80c2187fd6d57705f3f13ca3c594e19e721c162a0e580cc262509ce38ca40b12

Analysis

max time kernel
156s
max time network
186s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
15-06-2024 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b02f41ebe7a74804daa0effc54e72f9b_JaffaCakes118.apk
Size

30.3MB
MD5

b02f41ebe7a74804daa0effc54e72f9b
SHA1

6e503bfdd3487d9f684564fd17dadee6e47276bd
SHA256

80c2187fd6d57705f3f13ca3c594e19e721c162a0e580cc262509ce38ca40b12
SHA512

c22c4ba7aa68ce4e3e1058ce9e7ac1a61f39722b3365fbd1766017b74ed199466b01da8df060d4650829ac93f18c288d65c5a3c05c02c2072755d75b2a37e9e0
SSDEEP

786432:eEAk1RIC7HeFMPrYZAX4abnsEA6i6nCx8AS3QXvznQ:11SC7HeS2AX4abnshJ6ny8A78

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 4 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.yxxinglin.xzid12990
/system/xbin/su	com.yxxinglin.xzid12990
/system/app/Superuser.apk	com.yxxinglin.xzid12990
/sbin/su	/system/bin/sh -c type su

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yxxinglin.xzid12990
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yxxinglin.xzid12990:channel

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yxxinglin.xzid12990
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yxxinglin.xzid12990:channel

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yxxinglin.xzid12990

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.yxxinglin.xzid12990
Framework service call	android.app.IActivityManager.registerReceiver	com.yxxinglin.xzid12990:channel

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.yxxinglin.xzid12990:channel

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yxxinglin.xzid12990

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yxxinglin.xzid12990

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.yxxinglin.xzid12990

com.yxxinglin.xzid12990
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4307
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
  2⤵
  PID:4405
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
  2⤵
  PID:4425
- /system/bin/sh -c getprop
  2⤵
  PID:4476
- getprop
  2⤵
  PID:4476
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4504

com.yxxinglin.xzid12990:channel
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4592

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yxxinglin.xzid12990/app_crashrecord/1004

Filesize
241B

MD5
a422749a91bdb0ac7c599b411e20ba2e

SHA1
1ca3331c304480e93c03bf49b178544d52877611

SHA256
29367747acb7d95886b4c36d535b4ff5065975096dc7c72314146451b1d128ce

SHA512
b21246aa397eae5f4bbbb60c0c6db348ebd757c8406b72c3d0c9bc8f045e7031c75b8da5eecce67da58921167d07b913f64afe5beb768c0362407a6b43fbc86e

Download Submit
/data/data/com.yxxinglin.xzid12990/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/MessageStore.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/MessageStore.db-journal

Filesize
512B

MD5
6f105c274f5b5f135031574a259d8f45

SHA1
385425ef37955f1f3925768df96f2b23d9f324b1

SHA256
fa206a77b87c99fa1934ca02a9bc27de00d82b3870a9aa736bb0d695a65e84db

SHA512
308cec51994be2cf20f174d5588075cdbea7b92940f5698de2a0469945b5f818284bfc52cd1f028c401abed532aae8c1958a56007bfb934e8e2943df6b60ab13

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/MessageStore.db-shm

Filesize
32KB

MD5
bc05ea45ac0a93254652731dd1dbdec9

SHA1
6ea5e9d9487901181efb294db5b25f15c65d9a78

SHA256
6f8091482fbcadee1f33d654f6e87e175f3d57ac17d3d8179e30f7b7bec5482e

SHA512
9844bd1c3220500968365ca79afc14e37de7770f3eef47e96e17235b75fad4054247e572d5981623cef0854e6b45907802104822c59d8cf895447c125d86676d

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/MessageStore.db-wal

Filesize
48KB

MD5
42633ae8912eb8a19db02e38e9c08a56

SHA1
9fcb275ede49d25dcb5bb430ff4bfce74809a9de

SHA256
06371446ffc39f256401e75e933ba4ac9c8ab412aecf7b70b466fb461a01ce6e

SHA512
3f496535772d567d8742a09530e10575b00c64b383e255a203c47cf5b9067e13034023530d10d849fedb24f81f4a570012318281f21e49f72a1c51f146b8f8ec

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/MsgLogStore.db

Filesize
4KB

MD5
0488db59b5f283da0646117038ecddde

SHA1
b6acf0672a8127b72dc95807d418940fd1b5d379

SHA256
c48f235da86e82b3937e246149ce46f901a80f5e4749574d070541344c155677

SHA512
e0687da25cfb72449bb52bdb36ba6cbd3bdb6c88e53b6e1030e49897c91c7f0fd077890557672f7054f9d07bde5e650731d609a47a6d4b771af07a1d295be2c6

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/MsgLogStore.db-journal

Filesize
512B

MD5
143d658f8582ffa1869a89f68ba0c4d2

SHA1
e4cfbc79af73d71443b19a1fcd78757b34c646d5

SHA256
ca8858e7bfb155eca20a363c56085f46c31062a2336fa13504ec6cf823292d77

SHA512
3e7ba1c9976d62775a42eb13f88a096c419f746d6253f550d5989302a0eee4104ee687b62b7b195242a25dcdf9dbd92273fd70505b323fdbe5e7cd7fe2ca1c0c

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/MsgLogStore.db-shm

Filesize
32KB

MD5
792d781becc7cb334c97b7bd8f5c9b6f

SHA1
4f3b393e0adaeeac72a49f01c0195388ac102fe5

SHA256
4feb89fb81a1cc58bd049275e449c7d4d3aa65514b138715ce7ec7eb548ecd0c

SHA512
1c349cffed2fd07592dec178fcec553b627891847c9cc3c3f53bfb82ed27407b4d2ba81ef73156c7f06b4379d25cf7ed6d86aa5f578bdc8e8af775218360e73d

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/MsgLogStore.db-wal

Filesize
68KB

MD5
d44d6f237675135cc2cf77efa4a27cd5

SHA1
8954d6498940decc51af711f0b259379901e59ea

SHA256
5295d87b11bb09a3de3c085572e87b60792fb9db4937f92174ad4fe8b581df15

SHA512
be0f16b7c420f980b1b49c21a82d2443107fb115fa5d842558487763d2b0a075a673d5e2f285abc06c6062835f19863fc59e92cf16e16ba56363097b325c0699

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/accs.db

Filesize
36KB

MD5
486e2bac2b3e9e1cb411d2838a4854bd

SHA1
81dd0a7537f4af319b830ae834908986be85da8b

SHA256
5644a250fa6cef16c2c802b98275656a5fc39dcf89bcc22193742d85c7313f57

SHA512
c146789563dae163e373489b3df53f22efebd32b69643992969241eb5ad5eec668de67e7cd2aaf5c3a8af57b0842115d00183825734f57643d3fdb09835fe681

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/accs.db-journal

Filesize
512B

MD5
cb022a0a0dd27efd7bc6e5e62d3b02e8

SHA1
26121f26e4a4ef39da4b647e1df9b771d7509cbc

SHA256
a7b85de16d0705c0477ca717e29a62ea32d129bece672f730ecae5dc5657a852

SHA512
8c9bddadfab8ccdb42ffb470af8488258afa0fea7be947abb46bb7e1e5aa23d1d6d30d7fb42dcffe8ac6847909cf4072e43b1c5f3962230aa4869f44f9c76707

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/accs.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/accs.db-wal

Filesize
48KB

MD5
1699aa2dc5aa63d85e95ca4516cfdb17

SHA1
62f66bb209c2ab9f68118a7bb85e7c5f0a822cde

SHA256
6ed44dd87210bb7d9b6f02502a3db298bf43e8cf5b687c2c1990837d686fa490

SHA512
8257c08880ed3faf0929425ddfc23a8be6dece901d077d7c8abee316cecb6c5b5d05d48897963be88695b3b8a9f02334f85ff4aaea2ac09526b701cee103d203

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/bugly_db_-journal

Filesize
512B

MD5
a3a5c16c3c2d2e6ff0d232fb3726341b

SHA1
4c8917a9fe2a64ca8bbf5e42d526220538fbab48

SHA256
6eb7695f833b74f191141738961922325e2ceb7a08d3c36b19a3133e5a5f20c8

SHA512
5f01ea7f7e9f02bb3da78988761cb54b5b073c0f53f055690a15ae08642123f6f403de22a7aa004bf8cdc40fdfe51f3790251d200d8dce14940ffc54167e0c09

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/bugly_db_-wal

Filesize
72KB

MD5
f95b49f64f06c1d5ebd22c623df1e08d

SHA1
f3ca238c03fce3ef833e7c5ee120b93df1a50128

SHA256
2d3e50ab63ab315470921cee450edcd00697f514c91f1659d4ed7046940164e0

SHA512
157f62ac68025ab68d97626c4ea61e1ba432665fdc84006de8da94bb2d3d6290f356443e2953a6e9f23c0159cd4ccbed454596cb722995a87883a55d7bd84184

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/tencent_analysis.db-journal

Filesize
512B

MD5
597fca2df464065874b9335785d941aa

SHA1
4e5398f269a0dccdd0e735e3f37653736751a3ca

SHA256
0d0c1dbe2ebf0b11a9807b85b8c76ee09725fd84cd739cb1254e8ef804e60011

SHA512
d5140a66e24ee68987f64621ab49b583668ff78adc41142266fb96be9cb00461861990cfd9cc93cca8e07b7c260f3ad22038c6f36da0871649478e51ba70e5e8

Download Submit
/data/data/com.yxxinglin.xzid12990/databases/tencent_analysis.db-wal

Filesize
76KB

MD5
37d1d2c699224487c834d5c93d03639d

SHA1
6048514287f9af77f213c4af4ccbd962fa21714a

SHA256
4e60e899c9e69d71cd4add1533f651d2ead5ea2275dfc02bbfb5cc85f5fe0755

SHA512
69206c1f4c65dd158b8fd1211829adb8ca534712fdba3bbfc64dbc22f268e5ceb5689f11756e4af6aa5b64f1242962cd93004a8b83b3384aab6ccd3b199a36f4

Download Submit
/data/data/com.yxxinglin.xzid12990/files/cclogs/2024-06-15 213122.log

Filesize
1KB

MD5
ea6fce8bcaf327c88b9b1b0c4a869175

SHA1
d4c2a7f1ed2e28358380669afe65a8b651b398c8

SHA256
cd5528f975d64377580f66df1c7e1654aa7d75baef2b4a7519dd092e5529713b

SHA512
da6b6882de4582c0cdfe33580850e4275f803da49ff53ae7cbcd8097e85bc109f5b17ba970fc763b91a2f01e951b9f62dc0744422661a4840b028cc90e8ba860

Download Submit
/data/data/com.yxxinglin.xzid12990/files/com.tencent.open.config.json.101400326

Filesize
1KB

MD5
f526172de1566b34fdcea744710d9559

SHA1
000cb54d9a008a807a1c5a3fd2b2e7cb41e7939d

SHA256
8572be02b59f4d514000939ec04a9b4e2380c55265256b724a617d8d0f4c6940

SHA512
dc81f0fe345b18c96b1638c67b9ef4c5e60059dfc4a02f3c30a23645d4847abeef46cf467d044c42597115c48052ce0e8ea24328382114a544c5dfd039a95e7d

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
111B

MD5
f1bff18a90b1805837f247a304d4f657

SHA1
b7584f550bb24a83271d116fd15e46fd895573b4

SHA256
e87488cc78ef1698b2e1c4494f1b0cf237bc0a1d02f397dac695515c2d8483de

SHA512
8d277b908668350f07a5097da8a6f31c70cf8443b2a2e0702bd473f28d36bfe75ad673286489f1a1a505ac24b6b3a9ffd14f9a677435cedd6d21082666bf06aa

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
111B

MD5
50869fbe196267980a904ce9e9405a08

SHA1
f65da3f3b82bab3438d8b4ee9828c4ccdc0193ad

SHA256
ebfcde7d2fbfdad425b80e3f283b83e9a875be4ac86cb8863c37e5104b8be2c3

SHA512
02ed19cbb627385a575e7209f1d3f7affc49054f8c22458235f2610c0bcf3ee0c89ce853c7ed77b852fc9e6ad2bad23bd4793d1823c5f4bd218427fa56020bed

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
381B

MD5
7222fabc90c20b4e4ce2c60a94726405

SHA1
84d8106097fc94ae424b9de7e28e5ce5d756da52

SHA256
a9d21eea408a42ac19bc8f2dc8df5be28111b200401ceead34e3d70b1b71bf22

SHA512
cb8c4c50d42c5018d0d3ac5a9117811260c674165c3855175562e1b94a6d92dd45aa03ed45e1cd89c970befd0d41b2625f8f4620e8465e3844b149f8178eff59

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads