe5be657facde21d91c6cf73216ca33e6ce7b5fc1af0c0db19
SSDEEP 24:7+tI2qLL4XBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSV:7MI2qwX85WuAriStwwuMN5meposSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

npth_log.db

Path /data/user/0/com.tieniu.lezhuan/databases/npth_log.db
Size 20KB
SHA256 e7a10f4213b91e5144fc5e5d61ea6b81484ec79506ad7f7db35ca992a9634a7e
MD5 8dc03e147a44099e46adcc75eb340610
SHA1 4e087fa92230d55aba4de0ea71719afaa66ec108
SHA512 d823aac6b0f8ecd90106e1b10b8fc5399798dfc09e63729b88b525a8a43ea301fdbc3977eed3a1fd21723c0e1f4c78585db9f9fb3402787eead6c724087d790f
SSDEEP 12:TLmaIqsyNTSFbys3KVD9CU4LCRmBEyPbAVOwG:TLXI01CblGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

npth_log.db-journal

Path /data/user/0/com.tieniu.lezhuan/databases/npth_log.db-journal
Size 512B
SHA256 0e9bc789a4fdf7f5b800fbfba6967f93f23b86c7f0947390c440f62ba9ed903c
MD5 761c0e3571577040ce02f7d623cbb026
SHA1 c64ad7fd462fbb68f92a0cceac6ced9595e72618
SHA512 dd5706a7b5ec7f36568e3845e4b1803d204340355219b278cbc1106711200a9a41e1a6177902390b9272e75cae66110ec0c2457f38104bebebb2f9cfea03e079
MD5 SHA1 SHA512

Submit Download

npth_log.db-journal

Path /data/user/0/com.tieniu.lezhuan/databases/npth_log.db-journal
Size 8KB
SHA256 2293c63e699fb54da024eb589d482ecd08af11aa1455de74eff4d795f5930f69
MD5 0c0f0d446cb1eeff6c032bbe89f4d2cb
SHA1 5f353e3045712e2126b4e55b4af7c892cbde366c
SHA512 36f5e50aac9cb941be28db4b10c994afda5e66b52af326268f14b94f19143b1ef676e7aae3017e2f8fa702c50711dda056c4c28ef22e83ca8fb41e70509aa5f9
SSDEEP 6:7+/l9DOn1rxvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKyn:7+twvqLiuWdYRmBEyPb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

npth_log.db-journal

Path /data/user/0/com.tieniu.lezhuan/databases/npth_log.db-journal
Size 8KB
SHA256 9311aed4210cacdd0cd5389af5382ec5262bc02042c05d074e3ef5c818a1b8c3
MD5 917a59f3c3ab4ca62bdf76708f071a26
SHA1 60b0cac43543848a09937819857ab2a7b27e7336
SHA512 d5bdb7836c6b46e1a603e4f3610fae9bc58980ea5196cf466d7e20d8be754e1864c158cc06b7d50f7137dc5927f05b3b8d7adb31773b04e422b340332d3a362a
SSDEEP 6:LPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKf0//I:DqLJdeWRmBEyPbXI
MD5 SHA1 SHA512 SSDEEP

Submit Download

5ac714da7be6d534dd74c84a097f98e0

Path /storage/emulated/0/com.tieniu.lezhuan/config/5ac714da7be6d534dd74c84a097f98e0
Size 344B
SHA256 11e46fbbe530ec0e8405fbf05a12ccbe41a71d07a5a8375c3d3fd1cc5c85c4c4
MD5 81c233ab39a49c5e1804695652694a44
SHA1 bf4f2988a1c6c395c13540e2bf28bf2fa4f9eb1b
SHA512 d8f4be78a6ac599f81824722d47a93a387e09d01bee21faa47def64ddd14cc2d1efc6529bcbcd8fc92012658c6a27fe2cb02cf85ecf6deb7b9c2ca1699c618bd
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads