93acd82507104298215af6b35cca733d96c35e072ef7e06f4b542a89f92c1cf0

General

Target

aab8295cb33138e7c476c0d77bdc4b31_JaffaCakes118.apk
Size

27.7MB
MD5

aab8295cb33138e7c476c0d77bdc4b31
SHA1

5107173c4cd9a2baffa84f81fcd4855820edc073
SHA256

93acd82507104298215af6b35cca733d96c35e072ef7e06f4b542a89f92c1cf0
SHA512

5319defceaf3cd73388e2cc84893666ea600e538b78efd97c3937c50c9a60bee47ace9590fa67d2bb5ffa1317085219255254db8ae6f2622b82ec7e9f849cf3e
SSDEEP

393216:MZ6coNOB7GCE0lCXdK0a2pQVOFHUhvrJvTGXr7oaRzlwEoGeGXiR03G5mvsm8owZ:XuEf62+VOF0TFGb7ztzoGfW5mvs5owRH

Score

7^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.founder.gaotaixian
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.founder.gaotaixian:pushservice

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.founder.gaotaixian:pushservice

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.founder.gaotaixian:pushservice

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.founder.gaotaixian
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.founder.gaotaixian:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.founder.gaotaixian
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.founder.gaotaixian:pushservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.founder.gaotaixian
Framework service call	android.app.IActivityManager.registerReceiver	com.founder.gaotaixian:pushservice

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.founder.gaotaixian:pushservice

com.founder.gaotaixian
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4270

com.founder.gaotaixian:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4455

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

1

T1627

Geofencing

1

T1627.001

Credential Access

Discovery

Location Tracking

Process Discovery

System Network Connections Discovery

3

T1421

Lateral Movement

Collection

Location Tracking

1

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.founder.gaotaixian/databases/pushsdk.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.founder.gaotaixian/databases/reader.db

Filesize
4KB

MD5
6e28a0b4ed83f7a3988b3ae7b7b54843

SHA1
c7eb465b9c263612dabe8ed1ef5322244ad16a77

SHA256
3899806eb9e034af5723b39fbaf4e16b72b3f5c31d7fcfc1f24e0f531b9c0290

SHA512
030215ccf8224311ab03a509b47e2a9bbde8554890a94c872abf10d35c7dfb74b2a2d7554432b3def99f82c702be4cfefecb00e00813a7d0430a314c20abb779

Download Submit
/data/data/com.founder.gaotaixian/databases/reader.db-journal

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.founder.gaotaixian/databases/reader.db-shm

Filesize
185KB

MD5
6b3fc89cc811a6d7cd47e1c5cb044dd5

SHA1
3d5915de7a756f8b606929acc2a1f7e03d86c4c7

SHA256
4c92bfd93b889bc4f3b6326132592a618a8d3d60ab5ed8566b1a082cc9438dbb

SHA512
a36a8e1dacb1a0a1ba4eb19dd103e3798c7666daf9275f66c55e7fa77617a210152174b95369a5328db2a01dd27b4c0fe44b1ae379bc1c90e0cbab63fa733694

Download Submit
/data/data/com.founder.gaotaixian/databases/reader.db-wal

Filesize
68KB

MD5
5cd77f894b003f207ccc177270e94190

SHA1
2044216ea903bb77c31f933fbf15e83a887428af

SHA256
fbb391b70606c398ef49f63acc02b659d7e1c98ee5266a5529886db5c970d3fc

SHA512
3c36e6f342c2f614f2e94f30f13a887ad6cc3b4fb7dffe1b0db2fc07bed4f7f5b96cc2c91327f0af8cd5bf2ac5aebbf5c5aa58a936dbfd7acfd2f04cc679e433

Download Submit
/storage/emulated/0/Mob/comm/.di

Filesize
57B

MD5
70a42cba408700f9a6c01c7941a8829e

SHA1
eab01cc2c0671538795fb0b1146017dc099d0984

SHA256
499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

SHA512
8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

Download Submit
/storage/emulated/0/libs/com.founder.gaotaixian.bin

Filesize
75B

MD5
af1b1e683030a635edfab0c1da5b2d58

SHA1
f0d7b4e419d387fcd821c719dfa9aee63aa9f8f9

SHA256
d469c7b30296b1cfa52c28519110840743e0809ebd7cc625573f0a88b07659b5

SHA512
8ca82507d5a5cf64522a5b4643f5328f1b8ee8ce006f7f4d43e23c9e03b1464e2f7bed68f1baa88017c94f79888965646c5319aeeb7ab673b4611359aa37c4cd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads