Analysis

  • max time kernel
    177s
  • max time network
    190s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    14/06/2024, 02:55

General

  • Target
    a7c5c395bd3f189abf1c1cc8f317dfbf_JaffaCakes118.apk
  • Size 20.0MB
  • Sample240614-demyqasfpg
  • SHA256 e62312465dd2741095e793c14ae5ed2888b3473aa081901350e64c38f615d984
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Queries information about running processes on the device 1 TTPs 4 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Requests cell location 1 TTPs 2 IoCs

    Uses Android APIs to to get current cell information.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 3 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.android.yxkaola
    1⤵
    • Queries information about running processes on the device
    • Requests cell location
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5177
  • com.android.yxkaola:download_server
    1⤵
    • Queries information about running processes on the device
    PID:5222
  • com.android.yxkaola:jpush
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5312
  • com.android.yxkaola:channel
    1⤵
    • Queries information about running processes on the device
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    PID:5597

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MessageStore.db

        • Path /data/data/com.android.yxkaola/databases/MessageStore.db
        • Size 36KB
        • SHA256 263bb95aa091dacd20b8b206a58cde6abd13fe26f69714b4e9203417279f1dad
        • MD5 SHA1 SHA512 SSDEEP

        MessageStore.db-journal

        • Path /data/data/com.android.yxkaola/databases/MessageStore.db-journal
        • Size 12KB
        • SHA256 f5ec22609f1b794cd2b648a5c89d1d0802f34cc61d810156dfa82a94be496a06
        • MD5 SHA1 SHA512 SSDEEP

        MessageStore.db-journal

        • Path /data/data/com.android.yxkaola/databases/MessageStore.db-journal
        • Size 512B
        • SHA256 39938297c8b5b5ac580c7728afe2ed74d09f58cdb002e2c7c4bb7d28eb9cf3a4
        • MD5 SHA1 SHA512

        MessageStore.db-journal

        • Path /data/data/com.android.yxkaola/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 a634029fc6761e05e4d68ee4c1d426fe387cc59266f85ba92c58dd1f143db682
        • MD5 SHA1 SHA512 SSDEEP

        MessageStore.db-journal

        • Path /data/data/com.android.yxkaola/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 c1bd519c2321a9b225dd1fd097dfbec30f80450bcc2a8176ecc5199fd073b3d3
        • MD5 SHA1 SHA512 SSDEEP

        MsgLogStore.db

        • Path /data/data/com.android.yxkaola/databases/MsgLogStore.db
        • Size 48KB
        • SHA256 286fe14ca18d33958362bd374736a9d25ed8a527b9ae43775cd071abe0564e24
        • MD5 SHA1 SHA512 SSDEEP

        MsgLogStore.db-journal

        • Path /data/data/com.android.yxkaola/databases/MsgLogStore.db-journal
        • Size 512B
        • SHA256 59798059a5c1648cfb9ad4e37d0427ca897b217212b45f53d70c4f48f68d345b
        • MD5 SHA1 SHA512

        MsgLogStore.db-journal

        • Path /data/data/com.android.yxkaola/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 6d26cbb87ca8e647b0af3902ea816a15e9cfc32380964d0bb8389758c9e2c739
        • MD5 SHA1 SHA512 SSDEEP

        MsgLogStore.db-journal

        • Path /data/data/com.android.yxkaola/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 eae220d270ecae89b6939593ab12aab92457a83ae48143496ba08b133d87bbc6
        • MD5 SHA1 SHA512 SSDEEP

        accs.db

        • Path /data/data/com.android.yxkaola/databases/accs.db
        • Size 20KB
        • SHA256 58e0eeb309805e54342d5ccb3f9006751543d5a1306898dad2c09048b294153c
        • MD5 SHA1 SHA512 SSDEEP

        accs.db-journal

        • Path /data/data/com.android.yxkaola/databases/accs.db-journal
        • Size 512B
        • SHA256 1bf829b6342295ba3759e48baa03548fe887c21124600e6a014bd8150c65d529
        • MD5 SHA1 SHA512

        accs.db-journal

        • Path /data/data/com.android.yxkaola/databases/accs.db-journal
        • Size 8KB
        • SHA256 06171fdd19b67a2c2fa86f890e04f079bcf4158e798c31d42a12099221670c25
        • MD5 SHA1 SHA512 SSDEEP

        accs.db-journal

        • Path /data/data/com.android.yxkaola/databases/accs.db-journal
        • Size 8KB
        • SHA256 24af01461434e1a9647b826ffa4e40ff7fa48cba72bdc3f7d1bbbe7a7b1dbd90
        • MD5 SHA1 SHA512 SSDEEP

        AntiCheatingLock

        • Path /data/data/com.android.yxkaola/files/AntiCheatingLock
        • Size 1B
        • SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
        • MD5 SHA1 SHA512

        1718333751410_5177

        • Path /data/data/com.android.yxkaola/files/td_database0TalkingData/1718333751410_5177
        • Size 1KB
        • SHA256 dbfb7f74da51794f0b293bf03712f34670e8618fc4ef440c37656159ab29cae6
        • MD5 SHA1 SHA512

        1718333751599_5177

        • Path /data/data/com.android.yxkaola/files/td_database0TalkingData/1718333751599_5177
        • Size 13KB
        • SHA256 78baf8199568c11d1a72e1657fc6f8d5ec8d8fb9844f8403a412bc6c3de4db09
        • MD5 SHA1 SHA512 SSDEEP

        1718333751280_5177

        • Path /data/data/com.android.yxkaola/files/td_database2TalkingData/1718333751280_5177
        • Size 1KB
        • SHA256 12d8c427ec8d6d43a02f809d07a73ba7a6d7391aed67292745c5f0d49edaf13c
        • MD5 SHA1 SHA512

        ContextData.xml

        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512

        ContextData.xml

        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 111B
        • SHA256 6bffbb60d48c2b7bc746604ac27f5410387a994989b2cc81ffaf3d9a335537c1
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 167B
        • SHA256 b9ca3334d4476bfc8511d9afd677d322203531f9f07a56e4daa6b26fb38877da
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 167B
        • SHA256 f5908bafbe9db8a067f5ed32001c5455b57def030bffb0370b3200e390c1c979
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 8KB
        • SHA256 e94d7fad24821bd2855bf3c15442a94a8308fca6176c0bd22a4ffc19969ed557
        • MD5 SHA1 SHA512 SSDEEP

        .tcookieid

        • Path /storage/emulated/0/.tcookieid
        • Size 33B
        • SHA256 1f547391c1e41db71d1ce5b07917d5c62dbeefb09bbaa78fc9433f31e36ade42
        • MD5 SHA1 SHA512

        inapp_20240614.log

        • Path /storage/emulated/0/Android/data/com.android.yxkaola/files/tnetlogs/inapp_20240614.log
        • Size 37KB
        • SHA256 943273d7b31f47550c767749ed0d6d6e8c93d2f56134acbb969368114dda8316
        • MD5 SHA1 SHA512 SSDEEP

        2024-06-14.txt

        • Path /storage/emulated/0/QICloud/OpenBox/2024-06-14.txt
        • Size 132B
        • SHA256 eb76e2160eb3a8b06138dd1575d09381380accbac2d0b9bf593ae38f06639d00
        • MD5 SHA1 SHA512

        2024-06-14.txt

        • Path /storage/emulated/0/QICloud/OpenBox/2024-06-14.txt
        • Size 55B
        • SHA256 886f87ab07d32e5754329fd16971f51797e793686b28b75f57c078be770890de
        • MD5 SHA1 SHA512