b2ff8b800c588f2f5969e0101f136e5cc2d02ef7bbd6b6a37f1aabe53ed3198a

Analysis

max time kernel
179s
max time network
191s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
14/06/2024, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a86764af45a201306328acb2ea3eefaa_JaffaCakes118.apk
Size

30.9MB
MD5

a86764af45a201306328acb2ea3eefaa
SHA1

2820cb9c32c54b2d6615518b8340e00e6354044c
SHA256

b2ff8b800c588f2f5969e0101f136e5cc2d02ef7bbd6b6a37f1aabe53ed3198a
SHA512

0948ac62de75edaffef73a38f264899c157156f8e290512ffedd9ed4e70579f86c93991a75488ef614872063d90f32bfe72f296340d09bbd86141c7af51096e6
SSDEEP

786432:wIY60+KqxQ+Pwt7bTqu/mNP1N4CUhfrXblfOWmX9Vy1:wIYMn0bZuNNxUNDblDmg

Score

8^/10

banker collection discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.sdu.didi.gsui
/sbin/su	com.sdu.didi.gsui

Checks Android system properties for emulator presence. 1 TTPs 4 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.serialno	com.sdu.didi.gsui
Accessed system property	key: ro.product.model	com.sdu.didi.gsui
Accessed system property	key: ro.product.device	com.sdu.didi.gsui
Accessed system property	key: ro.bootloader	com.sdu.didi.gsui

Checks Qemu related system properties. 1 TTPs 1 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.kernel.qemu	com.sdu.didi.gsui

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sdu.didi.gsui/files/hotpatch_hack/hack.apk	4345	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sdu.didi.gsui/files/hotpatch_hack/hack.apk --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.sdu.didi.gsui/files/hotpatch_hack/oat/x86/hack.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.sdu.didi.gsui/files/hotpatch_hack/hack.apk	4298	com.sdu.didi.gsui

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sdu.didi.gsui

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.sdu.didi.gsui

Requests cell location 2 TTPs 2 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.sdu.didi.gsui
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.sdu.didi.gsui

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sdu.didi.gsui

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.sdu.didi.gsui

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.sdu.didi.gsui

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.sdu.didi.gsui

Checks CPU information 2 TTPs 3 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	com.sdu.didi.gsui

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.sdu.didi.gsui

com.sdu.didi.gsui
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4298
- cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4324
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sdu.didi.gsui/files/hotpatch_hack/hack.apk --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.sdu.didi.gsui/files/hotpatch_hack/oat/x86/hack.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4345
- chmod 700 /data/user/0/com.sdu.didi.gsui/app_bin/daemon
  2⤵
  PID:4369
- cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4420

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sdu.didi.gsui/app_bin/daemon

Filesize
9KB

MD5
c3b858cff9b63f0204de0e18cfe7ea4b

SHA1
563b414acd43cd8833fee63cf0fe1ceab304d2ee

SHA256
b7924380cf9d067b72128a077f30458dd7904235d7c9a68ad02ab29da14a9304

SHA512
7f07acadf0c6213c8d8c5c80366a8b6745c39605dc712e41a332d365bb188bf9db405e34d3dfb7bab220c3695b2ad40265f4cf225a5526c57adc1f299e6e6f56

Download Submit
/data/data/com.sdu.didi.gsui/cache/df18_13k_hts_didi.dat

Filesize
2.4MB

MD5
940c73542c91608751ce0213858bdd9b

SHA1
eac7a20d6db32db0998dccfc98b19123bbeccbb9

SHA256
d798e52746a945a6a526624351ee2b80ac3f8ffff64abbe7fae31a105ea20ab9

SHA512
cb00d1d7a3f91108c27bbecddf222d6b0e8b86e8ac0471cd0cde68f8a2da4751a736b63838079f7de53f65800793a226124922a9aade2b7b18c5925835cdeb41

Download Submit
/data/data/com.sdu.didi.gsui/cache/etts_front_navi_chn.dat

Filesize
8.8MB

MD5
cdea24f0c9bb286f048ab082141ce3c6

SHA1
99a940b69fb9ae722f6a6ffe45e3814ea62f66ff

SHA256
abb12aff82f3107af997b6f2f281102ff4426691999ffbfe2e20b07cb1881a4a

SHA512
656a37fe90783c40233fd2d94a3a49e0eacbc4e3a5b867ab8287e1e0d39539c162be191ec947a9829f8ba98192cf7961531892dcfdb99817bf701cd2183ad1d3

Download Submit
/data/data/com.sdu.didi.gsui/databases/SynthesizerDB.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.sdu.didi.gsui/databases/SynthesizerDB.db-journal

Filesize
512B

MD5
b7d3dad398f81e5f522ad1be74b00b8c

SHA1
bf95b440e1a1036b07bfcea3b1857dd0f8989009

SHA256
631150efaa8434fe886abedddee34ad522fba54f9f2b6e6a0a6bd28882f1ad93

SHA512
2adf94bf4350d018070be62743c38718683316a1d3a33ffe59e4dd846d8231338044e36488fffc6f66321d0b0c2d39ee6d0da758ba662671a162001034d60818

Download Submit
/data/data/com.sdu.didi.gsui/databases/SynthesizerDB.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.sdu.didi.gsui/databases/SynthesizerDB.db-wal

Filesize
32KB

MD5
fb34a9b7d1f31a30542584a897595b80

SHA1
e0c877fed41c647ea0a3343505b836c5b1a7d606

SHA256
b763dd395f619158805b1aa1a11bd3a1ea67d6baa783844b310047ffbea8cb93

SHA512
973baa0f8d1a5f9d1b21180c5fec6e83bab53500e1647cb2b9763de195f3ff489f5c014fb20b74feef2faa332cce5f2b41cb4691d8299ef863577403c328fa4b

Download Submit
/data/data/com.sdu.didi.gsui/databases/location_info.db-journal

Filesize
512B

MD5
c9513e16fe4c37d035e8d3af9a464506

SHA1
328e74ae9a209e7205e119260e653d1bc1620c8d

SHA256
079c182effd9741890b035f290212f38de3c389079ebcd39f0757ba0b6b80da1

SHA512
1355aa6a231f3c4e5c3c1b3e57078358ad4e11aabb534ee04478f537ca39c9eb57157256a468763699979b463f4e94cc5ae2da500b7aff255a0253568a3a2b41

Download Submit
/data/data/com.sdu.didi.gsui/databases/location_info.db-wal

Filesize
160KB

MD5
4cce53b83abe9e8fcc7dbd65aef541ec

SHA1
bd411af56b4ebe1663eea10d8d834cbfb312a900

SHA256
c94cbd1df793bf525b91b66b5805f4c54ce7fef0dc783bb7f904c0544e97b5b8

SHA512
c82268256f781dac37bac95142f2be8a39040e7d829c02dad1e316f49af8abe03e1ba222e4866eaea7a3685b84c76ebc709efe366a8ff1ca1a8fed473bf33cc1

Download Submit
/data/data/com.sdu.didi.gsui/files/com.didi.sdk.login.c.j/36453449

Filesize
91B

MD5
c263fa0a7109789d49cc1eb38f00ba6d

SHA1
8497deb3e61559bfded77d05f333d714c2edfdf6

SHA256
3f823a10535574f5e6e19ce913b75d80fe5a208e5c2c53b80367776be1674891

SHA512
263166406716106b4211d210075a2507cf7e852d9241d6922792523304d8ec3386fd0abe18960e683716e519d0ea85dde73d8b93d7412a0a970cea9cf17b9970

Download Submit
/data/data/com.sdu.didi.gsui/files/hotpatch_hack/hack.apk

Filesize
746B

MD5
63f8ccbd6d43328f456c8f2d56d56547

SHA1
3cb0bdac74d123b13b2aa56d7790d7f49b610f94

SHA256
ecb2aa8e3c0cb32e63542cf2f0a9f7ece00d6e2d2bb2ee516a4c09570d920ff3

SHA512
1de01f36459b4557a0358087f8365ba0e92dfbf014d97992b647713e1e7c0d746833f32a928e158755f14da761d76288009f35addb1512ab75ea480a2bc2276b

Download Submit
/data/user/0/com.sdu.didi.gsui/files/hotpatch_hack/hack.apk

Filesize
460B

MD5
2f9ebaa804fc8607621cffb5f45eb777

SHA1
fb303780396621f1e9f1e2765d845967ad054eea

SHA256
8915ff957af6abc477af8c06c06d3205a7ed26914416fab9f7c8f7aaf7e02f56

SHA512
8850ca23d7e87862c386412e0362ebd799136e37ede456937029a4605268ab749f629ffbbc68bb141156bf6a96880ae98b35b1e9bd841f448398dc78c78d63f2

Download Submit
/data/user/0/com.sdu.didi.gsui/files/hotpatch_hack/hack.apk

Filesize
460B

MD5
257ee52ea6bbf3fe02973e5e2b64d990

SHA1
748d8acbfd20b23ded9d58f9229638520fc25460

SHA256
5b903d81bf2a8ffca93cb2e5485702e7cb9d1ba64a6fe515e972c208394a3e0c

SHA512
3a2f5014388b53d8c7f7fccd99d28b5212f6a8b2f619358648bcce7264796a2ae994fd3279cb4f8ab0f2303ad8b774c5ecd2ef5393f825b70214478851084e2c

Download Submit
/storage/emulated/0/Android/data/com.sdu.didi.gsui/files/omega/e.cache

Filesize
308B

MD5
acae024c9403623303303897a4f2362e

SHA1
b3693ead966fb19fbb86aaa07c32af2ff331b781

SHA256
c65259c03daf80cb15206a9a4a3ceb88b8a8498e9ef31668df55de69d805f4df

SHA512
94d68714551158e1264e1d5ac3ca8acc0ba9790675c3a7847eedd96d46c72f37ceb19b7f9d7c770e0f67ef796e66c583d982b733ccd567c28bc47eb76e575534

Download Submit
/storage/emulated/0/Android/data/com.sdu.didi.gsui/files/omega/e.cache

Filesize
525B

MD5
744682796a94231ab59ca0849c69f02b

SHA1
3ff65a5ebf5ef1bb3c985fd6e8191863b6210fbb

SHA256
3d74b8a7455b11c3bf14e8747f4a6ce9ef696dafb9f612957abc982040c12b27

SHA512
763ef7a0489e4e2ede485650560e74aed26e6fa1af1731a70030971ffe2fd3540bb8d40b7cb57157bb8c7df4188586e0e62fb4ebc024926657d8e1935a7a3c05

Download Submit
/storage/emulated/0/Android/data/com.sdu.didi.gsui/files/omega/e.cache

Filesize
584B

MD5
8f985f14116813c21640338228031859

SHA1
21c1002ebaa563c10d924c15ca19c805d1b24388

SHA256
b1d1ff539ba3a0f994c0d001e6e258790b9948eceb0e23d9de1dfb69da441e0d

SHA512
72e09f487c8b973185303cbef59509e9ec6a8ea2eca7f3ae2e91550cbb517b1941f8d5d6e94e46d4e2ce0534a4ec50af9fd5df4739e67722f2542322d23e4c94

Download Submit
/storage/emulated/0/Android/data/com.sdu.didi.gsui/files/omega/e.cache

Filesize
644B

MD5
8ace844992399608c1e0326fb634eecf

SHA1
5617012388545a1005029fd32d9f8249e8dccca8

SHA256
03626ecde5fe5a5ed615d3d72671d69a7ee5670959223d2ff086d2a8a3423b2c

SHA512
b9efa488a4c35ab534985cb5c09e2552ff0a19bf82f332d36749e5ab366cd2b376d998cfbb1626c92eb8810496b202e341a867f5a2b522a91d112800bd0eed06

Download Submit
/storage/emulated/0/Android/data/com.sdu.didi.gsui/files/omega/e.cache

Filesize
802B

MD5
da8094e2c44b86ef167ab94694367616

SHA1
8804e8c8836385912c99f2b04aa636cb95d4cfca

SHA256
9ee418c4cb6130dfea2e439185a26fe37ac364e271b92ac22c42357e92d16803

SHA512
03c776af465b42c7297a3e73e370cf23cd886df03db85972c1b01e43dc40a5de3da8e2e01d1e6067833d1dfb219542b7af49420d4b342a78c072f08e48ce6ae8

Download Submit
/storage/emulated/0/Android/data/com.sdu.didi.gsui/files/omega/e.cache

Filesize
3KB

MD5
3f0016ab6065a18074fbd18b4c2dddc0

SHA1
0998c57f6c80f1740d7c68f632ab79aec9a19600

SHA256
b2c806aeb1eeeb8b36a0a1f98a22b6cff16bccf07ee25aae9e7d15a1245f7708

SHA512
8c1ad647066ceadb5376dd7b194d2133740c335ff1a2856dc10276aa1dc2ec8971a39f3ad763ff4344ad1dafeff4e84da6fe7db1ed17d780f039f17d1078b4c7

Download Submit
/storage/emulated/0/Download/.omega.key

Filesize
22B

MD5
87f49479317f2609adb589942c805c97

SHA1
e8862ded335f8031fbc3671c5447c3dd9183dff8

SHA256
718ba07c4adf8a9061591b68cadebf68592e2a226897f4ece72f89fae903ef14

SHA512
e93c6a1ac0af8e3fd05054511af0352d0098d35ceeef089b15f59a28066a0191399275e58c857c49413d3943f1f1b214d26283236edb29c5965e05b0d66cd5e4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads