Analysis

  • max time kernel
    179s
  • max time network
    187s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    14/06/2024, 04:33

General

  • Target
    a804b0b5d7ad2571faf52cf15b3f23db_JaffaCakes118.apk
  • Size 14.8MB
  • Sample240614-e6w65sygpq
  • SHA256 b98cc355f223d25ac12c9bb565707c476ba352f194ac92f7afffaa721f5dddb5
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.yxxinglin.xzid27931
    1⤵
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4296
  • com.yxxinglin.xzid27931:pushcore
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4324

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1004

        • Path /data/data/com.yxxinglin.xzid27931/app_crashrecord/1004
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512

        1004

        • Path /data/data/com.yxxinglin.xzid27931/app_crashrecord/1004
        • Size 72KB
        • SHA256 1db62e662a0c908871951ab6fa92fbee305aa8526f6bfcce6163539f9534f80d
        • MD5 SHA1 SHA512 SSDEEP

        1004

        • Path /data/data/com.yxxinglin.xzid27931/app_crashrecord/1004
        • Size 230B
        • SHA256 17e6f6d4e4b82e452ba9b70c447c966eb89afae55af58587b973182348d90560
        • MD5 SHA1 SHA512

        1004

        • Path /data/data/com.yxxinglin.xzid27931/app_crashrecord/1004
        • Size 58B
        • SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
        • MD5 SHA1 SHA512

        1004

        • Path /data/data/com.yxxinglin.xzid27931/app_crashrecord/1004
        • Size 239B
        • SHA256 5ba0a2ef8d2cfd8ab8ec10f6f8efef4f10b5c72e3388940b78d944bb91003763
        • MD5 SHA1 SHA512

        bugly_db_-journal

        • Path /data/data/com.yxxinglin.xzid27931/databases/bugly_db_-journal
        • Size 512B
        • SHA256 b07ffd062f24f1d26bb5d8b762611c971435048f78e1b20dd923389bddc6d911
        • MD5 SHA1 SHA512

        bugly_db_-shm

        • Path /data/data/com.yxxinglin.xzid27931/databases/bugly_db_-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        dso_deps

        • Path /data/data/com.yxxinglin.xzid27931/lib-main/dso_deps
        • Size 152B
        • SHA256 d9c938ad69b1acb5f85afe8d7b8837d3ce332060f5828a8d20832c9dfd48e53f
        • MD5 SHA1 SHA512

        dso_manifest

        • Path /data/data/com.yxxinglin.xzid27931/lib-main/dso_manifest
        • Size 5B
        • SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
        • MD5 SHA1 SHA512

        dso_state

        • Path /data/data/com.yxxinglin.xzid27931/lib-main/dso_state
        • Size 5B
        • SHA256 34149b53d6b1f28d003da7037ec02c5d18e6cb8b99d85445d5aa020483db8fe8
        • MD5 SHA1 SHA512

        dso_state

        • Path /data/data/com.yxxinglin.xzid27931/lib-main/dso_state
        • Size 1B
        • SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
        • MD5 SHA1 SHA512

        .push_deviceid

        • Path /storage/emulated/0/data/.push_deviceid
        • Size 32B
        • SHA256 beade2476447f87b4a638f072b06d6caa13d846e9e2303e78fff6928c6cf6657
        • MD5 SHA1 SHA512