Analysis
- max time kernel
179s - max time network
187s - platform
android_x86 - resource
android-x86-arm-20240611.1-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system - submitted
14/06/2024, 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a804b0b5d7ad2571faf52cf15b3f23db_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
6 signatures
150 seconds
General
- Target a804b0b5d7ad2571faf52cf15b3f23db_JaffaCakes118.apk
- Size 14.8MB
- Sample240614-e6w65sygpq
- SHA256 b98cc355f223d25ac12c9bb565707c476ba352f194ac92f7afffaa721f5dddb5
- MD5 a804b0b5d7ad2571faf52cf15b3f23db
- SHA1 da180ac24a7323896a4451fd4e86ecec6b89af36
- SHA512 0008af90fdf2db4ef227a4209cd2f88894a47df5b9b2f3a1368649790630892538943444cfb8245f152624e4979cf3f1d4ac839aa8e8eb659aaabd68941c5166
- SSDEEP 393216:cfI0j9mOHU7HmkMKl4Me37+seU0S4iNZw0B7Iy:CH9Y7HmkFpe3yseBYB7/
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.yxxinglin.xzid27931 Framework service call android.app.IActivityManager.getRunningAppProcesses com.yxxinglin.xzid27931:pushcore - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yxxinglin.xzid27931:pushcore - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.yxxinglin.xzid27931 - Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.yxxinglin.xzid27931:pushcore Framework service call android.app.IActivityManager.registerReceiver com.yxxinglin.xzid27931 - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.yxxinglin.xzid27931:pushcore
Processes
-
com.yxxinglin.xzid279311⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4296
-
com.yxxinglin.xzid27931:pushcore1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4324
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.yxxinglin.xzid27931/app_crashrecord/1004
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- MD5 SHA1 SHA512
- Path /data/data/com.yxxinglin.xzid27931/app_crashrecord/1004
- Size 72KB
- SHA256 1db62e662a0c908871951ab6fa92fbee305aa8526f6bfcce6163539f9534f80d
- MD5 95a1290630203627b37058fd8dfa858a
- SHA1 1be2ec93e1f15beca84b8aeb9194b3f0d5267ac7
- SHA512 2db17a119bdead64eb877af6681abc4b37d3d0a1ce6e16a9f716c999c384463c3b79e0fe038c7ecd212d78a80aba6c8ad3960fbfecf05d69650013346163766d
- SSDEEP 48:XTzNSP//LqJ85WuAriStwwuMN5meposSV:X30PG653AzwV
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.yxxinglin.xzid27931/app_crashrecord/1004
- Size 230B
- SHA256 17e6f6d4e4b82e452ba9b70c447c966eb89afae55af58587b973182348d90560
- MD5 4f64004202df14befb28c1dafcbab952
- SHA1 b898687ecb6f5c7ed56b087e7f924cc920bb120e
- SHA512 67286b8abddfdb5f876641aaae43abddf1aedabc2b0aa36afc0bd0ad951849a3dff19ae1f44c620e5a6ce44c6887273b35823f37bc8fb22008fc8b1bc3b96039
- MD5 SHA1 SHA512
- Path /data/data/com.yxxinglin.xzid27931/app_crashrecord/1004
- Size 58B
- SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
- MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
- SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
- SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
- MD5 SHA1 SHA512
- Path /data/data/com.yxxinglin.xzid27931/app_crashrecord/1004
- Size 239B
- SHA256 5ba0a2ef8d2cfd8ab8ec10f6f8efef4f10b5c72e3388940b78d944bb91003763
- MD5 382fdecaafc9aa73cf8cfc45b7c286d1
- SHA1 d0c0c6ad603fb8c3685a65bd8cb39affee62514b
- SHA512 783ebcd45dd8437fa745ed28238b7ed281c3e36188575dc228ee0e83d6c231562d6ba1640f8972c31e125123d110f55085146def75c5b0ca4163882897cc3053
- MD5 SHA1 SHA512
- Path /data/data/com.yxxinglin.xzid27931/databases/bugly_db_-journal
- Size 512B
- SHA256 b07ffd062f24f1d26bb5d8b762611c971435048f78e1b20dd923389bddc6d911
- MD5 27c7cb004163e419481620de2e94357f
- SHA1 24e62a71be069c4dfe936e8d4abde41fd8bd3f72
- SHA512 f756a9696b8bde7f85f5793a839430f91c1d39ea74635e64ba2c8338a7459811d1c797d2da869ccabf654579637842c0102228f04844c538c353ce373eb81586
- MD5 SHA1 SHA512
- Path /data/data/com.yxxinglin.xzid27931/databases/bugly_db_-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.yxxinglin.xzid27931/lib-main/dso_deps
- Size 152B
- SHA256 d9c938ad69b1acb5f85afe8d7b8837d3ce332060f5828a8d20832c9dfd48e53f
- MD5 b398118dbd2137cfa8ee50b15163266f
- SHA1 296e1703081a8f713680496276101d22e6193c38
- SHA512 18a8bf1a176d27c046820e025c8e5d977a37b5c85e7ff1b4d319acc4729d9614cf70861f6286ae046dbe614e18a1bd2df26eac370ec5f5d62bfc5d61c9ad860c
- MD5 SHA1 SHA512
- Path /data/data/com.yxxinglin.xzid27931/lib-main/dso_manifest
- Size 5B
- SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
- MD5 c06857e9ea338f3f3a24bb78f8fbdf6f
- SHA1 c5a0a2529d2deb60fec041b4fbd722a2ebe31702
- SHA512 29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1
- MD5 SHA1 SHA512
- Path /data/data/com.yxxinglin.xzid27931/lib-main/dso_state
- Size 5B
- SHA256 34149b53d6b1f28d003da7037ec02c5d18e6cb8b99d85445d5aa020483db8fe8
- MD5 10c6cdc8516b00c20c44083a7dc7dea8
- SHA1 a23aa938b0cd15d2d2c4d4f5d6a853e3bbb23840
- SHA512 c74319341d275730083c137924865b90be350912d10f10a5e67669f2a9939152489670bf21c91124db358c2dc6d518f5fc62243d8f3fd09e280ed785410f12ff
- MD5 SHA1 SHA512
- Path /data/data/com.yxxinglin.xzid27931/lib-main/dso_state
- Size 1B
- SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
- MD5 55a54008ad1ba589aa210d2629c1df41
- SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
- SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
- MD5 SHA1 SHA512
- Path /storage/emulated/0/data/.push_deviceid
- Size 32B
- SHA256 beade2476447f87b4a638f072b06d6caa13d846e9e2303e78fff6928c6cf6657
- MD5 a01ceb4ed94666d40ec94345d8c374d5
- SHA1 a58afbc755066160dcc7da005126de41a8f873e1
- SHA512 1b96b549e79dc96085902b5f8728c6b018d84db5cf2059396fd3bbded402dbe8ebb998871d8d1c3c2a2e658984efb672ba0bb56f790df7badcdee000e1778ef7
- MD5 SHA1 SHA512