a26ea1ab394843e1a5ccb1558bf9eb94c65312cb38e49633195258a32f55a0bc

Analysis

max time kernel
154s
max time network
182s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
15/06/2024, 05:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad0b9de5a653c9a6b6c0a65d260d2077_JaffaCakes118.apk
Size 19.0MB
Sample240615-ge513stfqq
SHA256 a26ea1ab394843e1a5ccb1558bf9eb94c65312cb38e49633195258a32f55a0bc
MD5 ad0b9de5a653c9a6b6c0a65d260d2077
SHA1 af5c1a63babd867952e14a6ceb3066cb53bbf138
SHA512 ac68d4e20dc289b164bd5f843e5ff3af16f292a3a7c22b813b735691d5dd055a767be7bb90150079777f51b70c6326b7cf8422bc1b9f154f8dff6cc3d694e73f
SSDEEP 393216:NVDU1UBBz/yo5X0MvH4TdQm0pBQndA3JzX2p6YZKHTIh:PU1uz/yoKMgTdQtBKgzmp/ZaTW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xinmang.guitar.tuner/app_e_qq_com_plugin/gdt_plugin.jar	5082	com.xinmang.guitar.tuner

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xinmang.guitar.tuner

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.xinmang.guitar.tuner

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.xinmang.guitar.tuner

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xinmang.guitar.tuner

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xinmang.guitar.tuner

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xinmang.guitar.tuner

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xinmang.guitar.tuner

com.xinmang.guitar.tuner
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5082

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

gdt_plugin.jar

Path /data/data/com.xinmang.guitar.tuner/app_e_qq_com_plugin/gdt_plugin.jar
Size 393KB
SHA256 9597de7943e30d0ed1d6a128b18111585ce0dd36af66502638d57b470fbbb6f3
MD5 0d546943943234cbe0a8b132c4d65bca
SHA1 11c36b9ad64cd3925c449e9a794a3613abf33c4a
SHA512 096f35cc60239a9412651f9b0607e30ef57c3fa0628904b5a450b08c71534323cc66b8d506c19da8fef9d19dd8f0888b19b7efce66463becfaca5fbef1ddc4b1
SSDEEP 12288:K+uPO8JwCzjAhw7VVsvWE3u3M7ynOSso3Rdbxg/:Bu+tQVyOEDmnBf379m
MD5 SHA1 SHA512 SSDEEP

Submit Download

gdt_plugin.jar.sig

Path /data/data/com.xinmang.guitar.tuner/app_e_qq_com_plugin/gdt_plugin.jar.sig
Size 180B
SHA256 9bb6aa039d8d357c21d7357782f47bf9871619c77fa8e524a93be24e3051ada9
MD5 72a35623a7ec98c621abb05ef1ed45c7
SHA1 90d548ed43b4acebfec22fc7e8c86ec6c47ab046
SHA512 f8aa202e2d0008282f224165aa6825204e9516121fbdf607d79c56860485a2d1f2598792b35c98e29e873262170ca772f91ffe5c7ba65b288d3550918a3d3e16
MD5 SHA1 SHA512

Submit Download

update_lc

Path /data/data/com.xinmang.guitar.tuner/app_e_qq_com_plugin/update_lc
Size 4B
SHA256 0c030586945fe504b604ecc2e875c38ede400cd5cd73da9730302162e6b02c6f
MD5 dce7c4174ce9323904a934a486c41288
SHA1 e117797422d35ce52f036963c7e9603e9955b5c7
SHA512 d570ab6a8f4a7b54d426b0481219074b5277ace37d88438d87ab97eb387938eca1cf7b09fa42d596c56ada860710d2a7385d2a96e1cedff58ad6ed8900f1b143
MD5 SHA1 SHA512

Submit Download

update_lc

Path /data/data/com.xinmang.guitar.tuner/app_e_qq_com_plugin/update_lc
Size 1B
SHA256 bbf3f11cb5b43e700273a78d12de55e4a7eab741ed2abf13787a4d2dc832b8ec
MD5 0bcef9c45bd8a48eda1b26eb0c61c869
SHA1 4345cb1fa27885a8fbfe7c0c830a592cc76a552b
SHA512 91972aa34055bca20ddb643b9f817a547e5d4ad49b7ff16a7f828a8d72c4cb4a5679cff4da00f9fb6b2833de7eb3480b3b4a7c7c7b85a39028de55acaf2d8812
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /data/data/com.xinmang.guitar.tuner/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/com.xinmang.guitar.tuner/databases/google_app_measurement_local.db
Size 16KB
SHA256 334647613f2ca6d9ac0fcc5faa1fabfe7b28b2df377bbef9aaa988dad2b4713e
MD5 b7602f458617049b0a61b479a501afa3
SHA1 85ac94c5f8f5d7c20f07443314d1fb589aaee311
SHA512 078c306bca16529951ebbc4bc2e86e3b24bc915d5cab63733c08459f11024799d9787bee173e83bb3372a609221a469b82ce557087da753f589f2bc7cc2b8ef8
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wb:TLiEy9zmzrfRmBEyPbP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.xinmang.guitar.tuner/databases/google_app_measurement_local.db
Size 16KB
SHA256 4769255d67e3ea87a9a6487df0e8b84372115f1f51a090269836fcad026e296b
MD5 d0425d08931a94a322f76a069c1f362c
SHA1 60514113fe4343152ed91ec0b385cf87a9372275
SHA512 bc8394ea847ef4bd1ca14ce931821521a0364a59157651e0435a936866e14cb159edcdf4af5ceac55ff2e94cd8cdd811fc136c2aa809ebb11dc79bbfc66cdfcf
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/kRv2JJ7Q8ll/oi7UyWlVs:TLQpmzr0GSP/kRO37l/924
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.xinmang.guitar.tuner/databases/google_app_measurement_local.db
Size 16KB
SHA256 8ff162f186b82fe94c6160773bb85295e1445da45726dc9139875fe130780934
MD5 a5de0848183b64a6c8fc3ece81c733dd
SHA1 711d3a00223561e0e1655940d7de10d4c911d196
SHA512 f57d6b2c09ed3689492c034e0009f124b52ce50080f823f348bda84e7ebba61616501019947d29942760866fab44fba81363114ca962a8ee70ead363214b24ba
SSDEEP 6:l9bNFlils1QvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wpl:TLIEQv9zmzrfRmBEyPbP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.xinmang.guitar.tuner/databases/google_app_measurement_local.db
Size 16KB
SHA256 29f0ecc69378a707d744ee2588041698299f50917c18d9ecdbf2bd557567800c
MD5 af21881571ba2b8f55e3ea14fc554796
SHA1 8d20ba0fc330004189ac6f733bda557f2dbdcaa2
SHA512 1ceb08ff23e96f65b01e6ba5d67fc59c1f134463d5f9908b8337e32c173458db98b9a0da619b4b83b97c92515bbfcb114b284cd5a00068a9f09d55f8f37c6c1c
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/N/3OLapAo1GtD7Ujm5EWlCuUyWlsBH:TL6Xpmzr0GSP/NfKapAJtDp6b0
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.xinmang.guitar.tuner/databases/google_app_measurement_local.db
Size 16KB
SHA256 e05d115ffbfed820baf5199e20daa4f086685101cc533fd3f9c6e05db3adb602
MD5 2d3d95b3cc85108ed6acb61f7dee3aee
SHA1 cf68e1b4a077f48663d94283ca928baa3ed8c91c
SHA512 42fea872cd32c95440872bad659e1483bec45aad325b6637476a66276b6bfe920ad1e45367f0ede6be9437418a469f664bab09b1ba745d0c5809e4e469ef0c74
SSDEEP 6:l9bNFlkls1KlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wbrl:TL6EK9zmzrfRmBEyPbP/Wvl
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.xinmang.guitar.tuner/databases/google_app_measurement_local.db
Size 16KB
SHA256 e73fc3b5ca388f4253e9c5fcb04c386cb6b04f055ec8d0b52ea871e1e0f0f46b
MD5 9403c4b969f15f66eaae847b996f1423
SHA1 3d0321de00b4d0da5011e822432ea679a649124e
SHA512 c13d1f32d617c24fb80ccb6eb2d008bb47dc5027de645864380d4bec38fa4c7ae5f29c1f76ff9bbf9462457c375022f45002fa170be1067d9736660557c672d4
SSDEEP 12:TLWuEOe9zmzrfRmBEyPbBvOwO4VOLabCAUi7UyWlV62:TL5epmzr0GSNOuKabCE2J
MD5 SHA1 SHA512 SSDEEP

Submit Download