56dbe7d9a2c5433c52e4c82af9abb642b694f92b4abc80b114a01d87aafdec97

Analysis

max time kernel
5s
max time network
187s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
15/06/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b07b9d8bc9276b3a17c5d51843170203_JaffaCakes118.apk
Size 24.6MB
Sample240615-2ndcmsxeqh
SHA256 56dbe7d9a2c5433c52e4c82af9abb642b694f92b4abc80b114a01d87aafdec97
MD5 b07b9d8bc9276b3a17c5d51843170203
SHA1 02c2c50fcc3ba297ab0498431f5e2a73e9c0ee2e
SHA512 f8359ace3ce70bbaa2c3028eb13494d505b36ce6dd37411dce6986bb42a1a1488ba2964ee10399004ef4c1dc4fe04c15babb34b93e1e2c2e2499f80ce1185d68
SSDEEP 393216:CQiXSi0TrMPk2CZA7S3zWWLXxg5VwEM0MfZFvZOQdG3Erc3KdPPZX39pkxsd5Yo4:CDXS6CZWWLqIEMNOQ6ErcqX20YouYqxz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.founder.fushun/app_SGLib/app_1718491412/libsgmain_312768000000.zip	5154	com.founder.fushun

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.founder.fushun

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.founder.fushun

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.founder.fushun

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.founder.fushun

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.founder.fushun

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.founder.fushun

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.founder.fushun

com.founder.fushun
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5154

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

libsgmain_312768000000.zip.tmp.5154

Path /data/data/com.founder.fushun/app_SGLib/app_1718491412/libsgmain_312768000000.zip.tmp.5154
Size 364KB
SHA256 31e020e3eecfc11883d2220570ec0ac2098bf8006128ec27dd632ff83b8ee497
MD5 200a69ec413e2d3f6f2433d15e2d6ab4
SHA1 c029a7c0c44aa490527c11f612c644ad1d70d564
SHA512 abec8ca19b01b0bb8b555e955fee8b768578253171644a58f3bc374078a46a200a3121fa9ae4bd98686ec649cce7517efe6f06bceac4b6968b9355bf948b3e76
SSDEEP 6144:5h3shIcUFhT7D1y5zijZqPTm3wokefRmf5hbu0gwjC8nGo/yd7QmdoWA:5h3shIjFh+2jZam3wFHuwjC8GoKd7Qmk
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsgmainso-5.4.38.so.tmp.5154

Path /data/data/com.founder.fushun/app_SGLib/app_1718491412/libsgmainso-5.4.38.so.tmp.5154
Size 658KB
SHA256 9e236d24f8c9a3d46e80e5286dab3deebb05e44686950db3aec24f6dcea7d647
MD5 37e6383ee3a98dd848a70f506535957a
SHA1 65e79520fceb74f6a6fcb931b47dfd21bf774e68
SHA512 de5e8ca80f1b714034947ddbe9e3de43bae26e94dbf2cbdaf53e7fd4e3f3b8cabd4c75931e0840ffd12e0694f611a57e5e98760aed14c3ed7f6b10fcc682ac4a
SSDEEP 12288:Ch1uE8Qv2IEsUasUa3JLXb7UDEo8kQW47tBdkhdos:Ch0E7uea2Eo8kQWItBEes
MD5 SHA1 SHA512 SSDEEP

Submit Download

reader.db

Path /data/data/com.founder.fushun/databases/reader.db
Size 60KB
SHA256 015bf0e8920a4932f111381dbfa1383de85906ab55d869cade02553fcdc97a00
MD5 66f6747806d58a7355865987cef47a87
SHA1 1ed6cbf4f1b7938b699e4060f3fe826a4c836438
SHA512 4d39a631e23339054c9a13f177697fabafd346bb7a91a0cb93345eeb12325f9d52f7bb8a3af2e043f4fb47fc5de014cd02daa2b3201284a41d6f80c9359a354c
SSDEEP 48:TVghiPCswxHmVKSzm5Fruw5tcxRrSDFOkbWymo+zDb6BE4tmDCU2JuUGp8S:mQaXlGO8SDAqWyt+fZ4tmDV2J09
MD5 SHA1 SHA512 SSDEEP

Submit Download

reader.db-journal

Path /data/data/com.founder.fushun/databases/reader.db-journal
Size 512B
SHA256 1a21f882f3726da318eb77b6f5872512fdcf3aecbd46d14167c8f22b0790cf2e
MD5 1c3bf851b1fc308e4d1b28865e1cfcf0
SHA1 e542b9e89e63789ce2829bfa24457f5b5fdcefce
SHA512 26143a432a0bc7c03ee93869a139d062ea41c5fbff8559694927fd6ae2a48234346b6beaf059a38e95365e6553644ddcb7924c421f8de20e99bb0ba97aa62c2a
MD5 SHA1 SHA512

Submit Download

reader.db-journal

Path /data/data/com.founder.fushun/databases/reader.db-journal
Size 8KB
SHA256 397c0c5b65307390b2844de9308d909579a0e9ed560b9da8e09fe57e7a35aea6
MD5 ec9770c2485dcba3eed7fbd175934915
SHA1 3af1e27023180cff19bad8f133d623d0e9a8c5b7
SHA512 8ee08c3b94ac839d9ad6b1c5091092a57b3a1aaa56f42d5a825b69acaa6259d57538c350b9f3f7eee11a1d046f13857d7341b16720f03e9ed6f44a9f33806522
SSDEEP 6:7+/l9jrn1cXvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK4w:7+tBOXvqLiuWdwRmBEyPb+
MD5 SHA1 SHA512 SSDEEP

Submit Download

reader.db-journal

Path /data/data/com.founder.fushun/databases/reader.db-journal
Size 8KB
SHA256 79ff2ce2b6b0cee7a2790e6ac75a897aa1a134a93c9f1edab8964967c4c315b4
MD5 8c00011ec179f56a73240c4adb255f6e
SHA1 86aa4ca24114e020809bbe786ed35043a6351ab2
SHA512 1f456d3e1cbf70f2c2f7059fe5fde60f15b775257aea36308db98ea9cf8e5d7e97aef739be7fa1866c0fda323681229141f4ec042d5e346dddfc301591e6e361
SSDEEP 6:7+/l9EHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKWO//v:7+tOvqLJdTRmBEyPbsXv
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsgmain_312768000000.zip

Path /data/user/0/com.founder.fushun/app_SGLib/app_1718491412/libsgmain_312768000000.zip
Size 63KB
SHA256 341fe9a38aadb839142a9b17b20731ab069fec07eb72147480be9a7b370f7b48
MD5 8c0e6c9b072ee3fb859cd999e8420de6
SHA1 5f34904635634c452ae3a79904674870ed7c537e
SHA512 58ae839793f8bfd1fa0ba7f0d68c4a01fe56e2758be6325a1b64c69fce3e70a7d51418a0c5e1744dea9a7da29074cb3e79a2f838926c378f8160db0d0d6a334a
SSDEEP 1536:GhaOMqoQ/B6gzPMyoFxvbmTUkd6bARPhU/9/8pmDYFivUhARGpVFx9eAK+q4J7in:QaMoRFdbmTUkd6bARPhU/9/8pmDYFivj
MD5 SHA1 SHA512 SSDEEP

Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 148a9f998759dbf0c9d523dce3938a3947bd136225ee050123fd209097da7a39
MD5 b8bb3eb1a2a748ada64e0c02d612aef5
SHA1 4ff22460cac876e7c9a75e5a2057682e4bc5cf21
SHA512 c8b01458ab2a87145160e028c15fa65dcaca42bf0cb5c4cbf96a6c59893d9a40a802d8078462d01a36e0e41a492861fcb5bb6ef34c3d2955622db7c52f41269b
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 213B
SHA256 441adc1fd6fcee6d17c3344bc09c96901ad0dbc0e4d5a3e9458a27722fd467c4
MD5 af81e860c816f0607cd7899499cb65c3
SHA1 e2eb0bab87c55f053a6bca957d073990b294da33
SHA512 af3b6a708d2f928aa067a0bad859bd21fafb6aa380101d9b9b3518a6049658cb80e633c568056bfb73308d189aca5143226d9f194627077119709718ec3f04cf
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 167B
SHA256 50d4d29f10858ce5a07a7c3eb4850e257b156bf35074c933b6b3b4a105ed4f8d
MD5 ad0877f170c24d0bf1ecced0607ce62c
SHA1 4742206597cd0e6469c053289c8a9d7e748044de
SHA512 5ad74d416a509a39f818f6d397f908aa7ae4605fbb6bcf210757655c1cb095b29cacad2df0e0d4dd7024b03245cedb7082c9578831c97aec60b00b4680a97584
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 251eb3d56fd5da0399a10fd7330e27041c69d51e027c15be13c4fe186820316e
MD5 72f04e70244f061371884cdc4a9387ee
SHA1 a708810fa4c3d6449bee48ba5c953dee17b5cd4d
SHA512 b946737f904facd7cd7483904e15d7c5c23a7f2c5d52dcd3f66eac1d46426b5b5e3ac71ea50464b3422f1ede0c2dddc4c76a13a41f0d3e5376cdaf8ad73c8dca
MD5 SHA1 SHA512

Submit Download

tbslog.txt

Path /storage/emulated/0/Android/data/com.founder.fushun/files/tbslog/tbslog.txt
Size 6KB
SHA256 4ab2b958f35e294fa190d4a61983d8c927e27cb8010b55fe93a062ca43c6b6ed
MD5 4e32badf06908702629623f4f6359f50
SHA1 f8296ed22305968f3eca1196d368e534ca675e07
SHA512 943a557b33558359d000c8de138c33db39d8f3fa08d369b61f2a59abc4ed2e26dc353739e7a940339831e7ce03ae1c1b7315ff62f4095a8c7168c12ad247195d
SSDEEP 96:lvY5n1nwKuMh5PW5R+P4zXuEnwIe/VGPgRgaxLXiBohDERe3:lv25xbr4vqe+xXwAEU
MD5 SHA1 SHA512 SSDEEP

Submit Download

.mps

Path /storage/emulated/0/Mob/com.founder.fushun/cache/comm/.mps
Size 49B
SHA256 f36fc4ff2ab14bdeae6981e203f77c020728dce8707a75e37095bfca062d5d04
MD5 3c2cddbc9c51d05b8355f0157f955acc
SHA1 561c4419353bdaf16f82f74bac34176ce0d38936
SHA512 4be78618cc3fcf6b93bc1a5d6cda555788a18ac9f700f1b2613a9fd29007438d41fe4954c5ab7df50466b519a0d8f34c007c5174c2b10e86654d3ab00c0a5e80
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads