b98cc355f223d25ac12c9bb565707c476ba352f194ac92f7afffaa721f5dddb5

Analysis

max time kernel
178s
max time network
187s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
14/06/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a804b0b5d7ad2571faf52cf15b3f23db_JaffaCakes118.apk
Size 14.8MB
Sample240614-e6w65sygpq
SHA256 b98cc355f223d25ac12c9bb565707c476ba352f194ac92f7afffaa721f5dddb5
MD5 a804b0b5d7ad2571faf52cf15b3f23db
SHA1 da180ac24a7323896a4451fd4e86ecec6b89af36
SHA512 0008af90fdf2db4ef227a4209cd2f88894a47df5b9b2f3a1368649790630892538943444cfb8245f152624e4979cf3f1d4ac839aa8e8eb659aaabd68941c5166
SSDEEP 393216:cfI0j9mOHU7HmkMKl4Me37+seU0S4iNZw0B7Iy:CH9Y7HmkFpe3yseBYB7/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yxxinglin.xzid27931
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yxxinglin.xzid27931:pushcore

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yxxinglin.xzid27931:pushcore
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yxxinglin.xzid27931

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yxxinglin.xzid27931

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.yxxinglin.xzid27931

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yxxinglin.xzid27931
Framework API call	javax.crypto.Cipher.doFinal	com.yxxinglin.xzid27931:pushcore

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yxxinglin.xzid27931

com.yxxinglin.xzid27931
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4428

com.yxxinglin.xzid27931:pushcore
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4464

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ua.db

Path /data/data/com.yxxinglin.xzid27931/databases/ua.db
Size 24KB
SHA256 7a4f5b0ab23a456e79e1e46576954330f946d791672fae4d9f6ba1168ca1ddf7
MD5 cdf9d23eda92c0b13bd55d21658e77b9
SHA1 8cf3f062270efbcca300e519655a8611acaaf0b1
SHA512 70b8f52b674cf0d8a959731c6958932e4ed99235c149275eebd9a6a8c7e95d097505463835ac7388f371340cc814c77492ccc8a0c29025be5b5d3890f4c9b0d4
SSDEEP 12:TL+/0/ZapgPBuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbP/ho+Wt+6dfESHP:TL7oiD4PPvP/BlmqygGSP/ho/Xd3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.yxxinglin.xzid27931/databases/ua.db-journal
Size 8KB
SHA256 11f6c2785cab6609c38502b82f868bd7af97c4560f78407beed27c4c097ec017
MD5 99513c28ab5520b4545924dfdb15460e
SHA1 cc5cf293e09055cd7c4c209171b4608976d958d2
SHA512 5f822c36b56125abe0ff0f8c9c6f580dfbbb632e50733e7bb2c5a60386fa10feb11a396faf70aa4dad57976f4d28dafaee22897bcdca62799c78e8f0b73499a3
SSDEEP 6:7+/l9kGn18pg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKB/:7+t8qLiuWdYRmBEyPbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.yxxinglin.xzid27931/databases/ua.db-journal
Size 8KB
SHA256 2210618dfe60183543288376a511e1daf77bf19937419ac88a44592ea13e7e3c
MD5 44cbe425e6f76b922646eb003e76f579
SHA1 be077abd13475a3d81a482495d6d6e36343b1c65
SHA512 8052c94be109ec3b20e6ef148f73e65d09ea1c475d7034902358faa21fd1c4d733ddfa6bd2cf6e0abc1823d1386f8819b64183242855438c010ec66a55d28071
SSDEEP 6:7+/l9gMbjlpg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKtIls//L:7+tvHfqLJdeWRmBEyPbQISL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.yxxinglin.xzid27931/databases/ua.db-journal
Size 16KB
SHA256 2cbf12b61eb8a366c832c1147d9f797d2e2dbde4ad606cf42ca6b0a152634b28
MD5 2edebc06711e3cbbfd35df1af1fd93b5
SHA1 af6f977b39a7a71d17a94d44d113ff5c6f2897df
SHA512 d16b665b508ac0a24cde3b9998ee37b32af8b2c4aaf22d91f4ee6319148ade5ede0dc54eaef96209a314faacfaf1120a129f75b454230b5445fcc1524c0b7518
SSDEEP 12:eWxhX7/vqL/j/ZapgPBuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbsn:eWxhX7/vqLroiD4PPvP/BlmqygGSsn
MD5 SHA1 SHA512 SSDEEP

Submit Download

1004

Path /data/user/0/com.yxxinglin.xzid27931/app_crashrecord/1004
Size 52KB
SHA256 a74f1102e31db574ce44150bd8aa5c5538ab36ea979ddd82631926e4a97effd9
MD5 4ffc92b87d219534f3e02ca46aaaa716
SHA1 c22e076c4319a7d1b3388c0131ece5dc9faba5a3
SHA512 e7045786afb2bdc723b22ddc483cb8d8e584c1c70ce8be516f43c50e5bacc10c69b2ce635d2d2551cf843ce98642f3762a3aba0e0ac8fd7d90de9af41330cf1e
SSDEEP 24:TLL4XBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGScGQeQQQQ:TwX85WuAriStwwuMN5meposS
MD5 SHA1 SHA512 SSDEEP

Submit Download

1004

Path /data/user/0/com.yxxinglin.xzid27931/app_crashrecord/1004
Size 16KB
SHA256 684297a686d14e9fc03ca7788e959b68b17b91a5745cd8da8c549985d4298926
MD5 50814d744809c5655c6ab8d2cb9d30da
SHA1 4e1fc42d3a4827a40008fba73bf5bdf489bbee30
SHA512 4fac2c5474ed7c26044f7a2a21daaa797c11a448af41a33e00eb5f39f1a275aa4b52d8436028ed68b73448e1733517b6aeeb48abef3dd2466b28a82be59b410e
SSDEEP 48:T5SX85WuAriStwwuMN5meposSP/dAARaX7oPU6Ci7KR:153AzwPGARKo8637KR
MD5 SHA1 SHA512 SSDEEP

Submit Download

RKStorage

Path /data/user/0/com.yxxinglin.xzid27931/databases/RKStorage
Size 20KB
SHA256 4f691376bbe83a3fbef8e4c0025ebfdddfa69600d184d0dc9b6a7116a4838294
MD5 2ea97dadd7af3eedb1219ed5c7d1dc98
SHA1 fed7c852a8a407e6743467eecc5471d7af499fb0
SHA512 fe87218777c581338cf69fe021f14a0de37aba85fd8d4333646728310db81110b90d410ce0a47e602a9b91c6390d91050dade7cbb2507a7c2d835e3389881514
SSDEEP 12:TLyKjqRVcMEPVcMEeF8cMEg4sOscMEdcMEmRmBEyPbAVOwhB:TLyAYcFPVcF5cFG5cFdcF9GSEhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

RKStorage-journal

Path /data/user/0/com.yxxinglin.xzid27931/databases/RKStorage-journal
Size 512B
SHA256 9984c770176901952ae64961d252041a93fe730d250f29559a1f72721e1f150f
MD5 c655462ca08a4978731b4df9e831561c
SHA1 35ef8a86197006dfa91a723b61297c4b755cfc95
SHA512 73c89cafb3b35189ab5125916ae724b1985d5d10c8cd3347691a4f7bcf6bc7e72a994e9b3beb9eaceeb815cb027145bf1536fd6c5d8310a6dc1b8587b0a18ccb
MD5 SHA1 SHA512

Submit Download

RKStorage-journal

Path /data/user/0/com.yxxinglin.xzid27931/databases/RKStorage-journal
Size 8KB
SHA256 0ff46725d9e705bd0aaefeff0a1d734512dcd4e6d2d7586b63d272137a3cdd81
MD5 c062e11f819e5b5667618b1085323dcc
SHA1 b989cbcb9893cd18d19738230304562b2ff3f683
SHA512 624b24e1e887ec1344f6cd9ba2d9f70317469036a114f98f55ab24cc75bbbac49015d9794d72c8e361edfa8886e84f592c4ea2cba25fe7cbda3dd2af8d5ac36a
SSDEEP 6:7+/l9oHn1JsWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKny:7+tBWqLiuWdYRmBEyPbuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

RKStorage-journal

Path /data/user/0/com.yxxinglin.xzid27931/databases/RKStorage-journal
Size 8KB
SHA256 50435a65853c53fb7e1ff5c10d7642957dacff7b5286a9d187484aad5e54f75e
MD5 406ec753ce08f90694275ea757e75e9c
SHA1 0bde09767fc9c7a613053888c2a47d692a693740
SHA512 e899ffb2da4b975f4637c5d840a42a237ff1feb88d693c128929424c73f255af3b37a83a946ef7021f5ff4eb96f4e6c273fad89ea3db87b0decdf99510b487e8
SSDEEP 6:ayGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK7//Si:mqLJdeWRmBEyPbMr
MD5 SHA1 SHA512 SSDEEP

Submit Download

RKStorage-journal

Path /data/user/0/com.yxxinglin.xzid27931/databases/RKStorage-journal
Size 12KB
SHA256 60cb5e0d6af8ac4e3365a749f65f7a827f3c3efb4c877dd6059eb9557adfc741
MD5 ac586c36dc1565fa29f62bcb4b5007ad
SHA1 9de6095684178052ae4d5a07aae1ebf2a6635437
SHA512 179df382b908660a87f2c1ddec7372eeb39ae2173bd4ae62d3304b19c8e6ca53783ae15ecfe8a8cadb41e01378b9d684be592baf0ee182cd0ddbe6c1797a0578
SSDEEP 12:1DqLm8qRVcMEPVcMEeF8cMEg4sOscMEdcMEmRmBEyPbV:hqLrYcFPVcF5cFG5cFdcF9GSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.yxxinglin.xzid27931/databases/bugly_db_-journal
Size 512B
SHA256 62dff12a5d06ae611e66a6c54c046f754916d49a5fbcf8245592486e420a895c
MD5 4ff9feea07afa1dc503b081c2412bc67
SHA1 545d7b874500416cc7e7e705bbdb0881efc4780d
SHA512 ac38fb0fef05f687c0d060de718034c9566cba35b130d62fa910d518f9eff9fc4060b10a93e0719b6ad2e2f0c9c58a5a5a2f4460b4c6db8f5c1e50861fcb32ce
MD5 SHA1 SHA512

Submit Download

bugly_db_-journal

Path /data/user/0/com.yxxinglin.xzid27931/databases/bugly_db_-journal
Size 36KB
SHA256 1fa1b6e6bd75bcef64d35785e2fd6f2e73dcdf92dce73c8b2a8fed49746d53bb
MD5 4a8120c91e3143b2db43971dbc77cf8d
SHA1 37c5700d35059c4e0a718ced73b3d73ba5d2b277
SHA512 465cd282927e30a0a894a75ad261feddde5a31869c8cea6b548362afce08fbb7cff7a784bd1d62c3e4c95916ce30e758d3919dd4cdc13176f29d68c2620c185c
SSDEEP 12:TL/j/ZapgPBuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPb8FOwIQQQ:TLroiD4PPvP/BlmqygGSgIQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.yxxinglin.xzid27931/databases/bugly_db_-journal
Size 8KB
SHA256 b413f3e51800f866fbbad6232d192ab48ea44822cea97a8131c2ef6ae70c7ba5
MD5 e2f935191555786c79a85110469f7058
SHA1 20ffc6d59e4c6beb9ced09f61a1b31c7759904ec
SHA512 8d5cb8721d530d5e6dddf4fe9ef6a708465f468c6138bf566c76e011c15655c0caf71ba15ff58bc8e5fcb1ec2240e0953dc8c7aa582d36b5a634042b29f64f15
SSDEEP 6:7+/l9mpg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKs/lkt/Jn:7+tspqLJdeWRmBEyPbX/lsJn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.yxxinglin.xzid27931/databases/bugly_db_-journal
Size 8KB
SHA256 f53c4604bb20671d0c3f63048618fef5035f33f44a9a0c6e018746a137f391fb
MD5 bb88deb9cf01ea6c8f6f12dc1eb4caea
SHA1 6b65e8c3d72c1393ef68d76cd1ac36ffd5e82306
SHA512 505b078453076bf32227e40b8bf9a12a3096d933f07b1c85f91f3841be8d1fb138ae173ae5bf01e7dffda5b4d7725ddee35349eb10c750f78f2006b5fffc7cc1
SSDEEP 24:7+t0D3fP0qLL4XBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGS7:7MOfsqwX85WuAriStwwuMN5meposS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.yxxinglin.xzid27931/databases/bugly_db_-journal
Size 8KB
SHA256 d71c687432d782c6cf43ddde53ad8da05ebab230cbc11963b2cc5399c6bea878
MD5 448f641126a032f7c233de1379de0832
SHA1 3c7cdfb81aa6af2a93d9753e4f34b9161d80ddce
SHA512 8abfdf6a937156ebf1d4bd88ccd1d78e251c64cdffb0c4632bc4e341328b3900542eaef967e4c8888929bfb08fbd24518c220f2c45c6cbf92c98b21181df6cbf
SSDEEP 48:pPU6Ci7K3qgX85WuAriStwwuMN5meposSu:p8637K3053Azwu
MD5 SHA1 SHA512 SSDEEP

Submit Download

dso_deps

Path /data/user/0/com.yxxinglin.xzid27931/lib-main/dso_deps
Size 208B
SHA256 8b5719a8249fae3188ae12e13b746f38a46b8ad8e10e8fdabd114b706f9f90ac
MD5 f94e6e9d59e79944e70a84af3e3b2a0e
SHA1 6f9a00e9e8482957702e0264f33a226fb3bfda32
SHA512 c7302101a2f739ce2644c55642541bb87d5acb82f6a1d1f97f2a5ae131a75ec00e09e8f5e060ec26ba3ff810fb41ab54735ea1e44b690b983482b835264479d3
MD5 SHA1 SHA512

Submit Download

dso_manifest

Path /data/user/0/com.yxxinglin.xzid27931/lib-main/dso_manifest
Size 5B
SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
MD5 c06857e9ea338f3f3a24bb78f8fbdf6f
SHA1 c5a0a2529d2deb60fec041b4fbd722a2ebe31702
SHA512 29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1
MD5 SHA1 SHA512

Submit Download

dso_state

Path /data/user/0/com.yxxinglin.xzid27931/lib-main/dso_state
Size 5B
SHA256 34149b53d6b1f28d003da7037ec02c5d18e6cb8b99d85445d5aa020483db8fe8
MD5 10c6cdc8516b00c20c44083a7dc7dea8
SHA1 a23aa938b0cd15d2d2c4d4f5d6a853e3bbb23840
SHA512 c74319341d275730083c137924865b90be350912d10f10a5e67669f2a9939152489670bf21c91124db358c2dc6d518f5fc62243d8f3fd09e280ed785410f12ff
MD5 SHA1 SHA512

Submit Download

dso_state

Path /data/user/0/com.yxxinglin.xzid27931/lib-main/dso_state
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

com.yxxinglin.xzid27931

Path /storage/emulated/0/JXCP/aff/com.yxxinglin.xzid27931
Size 239B
SHA256 4f50cee6ad8eff93a57b8098a7c7d624361771778d50ec6e83e7ae273700e142
MD5 628999b0e90e459b2ca04c1d1638a057
SHA1 e30e4b31c0fd06a4557f5db86a24dbf71ae2fc0d
SHA512 b53eb758a4dd8670fd7de99132b25699dd78c4484568a722b3f86e23942d5269673c2081ab1832a18376736791f8656e6d661fe5338b9dc843f4856bf312462e
MD5 SHA1 SHA512

Submit Download

.push_deviceid

Path /storage/emulated/0/data/.push_deviceid
Size 32B
SHA256 6e9fd87d81abea16757c4e07acb87267ea43609239f68297cac04112358d8f83
MD5 b5c0b667e0741fde9d5297f19725d9f2
SHA1 aab21d0738f64f9712e74824cc2ac05ae4cdbf28
SHA512 cd6bf42e70c5a386d2e24f68aec850f7f422d930107e61f35990330b1478228136fc4218953d0dbb1992dea8d385d428e8853c77afac0d55642ad51d4c8eb527
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads