372195f49bd1a9714185a6d7c76909a11d2342f5ed1019f8cbd854624bacf24c

Analysis

max time kernel
10s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
14/06/2024, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9c20b4493559ebb20a3cf7c62bad6a9_JaffaCakes118.apk
Size 24.3MB
Sample240614-p2cbaavekp
SHA256 372195f49bd1a9714185a6d7c76909a11d2342f5ed1019f8cbd854624bacf24c
MD5 a9c20b4493559ebb20a3cf7c62bad6a9
SHA1 e921e4a7994516bc09255d4f6d5dcd9a4d2c2141
SHA512 d04a82fcf54eeec005b16cd9bd4a3b30050a1f756abdf29c2d5bbaf00a8d2200f242143c9ebf61c46dd985023a7b3c00f22de2357ece2e0b75bc445e780eca65
SSDEEP 393216:c/xXP728AHftUV4d4U2OJGYD4s0AkDZD/cJotzmBss2h6aUm:exXPKLHf1d4UyYD4Kk5/6Qkss2hP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mdcn.mdonline/[email protected]	4420	com.mdcn.mdonline
/data/user/0/com.mdcn.mdonline/[email protected]!classes2.dex	4420	com.mdcn.mdonline

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.mdcn.mdonline

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mdcn.mdonline

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.mdcn.mdonline

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.mdcn.mdonline

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mdcn.mdonline

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mdcn.mdonline

com.mdcn.mdonline
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4420

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

.jg.ac

Path /data/data/com.mdcn.mdonline/files/.jglogs/.jg.ac
Size 32B
SHA256 2cd030d21982dc3f7559d33c71be3d853276301cc21d599c012dd6e44fb65bed
MD5 81ae2c99d0df64dc5bb8f26ba2cd5b0d
SHA1 cf7688ba1b0edcde99f3ff6b0e97f95897151bc7
SHA512 0e6648c3879055fc3f179214c5b6f1917189c2b985e1dcc02f78d7b5bea0b0e76fd1dc04f71a1c8670d54e8367778628c32063d5ade81f516886f779c8252809
MD5 SHA1 SHA512

Submit Download

.jg.di

Path /data/data/com.mdcn.mdonline/files/.jglogs/.jg.di
Size 340B
SHA256 e81200651880cd1d19c2aaf6c04c53cf28a69d13d8caf2d6458fe3c2382c7f96
MD5 6ca7e85cd18a17098f9cc231c071cd44
SHA1 3efd4e81ad598ca761ff1f24de8cdf693c9a1bfb
SHA512 f41eff11a0a67d1adae00a7159e25e54bc185eac73ecd6b2a92987813c376dcd781c6c9c6852988d57bb1699d33c5bbb59dd3c5a2d55827b9841d1d80165794c
MD5 SHA1 SHA512

Submit Download

.jg.ic

Path /data/data/com.mdcn.mdonline/files/.jglogs/.jg.ic
Size 32B
SHA256 444776834d6e78aad96577d5dee51464b627346f0265e12be742705cb603a95b
MD5 de3b09230472b384e0aa00dc52996326
SHA1 79a8380e3ffbdb6531e8cd15831c0b4089681788
SHA512 cb35712dc3f4c8cfd64606111234b16a4b17bef286d65289cdbe4b15a75df555a555c48ca68859114fed66e34dd8e43ed4f27eaf10289f377d48504c4d282a8e
MD5 SHA1 SHA512

Submit Download

.jg.rd

Path /data/data/com.mdcn.mdonline/files/.jglogs/.jg.rd
Size 32B
SHA256 ea0f734ee263318f4f8a523f2b95c2500093520e5dec2d5ea7cec0aa23b88e88
MD5 fc521ca346352e7dde8bd4c884b6ec1e
SHA1 fc61e50606db1e58674d6035401a141d954e9670
SHA512 0990ac7fc0970674acfad5b056fa6b72de57e2d050ead9437150b31146579cbe2ca190a5266652d35f6f757e3cd422cde5cb2248d8f7b3b12480f4f2b350ea78
MD5 SHA1 SHA512

Submit Download

.jg.ri

Path /data/data/com.mdcn.mdonline/files/.jglogs/.jg.ri
Size 314B
SHA256 21a9e81f15812e127c0238641107d3849fac22f9033a15240a18ee216f873a43
MD5 57b464dec9deeab9c46246c7f04ac21b
SHA1 96e44a2b64782e2cb2bb1027487e54392d1e2db0
SHA512 0929d41db78faee77f68ffa6ecce6556ae5b6fc1cd226fdaa08dddf3bf316d818c4a591d27a41ad602cf7db2829311e17eab87be211efe8d63e630f5a4cc49ad
MD5 SHA1 SHA512

Submit Download

.jg.store

Path /data/data/com.mdcn.mdonline/files/.jglogs/.jg.store
Size 32B
SHA256 55612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549
MD5 448e391c59eef34ee1defbe4dee4c41f
SHA1 df1f890987371d7d8e6963c68b787856e42bc146
SHA512 ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7
MD5 SHA1 SHA512

Submit Download

.jiagu.lock

Path /data/data/com.mdcn.mdonline/files/.jiagu.lock
Size 27B
SHA256 1758f5109039f240a14c67dd7a4e10cc1d6775153375435519a59759130f2933
MD5 ee8d920ad636cdcbf604f3eda8358cc0
SHA1 567e02ac881ace93928565260c00d0f398c88688
SHA512 496f60f168076ca4818c2e37056675dd56e83b831dc1dc8b26f6de80e8820ef1260860031fa96cc87d7a2b26ebcf144533ec704806df651f75b684ee41fbbeab
MD5 SHA1 SHA512

Submit Download

libjiagu.so

Path /data/user/0/com.mdcn.mdonline/.jiagu/libjiagu.so
Size 482KB
SHA256 8455632be7bacb221468c4daab2f9b5ee33739f08b22244ff81a36a02bec36cc
MD5 f380717bd1e3916c7b697fab8d46c5d8
SHA1 04f51f0d16097214e38be517d93be44cb0603a88
SHA512 b78fe11f77d2c0ec5b36850e8cc3b955661b31641405233c8842b91205e44dc16a30d7fc1ef18dde1b066c1b98959ae9c18be5472413d2b398b7ab6a6b52c07e
SSDEEP 12288:1U00fCZt8ej46h8oQaik5P5ci1tUDTDakfmpjcjkDGaT:1UzfwJP8oQgRZ1S/avfC
MD5 SHA1 SHA512 SSDEEP

Submit Download

[email protected]

Path /data/user/0/com.mdcn.mdonline/[email protected]
Size 6.2MB
SHA256 72e66e94867ae3e2fe96b69b34c8702a611e04e3c4476460f559534d2e7be61d
MD5 c85911a76aa9762b2d9a3cf6391a9671
SHA1 21bf7a936c88025b77666883e36b17cf5ddeb578
SHA512 7aa2a8b4ab538389be08c1534a7a3738dfb4358ad496bc1a7b55a083eeb57dff9e906cd340ffd152a19ce5db6d037cb1e01c318ae50033c2a24bb8d9720013de
SSDEEP 49152:TXsRshrxRsIE4K62zkJGiJKnPAJpvmFctyH55ZEg2PmZ5rfCSuGWQYdI3cibzfqs:TXZhrHRK624p+H/R57CETqLOT/D
MD5 SHA1 SHA512 SSDEEP

Download

[email protected]!classes2.dex

Path /data/user/0/com.mdcn.mdonline/[email protected]!classes2.dex
Size 5.2MB
SHA256 9d1e51fa0bef72ed31268ada884bf96d050d3686d6f0db55079a76385fcb3f7f
MD5 d6d5a9279904b42184cf4938baf88df8
SHA1 ab859b2589ddaacd1f964a39bace75cbd2897234
SHA512 8ddd415e13fd9c560a006f84beb5c9f8e1c4402b05ea682adea9c59d79a6b6a21193550ba452e5300be02d0d178739431ce0beb218c1d4b433923123cd78efea
SSDEEP 49152:2Mf5Ye9DodkVGrkI4Mg1TMY7wtys2XlmmYrloG3w7OgzmbEBxjxMw5SQ7MkOFCEc:df5/JoyVtMFyNtMO6C/mo
MD5 SHA1 SHA512 SSDEEP

Download

MessageStore.db

Path /data/user/0/com.mdcn.mdonline/databases/MessageStore.db
Size 36KB
SHA256 559417bb54a8e1f6029233453b7f7db8bf04b2af1eda4fb57c160ab1cbc064f6
MD5 8b6fe9d7abfef6c7c780c87463d7ea1c
SHA1 b33ac1d182f68ddc65cf8852c65cb84aff195729
SHA512 555c92c96c37154303a234202d096cabe0d11d074370dab700b03e2408b7aa27181df18c130092c582b59fb47a668522c7c4f3be51d6214507cfe6fa4146f7f5
SSDEEP 24:TLggj/UPzmD6ZWaJyZ4M0yAN9GSgGUfO:TMgbRvZ4M0yIoSwfO
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db-journal

Path /data/user/0/com.mdcn.mdonline/databases/MessageStore.db-journal
Size 512B
SHA256 5c01c81207baaf4a3c78a367232436b49a90e2c6b57b66b242a509dbd4903264
MD5 3680b03540908070236b3d7902a9dcfa
SHA1 1dd48ff3c03c31be8f5384f124e3ac1db43d301a
SHA512 40dcb540de7921f1bbbdc5104600fcc2240cbcca17438a045c925daacf03bdd975b4ef4fc1ca45e9c42640cd3dc52e0159fdc209babea56ad8389983fbf44d9d
MD5 SHA1 SHA512

Submit Download

MessageStore.db-journal

Path /data/user/0/com.mdcn.mdonline/databases/MessageStore.db-journal
Size 8KB
SHA256 a34f618d38c7855787861d01aa7f0edbb99aa85393db8fcdfd3cc8d993c277c7
MD5 abddc895327732a4d0ee8cdd579add5e
SHA1 98071dfc30337eeba11b642164d248c8b72f627f
SHA512 643f12bc27a2c5d9a7c1e90ff2d9b8e90503ef7c65d78b01ceb4bc39a375ddfed03569d737b90de505ef4df164b2b618643f478022b4ccab43406c1aa06d1b79
SSDEEP 6:7+/l9Zvl4n1zg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKEn:7+tXcqLiuWdYRmBEyPbPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db-journal

Path /data/user/0/com.mdcn.mdonline/databases/MessageStore.db-journal
Size 8KB
SHA256 8e3072e52ba43319326a3b236531e4a79bbad005d401120a212790a920097916
MD5 1155d4d844e44be9b9c2c83f4ea63922
SHA1 3d2fd1aadaa35fd60b18c105f639c6086899719b
SHA512 9af19e72a30793621a64f8fbd6953aabeab0aa62b30e95d2a2381c09ebad5a8648bbbdf768f8d5990699af34f2bb3399882d320c2a91de94c1f4f26599ff7293
SSDEEP 6:7+/l9LlGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKV/h:7+t6qLJdeWRmBEyPbqh
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db-journal

Path /data/user/0/com.mdcn.mdonline/databases/MessageStore.db-journal
Size 12KB
SHA256 40e98e59109756e318631f803a9dc31f636521a46177f56556ea7f1284edbbcf
MD5 a33b5b2021eed3ef9d4d670788320acd
SHA1 eacd9395fcbd0c7f692c21ca8d903a7646569e96
SHA512 e7bf31e9ad7400382a27abc5bea5890bc34e25396f447fa5e702fe715a8c08fba2f705efff8e64c63d8bcf041489cf62f5905a5737fd9f78040592cbde2d2a32
SSDEEP 24:7+tLO+EcqLGi/UPzmD6ZWaJyZ4M0yAN9GS2:7MMcqqyRvZ4M0yIoS2
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db-journal

Path /data/user/0/com.mdcn.mdonline/databases/MessageStore.db-journal
Size 12KB
SHA256 2feceb4b13015401f9cc79c3315366c5553d631ec12f7b3964e93d6e0dd0bad3
MD5 459e4f3693e0c48a2e5c48636591771c
SHA1 ea19138d7d7c55cb5a376dc2e0948c2cbd73041b
SHA512 2b5adf10c68eead61e59e09e09e9b78d714db0bbb018cedeeb872e96b524879ed220cda7e22000fe3698769add45af9955228004f66d4a030b8694ec447ccda9
SSDEEP 24:uERRonvqLRf/UPzmD6ZWaJyZ4M0yAN9GSC:FRRonvq93RvZ4M0yIoSC
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db

Path /data/user/0/com.mdcn.mdonline/databases/MsgLogStore.db
Size 56KB
SHA256 4087524ad761d0669a39007849311b2b0a32c1a62d0a7ff04d4a77d702bfe27e
MD5 a860ba3e3a648f73fc11269ff9ea9c16
SHA1 7167faf1666bdb05633e945dddc3d6af6c35fd0b
SHA512 279991548672e18e99522e1402ab96a3b1887a6ccbfa350cab5c5f5096807beb647b9cef0a5668755798f8032e243aab9ea5f1cfcd934671153d54fce48ef8c0
SSDEEP 24:TLEji+931pd6O+Rn0H46Dgn8tN8X48XeqS8XRu8XM8XMWlsl4qSlXmlIl18f8Dqo:TcF33QO+t070OCJfhF8GIUWZw3RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db-journal

Path /data/user/0/com.mdcn.mdonline/databases/MsgLogStore.db-journal
Size 512B
SHA256 72e37a2ae2c4b319c54d2a1863b16ee3ef7d1ff3cb5f974024d72d0acac2746d
MD5 8cbf1fc45e37ab1779ec6cc2415e45b7
SHA1 8cfa1bc38e62833ea9693243e998e6d23ea31490
SHA512 f184896dbfb5b22acc7d92f0ec00f8e1e5295d353f76bf839e42a6930d7e6734990a1f48f42db05df4dfe7e83866c19f70de4873f4ae464e85b47c34b9ee98ec
MD5 SHA1 SHA512

Submit Download

MsgLogStore.db-journal

Path /data/user/0/com.mdcn.mdonline/databases/MsgLogStore.db-journal
Size 8KB
SHA256 936a58a547a15dcb3b9f0ab13cd3ef3f4114f409dc0efed7a0a24cc0bbc8755d
MD5 8783f5e28ba717c6ac7ec4212491c7e7
SHA1 13dcc84dc7064ab26e54aa4c0904e447a275b5bb
SHA512 f124c8a7768443b387dec2ad804a9303659aabb5baba63a4781b7a7351845d6e073e133946258400b64d32c285293b245d854e383f323cd69a05ed6127952700
SSDEEP 6:7+/l9etFn1mI7g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKQ:7+tgtD7qLiuWdYRmBEyPbL
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db-journal

Path /data/user/0/com.mdcn.mdonline/databases/MsgLogStore.db-journal
Size 8KB
SHA256 db04643897db18d50d72976ba37ecf3e5ba8c66a9cb58bc2fd4f7a654e90a937
MD5 1357df660f082831b6f2d241a496124b
SHA1 b895db9be02257763ab44de6f19e789a0eb07c63
SHA512 2d94b62c9eab61d59b2d4dd9b6696cbfcd6306debea42b07f6838f28dd1dc69246b861cda1747afa0dc81a16e05dd4234d9cfd915ae6fb4780b8536a70927ec7
SSDEEP 6:7+/l9/FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK2l//+:7+ttBqLJdeWRmBEyPb5X+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 d1a3de87067267e92066230838b9d6db165fbb62e91809f038f6bd95c4a431fe
MD5 70ad87d5b09af7b264121d64a5ac9275
SHA1 4c89347e586aa7485f1176631ac0c83f1964dddb
SHA512 334fdd673e8c9328a6cfc2e111d68cb17823e52c6958ab6554fa4dd23f6b1a52a22aa6780c59e63bacd372b0f024ca793499ea98d0e60ac3f535427a926d438c
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 d8bc1bb5a40a603f51cd860502f1f9a36bc72d00813327cbd5efbccfe9006b60
MD5 ac082d632ea6de2f10f799c2b4c0a7bd
SHA1 ce1bd157b14f876e4ec4e1198ef426cdde51627e
SHA512 86b73f02c1c434ff6c8bb02be822509c4f39867b13ce8e4907ca1bd550e32fae7861ad83b9745e33607b71294d57f772429b2d51d199e57f594c66215b28f73e
MD5 SHA1 SHA512

Submit Download

.deviceId

Path /storage/emulated/0/360/.deviceId
Size 48B
SHA256 36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
MD5 4c4c5285293d5141f582aefa4e038669
SHA1 e01852a72e5a8e6f7d63a21426b515118196047b
SHA512 097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399
MD5 SHA1 SHA512

Submit Download

.iddata

Path /storage/emulated/0/360/.iddata
Size 32B
SHA256 1f98879725be53fca1f7b690664ee1914785aa10fa0c95e2b7c7c9ff54c9440a
MD5 13654a6f32e3541684bb846ff5b3f171
SHA1 6ed95ca4e24ba4f8d30239b53923889d196a0921
SHA512 71f8dd9d8be2e5539f9dc8fb1ab944cc817f6f1ad8f8d6d89382f953a6058b39d3ffc9f14606f0b2753a1833afd6a28ccd5cb842f5cb68465a66323790e1fe1d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads