Analysis
- max time kernel
177s - max time network
190s - platform
android_x64 - resource
android-x64-20240611.1-en - resource tags
androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system - submitted
14/06/2024, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
a7c5c395bd3f189abf1c1cc8f317dfbf_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
a7c5c395bd3f189abf1c1cc8f317dfbf_JaffaCakes118.apk
Resource
android-x64-20240611.1-en
General
- Target a7c5c395bd3f189abf1c1cc8f317dfbf_JaffaCakes118.apk
- Size 20.0MB
- Sample240614-demyqasfpg
- SHA256 e62312465dd2741095e793c14ae5ed2888b3473aa081901350e64c38f615d984
- MD5 a7c5c395bd3f189abf1c1cc8f317dfbf
- SHA1 dba542a4537bdcd243d95b2092ea1abb0d68800b
- SHA512 0b737853f651ca0da2425fb726c0af8f6f0e012fdadcb6f752c85c00cb82af2ec706dc7a94126bc7cde3c68bd8c103c2c878002548350e9f2dd781c873aa731e
- SSDEEP 393216:oftPVYMDXhVlIlKa/KENAtLrdAfj+AWK/apGWPiUvKTuYPYrbTrJX3yuk74map:rMDFIlKmKqgvWfj+AqfPuTuYaRCuk7S
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Queries information about running processes on the device 1 TTPs 4 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.android.yxkaola Framework service call android.app.IActivityManager.getRunningAppProcesses com.android.yxkaola:download_server Framework service call android.app.IActivityManager.getRunningAppProcesses com.android.yxkaola:jpush Framework service call android.app.IActivityManager.getRunningAppProcesses com.android.yxkaola:channel - Requests cell location 1 TTPs 2 IoCs
Uses Android APIs to to get current cell information.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.android.yxkaola Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.android.yxkaola - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.android.yxkaola - Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.android.yxkaola:channel - Queries information about active data network 1 TTPs 3 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.android.yxkaola Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.android.yxkaola:jpush Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.android.yxkaola:channel - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.android.yxkaola - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.android.yxkaola - Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.android.yxkaola:jpush Framework service call android.app.IActivityManager.registerReceiver com.android.yxkaola - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.android.yxkaola - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.android.yxkaola - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.android.yxkaola
Processes
-
com.android.yxkaola1⤵
- Queries information about running processes on the device
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5177
-
com.android.yxkaola:download_server1⤵
- Queries information about running processes on the device
PID:5222
-
com.android.yxkaola:jpush1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5312
-
com.android.yxkaola:channel1⤵
- Queries information about running processes on the device
- Makes use of the framework's foreground persistence service
- Queries information about active data network
PID:5597
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.android.yxkaola/databases/MessageStore.db
- Size 36KB
- SHA256 263bb95aa091dacd20b8b206a58cde6abd13fe26f69714b4e9203417279f1dad
- MD5 b4d1037afca4357a8d0e6216c8dde758
- SHA1 8f4994fe75ff727f5aa51979db60afa1c00b583a
- SHA512 8183ab9719bd0f6b059899ab33106a5fa636e994fd90aea6445a3f364d6cf9ab4fa5772012609b6d4c812801a57c0c8f2866dbea08ddf2066a6fe7802b939e54
- SSDEEP 12:TL+W3ZMA7X2EkamDfVcsg1jWuZyemKiayjlApcGo/0XyNTSFbyc34wyACumRmBEd:TL/3ZM6PzmD6ZW/elJy2M0yAN9GSgG1
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.android.yxkaola/databases/MessageStore.db-journal
- Size 12KB
- SHA256 f5ec22609f1b794cd2b648a5c89d1d0802f34cc61d810156dfa82a94be496a06
- MD5 635d63f09bde5ed811470da250b92668
- SHA1 31d60242e4f03e9a4cedf675aedaeca44bcdd5ae
- SHA512 1e096754a61ea5d662fad605588c2dd17c30ff3f82dad64dd517d905322325f7ed88c66f25804d4d0c7914ef7556821fdbef0a2deb68ec16314c762c9204e11d
- SSDEEP 24:7+tyEYqLvZM6PzmD6ZW/elJy2M0yAN9GSR:7MxYqtM3d2M0yIoSR
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.android.yxkaola/databases/MessageStore.db-journal
- Size 512B
- SHA256 39938297c8b5b5ac580c7728afe2ed74d09f58cdb002e2c7c4bb7d28eb9cf3a4
- MD5 f12ebcc813ea9c06d07a60adfb7e87cb
- SHA1 f4cc4e7d816a162c68df0cb96a89d9e9831ec6e4
- SHA512 fe560ab6f3afbbf5706588b9254984ad4eb956c8a73179709cb365fcf6b45c27a6e4f5d4529584458b7099f039f859d38a22781f8aa3bf7809cbffbc3714bacb
- MD5 SHA1 SHA512
- Path /data/data/com.android.yxkaola/databases/MessageStore.db-journal
- Size 8KB
- SHA256 a634029fc6761e05e4d68ee4c1d426fe387cc59266f85ba92c58dd1f143db682
- MD5 19e23bcc1faa4d9905e90543a9d5da14
- SHA1 5fd1abffe3c23c75b65185b9308fa67862b44bc7
- SHA512 1ba291b73185b1d35df309d5ad7a97cc41cec58d2b5cf13ea6ed31550de2e2c7467e13a2714ec7c9fd9b433a61d9e7075aada9820d0bdc9189522ed43aea4260
- SSDEEP 6:7+/l9j8Hn1q2sWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKm:7+tdSsWqLiuWdwRmBEyPbd
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.android.yxkaola/databases/MessageStore.db-journal
- Size 8KB
- SHA256 c1bd519c2321a9b225dd1fd097dfbec30f80450bcc2a8176ecc5199fd073b3d3
- MD5 77033ec7319ee0d25a89a714c6777840
- SHA1 da68bb33ecf1005bcf5de60471b17bc9e12fd790
- SHA512 105a9ed4ab0fde057859faeb0524fe6d9b4dc900eecc7280f9714c1d29a4cc5cd2bd54eb337003c8037e192cb9093970b723ab1d203245941effc6b4cfa8de33
- SSDEEP 6:TM3iWT1jopLMuYnX7IC+TZLiYhyVqNcT6xg9bNFlLdrlOERX4PBX4ogLugMBX4sY:TM3ii1TXMfpNc2xqLJdTRmBEyPbDFO
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.android.yxkaola/databases/MsgLogStore.db
- Size 48KB
- SHA256 286fe14ca18d33958362bd374736a9d25ed8a527b9ae43775cd071abe0564e24
- MD5 d2afe5d22e347cc66d7ca5bfddbe911a
- SHA1 af5769430759496979c9b6efb88b68bf2476d719
- SHA512 8a37955581717e88a023cbfc35294aef1403fc3c5dbdf53cd8a7f761e45521b501cd2f81ecb84621c341eb00a1e18e8da48395de076289ae21610c99b7f02418
- SSDEEP 24:TLXrYVvJ0fiyts/fuLBzbx6JNGGSgIee:T7iJHUyS
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.android.yxkaola/databases/MsgLogStore.db-journal
- Size 512B
- SHA256 59798059a5c1648cfb9ad4e37d0427ca897b217212b45f53d70c4f48f68d345b
- MD5 50f30885f1ea9ebc6d8131cd2a03f75b
- SHA1 6ce0f234465dbece99668e6ad1dd560211436d2f
- SHA512 19fbaa871ece92fed9dca279909cc3242c501ef247f8119797113d07de9993112162963cbae7ccdcc417d28169c47dea493b5bb86eba0a04cd04a3a6ccd452ec
- MD5 SHA1 SHA512
- Path /data/data/com.android.yxkaola/databases/MsgLogStore.db-journal
- Size 8KB
- SHA256 6d26cbb87ca8e647b0af3902ea816a15e9cfc32380964d0bb8389758c9e2c739
- MD5 41996bd5bff0769db2fdd53e7faf45f7
- SHA1 a479ae940fd4d9125467e1e97f872649612a0141
- SHA512 dd9672481d7fd8d338a116f710964aa82bd9fcaaf2d0f458b4dd2beec22ebd632cb6099252f87268137ee6f0d349efe1e45845b604293f356edfba41fa9d189e
- SSDEEP 6:TM3iWT1jopL6LDYhyVq93avB1Yg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK6k:TM3ii1Jmp9qv0qLiuWdwRmBEyPbG
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.android.yxkaola/databases/MsgLogStore.db-journal
- Size 8KB
- SHA256 eae220d270ecae89b6939593ab12aab92457a83ae48143496ba08b133d87bbc6
- MD5 a9a43c844a26586a54f04dd2404d2a49
- SHA1 c8b2c077d2842ac2d9448f586ddfbaf3f2d18546
- SHA512 1a2a95f9703012cde8a72b96abb5490741313375e7af368a0de348c2d76fd4b697a60060c71b0963b12f88c5ee26b7adc86dcbe88e9cba8336ef0015abbc0932
- SSDEEP 6:7+/l9xonn1Wkg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKqn:7+tkNqLiuWdwRmBEyPbbn
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.android.yxkaola/databases/accs.db
- Size 20KB
- SHA256 58e0eeb309805e54342d5ccb3f9006751543d5a1306898dad2c09048b294153c
- MD5 d95e1280cc553509d7b5b7851398db12
- SHA1 121eb76ea37f3407d0f3b56392f6f67893fbe649
- SHA512 f52c432894144ad581d36d447ed61ac50485dbc931ddd9b2ba5ce399642dcb361502e6492f28e05dc7cdbd5f19126bbc6cc09e62586b73bf449da950a6de1284
- SSDEEP 12:TLgm//UyNTSFbyBh43R90Ef7c7VDERmBEyPbAVOwG:TLgoBqj0W7yVD/GSEG
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.android.yxkaola/databases/accs.db-journal
- Size 512B
- SHA256 1bf829b6342295ba3759e48baa03548fe887c21124600e6a014bd8150c65d529
- MD5 d122de8c5897df71a9a0041a5da4a072
- SHA1 df42ec9426b0945f67388caf5f641fe96e258b65
- SHA512 6ccf1ae1db14a22675ea91f11cc521d93215c099dbe82aca2a1221708b97fa0080846c7c97e6326efb07d873e77e0cf328ae4edebc935315d126d37bfe945902
- MD5 SHA1 SHA512
- Path /data/data/com.android.yxkaola/databases/accs.db-journal
- Size 8KB
- SHA256 06171fdd19b67a2c2fa86f890e04f079bcf4158e798c31d42a12099221670c25
- MD5 d010852bc0e58b3c85e4529f3d3e42bd
- SHA1 033558321467b80d061aa00d1ea24fc7a3cee63c
- SHA512 fb4531882d2c0eaa00e8d106ae298cd466b86495daca53e1f80273140065df1d03d1e60dc650a576f0f7de17d5e44371f1b22613d694c65240b5f6ec0257006b
- SSDEEP 6:7+/l9dGn1Mufg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKM9n:7+thufqLiuWdwRmBEyPbL
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.android.yxkaola/databases/accs.db-journal
- Size 8KB
- SHA256 24af01461434e1a9647b826ffa4e40ff7fa48cba72bdc3f7d1bbbe7a7b1dbd90
- MD5 e64e99c8fc7cc1cae5a5543bf41358f3
- SHA1 d6c8db475a2f05ee20dcb63bbe0dc5df9263eaab
- SHA512 e97f4954ac836a99af730d12430af48b5b9db5ee4f345498ffcd4437093f829f478895cfbc9006e9620222d5f7e693a512a980a32217bd80fcfc8badafe55566
- SSDEEP 6:7+/l9h3qFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK0V/Gt/Dn:7+tXAqLJdTRmBEyPblO1Dn
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.android.yxkaola/files/AntiCheatingLock
- Size 1B
- SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
- MD5 55a54008ad1ba589aa210d2629c1df41
- SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
- SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
- MD5 SHA1 SHA512
- Path /data/data/com.android.yxkaola/files/td_database0TalkingData/1718333751410_5177
- Size 1KB
- SHA256 dbfb7f74da51794f0b293bf03712f34670e8618fc4ef440c37656159ab29cae6
- MD5 04aa4df675ca25615e18a1cb8d7106c8
- SHA1 b1c29cd44195e1b1fe2b0eafbb3a9ff8caa9d714
- SHA512 df2746552f44295e0674648ae61b338c35233d597d95df1dabe94b59298af0428644b978e288be57ece2836ecf2b9bef65b54d187cb69f2c20a6bf105c8ccc08
- MD5 SHA1 SHA512
- Path /data/data/com.android.yxkaola/files/td_database0TalkingData/1718333751599_5177
- Size 13KB
- SHA256 78baf8199568c11d1a72e1657fc6f8d5ec8d8fb9844f8403a412bc6c3de4db09
- MD5 5f685cf465baa7ad60112b864a7cdc9e
- SHA1 d4eb7730beea081bfa490027278258db0e4719fe
- SHA512 7f2db2dac7f06b4a99fe159434b6fd643c673d765c726d37a3e5cb7bfa26098422be1f0e4ffeacaa716174cc22cf2dd49a199117c0367c5bc9828556a1d1851a
- SSDEEP 192:r+X9mtx6EGTtwIKTg3MZLVD5f6uVjUkGwOpq0gnmIwHaNNigabeoHTq33TAkrxtW:6NhaIfMZL55yGjbO00y+moHTQTry
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.android.yxkaola/files/td_database2TalkingData/1718333751280_5177
- Size 1KB
- SHA256 12d8c427ec8d6d43a02f809d07a73ba7a6d7391aed67292745c5f0d49edaf13c
- MD5 3e16bc6a2308114caa9f33a9bfd62e91
- SHA1 d40f42e87543b32fc4d0041b6705f4a126b9fbda
- SHA512 7fde29e7e4d3b88e852a2fdd07b1f724ea71a119ce664d2de2669dd6c455595a0cab28d03ee71ecf3d8c0ccd3ceac2b49056f1e7f0f7bf3f270dc6e078971786
- MD5 SHA1 SHA512
- Path /storage/emulated/0/.DataStorage/ContextData.xml
- Size 65B
- SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
- MD5 9781ca003f10f8d0c9c1945b63fdca7f
- SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
- SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
- MD5 SHA1 SHA512
- Path /storage/emulated/0/.DataStorage/ContextData.xml
- Size 111B
- SHA256 6bffbb60d48c2b7bc746604ac27f5410387a994989b2cc81ffaf3d9a335537c1
- MD5 20d65c0a9a6a8daac16429ae4fd8208d
- SHA1 990234d0c1ea598a1e0b0f5f1af1afdd3eb6d8fc
- SHA512 1f88c69d33cd8e01b430dbf1384f7d3bae2febd5185feab0881583078a5dd33ba821bb8b989bdd9f7a356fa99f22564b3219c4c1cb175647a6b47ef8d100b082
- MD5 SHA1 SHA512
- Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
- Size 167B
- SHA256 b9ca3334d4476bfc8511d9afd677d322203531f9f07a56e4daa6b26fb38877da
- MD5 d91163a3cc60cdbca1faa131f1f003e2
- SHA1 a820b50e992d2d7e069b483a853551bd1307f97e
- SHA512 5fbee81c10c052a258d86eb7b05ca71517d82f214ecd662921e2e4b5ea539c5dddeac763628bf851569a3a8c5f1530527763e1efada3502fd5babb9ffcef0e9f
- MD5 SHA1 SHA512
- Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
- Size 167B
- SHA256 f5908bafbe9db8a067f5ed32001c5455b57def030bffb0370b3200e390c1c979
- MD5 3473576bb9e8d832ffd4d71a8aa2aa44
- SHA1 a0cf709454e2e0ae8ed0ae126889dbd161c135a6
- SHA512 ef3108737c4252666a9838eb9a1695628a66775f1cbb450f90650a615dff3188d96a3602323b7604431540a6e2c20b69db9b51ccb7c26a24b78e486fb1aac921
- MD5 SHA1 SHA512
- Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
- Size 8KB
- SHA256 e94d7fad24821bd2855bf3c15442a94a8308fca6176c0bd22a4ffc19969ed557
- MD5 df4d98fcf6ea7891bf5daa6b34e081d6
- SHA1 0aaee0cc589a848d48706d555462f6311104d697
- SHA512 4c387fe29e7e6a5f3260a07d88f6e9128defa852aa272f141710a7d6c90e968bb5b68d64b7798504b68e22e82e3ace9952c8ebf581888a4029f8738ec433d832
- SSDEEP 6:7+/l9zs4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKnM/A:7+tZvqLJdTRmBEyPbzA
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/.tcookieid
- Size 33B
- SHA256 1f547391c1e41db71d1ce5b07917d5c62dbeefb09bbaa78fc9433f31e36ade42
- MD5 209dca0a8d378f499277b6820e1f6f58
- SHA1 f14db70831940f584d6e44496f05e9e96ce58b68
- SHA512 a21ca973b62e39a1710d3a2f61ffbbdaa789cafd9f9a70ed85591e498037d74ad0347adac34d8f8212f9a17628d064fc22b4b4708276cce7833db0272965295e
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Android/data/com.android.yxkaola/files/tnetlogs/inapp_20240614.log
- Size 37KB
- SHA256 943273d7b31f47550c767749ed0d6d6e8c93d2f56134acbb969368114dda8316
- MD5 f5ec1da68330386c7f7be012b93e301e
- SHA1 572e848a77fdd01cde114a09c9ce038735863f11
- SHA512 798bd5b5b583184eccd05bd4517d73d47f7f89694d79dc575f32b3071a7529917464b0c1ddf5c565fb079068364f4f550e79a969bc31329926bfc2cb67b16280
- SSDEEP 96:oCt5phXwaM1OllOGJvyJqPtiqbtyOEFDF0PTZaG0m21a:Jpua5lFvAqF7btQFaPCm5
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/QICloud/OpenBox/2024-06-14.txt
- Size 132B
- SHA256 eb76e2160eb3a8b06138dd1575d09381380accbac2d0b9bf593ae38f06639d00
- MD5 71dada3e510d1a1b003a9e02cd34cb5d
- SHA1 2f02728f471fc3dcf96636aa5e737437a8edc0ce
- SHA512 939f208f7e4d98ea86ee3e9d06b5ed92f63830daac5359fdcdafe634c733510e73d2bcf7248bf50afa64ab04b416a4d6b72ae358698f985fc10c6f9a1627f5d5
- MD5 SHA1 SHA512
- Path /storage/emulated/0/QICloud/OpenBox/2024-06-14.txt
- Size 55B
- SHA256 886f87ab07d32e5754329fd16971f51797e793686b28b75f57c078be770890de
- MD5 e3068e0af12ea9c43d90b97ab9c0d487
- SHA1 84af2f8b32e62926c4ef9ff68c5caad56d61bb09
- SHA512 117bbcd960342864d41e4a0952ea7c7cd553361ce5b7a86dac7bea7c2b063170b2b60f9e4b1e0602547dd4bcf51086f14426bfce316776054cb441533c2a2f88
- MD5 SHA1 SHA512