Analysis

  • max time kernel
    178s
  • max time network
    190s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    15-06-2024 06:01

General

  • Target

    ad1890f8dfabdf3fef20df166b1a603a_JaffaCakes118.apk

  • Size

    31.2MB

  • MD5

    ad1890f8dfabdf3fef20df166b1a603a

  • SHA1

    45171c88207204fc914c9c0552ccb593bf560b7b

  • SHA256

    8c50209773553b7096dec94ac6d62caa752b32282ecfea201a9c1cd0f9b1cfe2

  • SHA512

    fdac590c8e4b8ad1c4a02931986ac8ec39b4db6d8be02062678e6b36068b8932af925e2eccc92a307e67bc8da4994dc4eed4483579d62991aff97be4b1ed6a35

  • SSDEEP

    786432:u75ucrOSIWH9gIVnmZkxCFTi0kYkh+K6kuNSs:yfrOLq9tVnmZdTbC6BSs

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Queries information about running processes on the device 1 TTPs 5 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 5 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 5 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 5 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 5 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.smilingmobile.seekliving
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4203
  • com.smilingmobile.seekliving:core
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4283
    • getprop ro.product.cpu.abi
      2⤵
        PID:4436
    • com.smilingmobile.seekliving:channel
      1⤵
      • Queries information about running processes on the device
      • Queries information about active data network
      • Listens for changes in the sensor environment (might be used to detect emulation)
      • Registers a broadcast receiver at runtime (usually for listening for system events)
      • Schedules tasks to execute at a specified time
      • Uses Crypto APIs (Might try to encrypt user data)
      PID:4491
    • com.smilingmobile.seekliving:channel
      1⤵
      • Queries information about running processes on the device
      • Queries information about active data network
      • Listens for changes in the sensor environment (might be used to detect emulation)
      • Registers a broadcast receiver at runtime (usually for listening for system events)
      • Uses Crypto APIs (Might try to encrypt user data)
      PID:4659
    • com.smilingmobile.seekliving:channel
      1⤵
      • Queries information about running processes on the device
      • Queries information about active data network
      • Listens for changes in the sensor environment (might be used to detect emulation)
      • Registers a broadcast receiver at runtime (usually for listening for system events)
      • Uses Crypto APIs (Might try to encrypt user data)
      PID:4761

    Network

    MITRE ATT&CK Mobile v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.smilingmobile.seekliving/app_tbs/core_private/download_upload

      Filesize

      56B

      MD5

      326fdf1aa6627737ff150a7fc1af295c

      SHA1

      d986db4e5dccd3bf4a07e9a4a8d5d6f7e5ba1150

      SHA256

      f53df2cfa840b247cd75820081d5ed571ce01bc860bc3099eb1fa7ef306f9571

      SHA512

      86e2a258e761c092fbbe40712773da8132ef58500f1bb783a94e20a84821304e1d38c29d470bd46b46d9ecfe17e0569e12f8a2e035781a16fae1273742d8e5ba

    • /data/data/com.smilingmobile.seekliving/databases/MessageStore.db

      Filesize

      4KB

      MD5

      f1485162e89e7d7f71960c359eb2b9f1

      SHA1

      fdd1aa12c36624f9993028fcd75fbec7f41796d6

      SHA256

      2118882cd04cd45a269b6c5b66c9d7a132eddb73725c829686d3d1c71729862d

      SHA512

      2b96abe9988c911ff02b4a999a96971f435d48deae0149eee95bc06291b4dcd75bb0b572dfc8b132f9a0560edc697b64d30f5253daec76f1e19719d0fa039a4c

    • /data/data/com.smilingmobile.seekliving/databases/MessageStore.db-journal

      Filesize

      512B

      MD5

      99223e7f19cbdbce39219a3ade2eb20b

      SHA1

      86d8e16b4a4cfcacc60f871a19312963bf445168

      SHA256

      f5f222415d2caeb0f49574dc4d915d08ecd1645788dd198d4fc4e2fe4c4c9135

      SHA512

      a74dc144843cd2bb8b01882607c75854a014e4de8b1c21c7bb4dbf29a1456c0494b9a147298c80dd383473fb6c4f71788abd8d1779898528c4d44e650853ede7

    • /data/data/com.smilingmobile.seekliving/databases/MessageStore.db-shm

      Filesize

      28KB

      MD5

      cf845a781c107ec1346e849c9dd1b7e8

      SHA1

      b44ccc7f7d519352422e59ee8b0bdbac881768a7

      SHA256

      18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

      SHA512

      4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

    • /data/data/com.smilingmobile.seekliving/databases/MessageStore.db-wal

      Filesize

      56KB

      MD5

      de5bf6b025f195379c8de1fae5a411a6

      SHA1

      299acca4491b386b1b3201b99b642a355f8c172e

      SHA256

      01c0ae4cb219af5607d7f6af482f718d80164744f2e37b543d3cbb90980ecb8e

      SHA512

      85ac7e4e93c79f12754c67637ff21ce7d1ca8b0472c731275a43ffff2fb3033040ed7651d7aedeceac6980fa40e3303846ffbcb2090d4ad6c6f47516a24d681f

    • /data/data/com.smilingmobile.seekliving/databases/MsgLogStore.db

      Filesize

      4KB

      MD5

      f2b4b0190b9f384ca885f0c8c9b14700

      SHA1

      934ff2646757b5b6e7f20f6a0aa76c7f995d9361

      SHA256

      0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

      SHA512

      ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    • /data/data/com.smilingmobile.seekliving/databases/MsgLogStore.db-journal

      Filesize

      32KB

      MD5

      974057c0c545319fc635d9e37846bec5

      SHA1

      504eecd58843f40dae164e3053fd9d0fb1b7ef22

      SHA256

      2b78d5a540fb6c85f958ea840398206e7bf523c5c6de858af0c97b7598888210

      SHA512

      cedda924262bc3e91619616f99c6dd01688dc9ee56a9b867c324023ba04934f2046d68db227ec08be83ed027cfc557adabc855d17db478ce2008e85941153960

    • /data/data/com.smilingmobile.seekliving/databases/MsgLogStore.db-shm

      Filesize

      28KB

      MD5

      aa201d926bdeeb15a713f03003406ce5

      SHA1

      1a113664582c9d34b19f7d14224c79e2ff609636

      SHA256

      97460c563aeb8dc77a22729c9988780fbbce58ac7c68069b5dc00009dd34fd82

      SHA512

      ed8e09900164ba5734a0407f1958196cec7d74d4a0670ae83e4ae87f8e744749057d9a2315e4cc5b3ca190b1bfc2da93173ca7750b501cfaafa67bb1b393bae9

    • /data/data/com.smilingmobile.seekliving/databases/MsgLogStore.db-wal

      Filesize

      68KB

      MD5

      340e34fd70a8852577e4eb9c0a91f5d3

      SHA1

      be59ecfb62f8f0d4d2893bb01652c4da47a6fd03

      SHA256

      41af21080bd87b085e0ea904b8c01823ef74eaab2305800ca0db987e0b0bf999

      SHA512

      9b904828b05005869192ffa3e67322772575a3b14c3a166ceca9798f3761b1c0bfe5d4740a4da43018dd8a7bfde7ce45f8760ea922ca6c4b8c374de4a6f8fc95

    • /data/data/com.smilingmobile.seekliving/databases/accs.db

      Filesize

      36KB

      MD5

      486e2bac2b3e9e1cb411d2838a4854bd

      SHA1

      81dd0a7537f4af319b830ae834908986be85da8b

      SHA256

      5644a250fa6cef16c2c802b98275656a5fc39dcf89bcc22193742d85c7313f57

      SHA512

      c146789563dae163e373489b3df53f22efebd32b69643992969241eb5ad5eec668de67e7cd2aaf5c3a8af57b0842115d00183825734f57643d3fdb09835fe681

    • /data/data/com.smilingmobile.seekliving/databases/accs.db-journal

      Filesize

      512B

      MD5

      2d899ddaea5f6b00a97bec17dd1aa211

      SHA1

      8e810056a51aa38d17face6fa57461cfa005691c

      SHA256

      75fd87dc12c9c6f9450a4131d1da7a27e3dce5de1513ade2ddd34a4f3fe022eb

      SHA512

      a1fb5ef0ec19e640b7861e6e01eb5917a6bfa5f14223fd189e5b103f21d54c714aa4f33936ea8252ec5e19beffea902e0bcc84b94db848c20bae225c24f66075

    • /data/data/com.smilingmobile.seekliving/databases/accs.db-shm

      Filesize

      28KB

      MD5

      2172314f95d76a0469428111a8b6d68d

      SHA1

      ae751d3172fc55ca393c6ee48041b32acc1193c8

      SHA256

      3d8821c9634ec2fbf4b2ec431cb7dd19c2299549679aeb7e6d992c76d16d8f9d

      SHA512

      3f4022984049ef071d981f6903ec6dd309012ce81ab49010d8d2b67c98b294d69a0fbbda44b8b09ef183628450f8c812e8f201456c3f8ad7f1bdae6018598773

    • /data/data/com.smilingmobile.seekliving/databases/accs.db-wal

      Filesize

      32KB

      MD5

      308363025e6c5a99448eb31c5b6612e5

      SHA1

      b3f291277f826967e25e5a66eea8e8c9b6f84998

      SHA256

      456980ee76538ddff252524fa06e8c6da3189686459501e6f2d9a8966ec39ef6

      SHA512

      3316e06fa91b6331183731bc94625cd246686d3877ff77b9378a72a4d088a51e41232fe6db468a78307a3103cdffa4014f21b75c2ba312262266e6719ba967de

    • /storage/emulated/0/.DataStorage/ContextData.xml

      Filesize

      84B

      MD5

      629f5701b04d714222262f6e6fffca98

      SHA1

      698e9a4705be5c8d44c87a79358ceea73ba3ccb4

      SHA256

      2de088b8ad2f60bcc7cf7e4dd101bbf9ba44ce4f3f649b07cacde1c65fac27c1

      SHA512

      a16d9e34dc3f49088442a92aa1093a00b65c688df25e83d04858131d496e97c86ddb144cc6bad2f540339d73dbd8b765a76c5ab09318d09f15d3cf6500728668

    • /storage/emulated/0/.DataStorage/ContextData.xml

      Filesize

      175B

      MD5

      58a8cdba8f230c835bfb08deb5817105

      SHA1

      e2bb2bb9e26ed9f0057b60d9974cf2191b053f72

      SHA256

      d71db8d18dd978bb8b8abc2511a6944feb5a7a2c1a5935d6fcb1eb3a8e0a4365

      SHA512

      6d7152a525a9a41b305947c92dc993b5d75fe838c56f908eb52ff4f771a4c31923a285e2dbff7be2b5ebac493e7b53d77acc72e8896b3fa16b9d6ca2289d0617

    • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

      Filesize

      111B

      MD5

      fae093a2bdc35f2e52c75603b7f48986

      SHA1

      eaf2c98bedc70a8c4a0699fb8785446f9e5b0abe

      SHA256

      1539d5da41c025e5a2918e8f7dab5f0670ec31f051347268a2a3471edc874656

      SHA512

      545b04c28add8e42f69be7254af42cba8e5bea337471ccf7712b166bde7f024523f23ec385dbb67be840d9fdccc741c8a5aa26994c943fe024adabff276925e1

    • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

      Filesize

      167B

      MD5

      4dea9b1658d82375673a4166e5166fbe

      SHA1

      66a5dbf5eb03552e393c389a564d06342b63edfc

      SHA256

      b6b61a79f526ed28bafe2a8de4baf652c58bbbfc52ff2506dfe6880a88ad92a1

      SHA512

      7f15505651913848c4ae37c0736a45b4610456e40566d71995e9b325e5dc1956bc29e631d7652c2b78e7fee41b680bca52b89a0641b42424da6cf8b853d02e3e

    • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

      Filesize

      84B

      MD5

      221bcca912f7e385bb14e4c284c8c9a6

      SHA1

      1e1aad65f08c7717b43653c55c1c62edec1efb8e

      SHA256

      edbce38f3c423f4ef067a6f8e25b95802bf7354ca2f4bbed6246d80ce97ac81e

      SHA512

      64234d4d4f44be5be07edaca722cd45a84bf0579e3b106060209378140ba214fc68689a1e713e80b924f06abfd72b938fa492f08c07abd404fa180e887928ce6

    • /storage/emulated/0/Android/data/com.smilingmobile.seekliving/cache/nim/log/nim_sdk.log

      Filesize

      512B

      MD5

      e82111dd2317a2e4a28b69ec4e7dea5c

      SHA1

      574aa32663259cfa3aebb267b969cdd2742fef0f

      SHA256

      6972f1d6be06614815e2fc8b69e1d49cd877d86be5ff89c833067aa19682890f

      SHA512

      7a1bf7e23dc1adb0884a019f4ab34c844f7995a3057eeb53e42b3890674ab6e21827b24669691eb436040fdbf3ead60330956199217dd3d61626c407b511b954

    • /storage/emulated/0/Android/data/com.smilingmobile.seekliving/cache/nim/log/nim_sdk.log

      Filesize

      32KB

      MD5

      d8001224f373b21dc6ab9ce87e27041f

      SHA1

      c42b2ec0bfab26242f4cacf9c5e25944d52a8749

      SHA256

      8b0b2f42130a42d3d934a7272ff82617f9126b7e81b86b4d48c34c435570b161

      SHA512

      e9fedcea2c95d4fa746f09264361bf7fc03f75a3f0112b39c80e7c6abad1182b10d61ad6ae60de72167b701539948675b5194117c6b440aee014c916634c69a7

    • /storage/emulated/0/Android/data/com.smilingmobile.seekliving/cache/nim/log/nim_sdk.log

      Filesize

      220B

      MD5

      6e04d986b97d2bc869f9cfb472a23145

      SHA1

      98c6856215bd172135ceedf8cf606485b1709a95

      SHA256

      ab2b2893c40505f136967929f45dc4add8e7dedc960748d15e97215bc56c8640

      SHA512

      9577f6970e0cf2dd09299aa34e10518ccd267fceea4d0fccf5df08a3a662b935101043a1f5d0cba5dc80190132209a6a66cd97f33c859f353a536d41ee8e5bb7

    • /storage/emulated/0/Android/data/com.smilingmobile.seekliving/cache/nim/log/nim_sdk.log

      Filesize

      96B

      MD5

      7acf7502312acf4db1766f7e64f1cad7

      SHA1

      332a1fb0f979836567890a56ca65c6efaf01f6e5

      SHA256

      4ee3424fdf71e8c5c8c6e39b8cc39b559e8cd786bd3d2df0adf2e2b0bc930a4c

      SHA512

      41817fd45f4126493d4fdcbe9b757237d3854b1f68be053c8b3878e567bcff0b84c0328f37ca0322788adaf57d5f9af1ce9e0819d4cbbb95552e9288aebe2e75

    • /storage/emulated/0/Android/data/com.smilingmobile.seekliving/cache/nim/log/nim_sdk.log

      Filesize

      94B

      MD5

      ba447416f841c2a3f6dfb465db4d325f

      SHA1

      84026ab7a31a0b637f99b0d0cf012dd1ccd69be0

      SHA256

      d432d3d0e6d7592e8dfdd2d2d92c826f07005df04c8fa87411b3afca7d8fd4df

      SHA512

      a10a54aacf8db65368ccc221ab997b0bab4cfabd8b11fe7c45459acc5f7197735a63aa6839e0ba2f99836eff241d085bf2558ea789262ae1ca1c080dbd4e0b4e

    • /storage/emulated/0/Android/data/com.smilingmobile.seekliving/cache/nim/log/nim_sdk.log

      Filesize

      94B

      MD5

      ca6cb567ec714e4f55bb65b1ded703df

      SHA1

      e33e50dc59c6790e15a04a99ffdd90466c2578ec

      SHA256

      197721051b57dd20f5a6793222ffa64a8702b8dd3fa3ff902a5a31939b87367e

      SHA512

      a4cdea8832f3a940c481dd7ade3889fb30ac546cabc11e876d713080dccf93b63ac58d4d19be2e43643c955b977d753eb90f7f9e20114e817839e303b462d628

    • /storage/emulated/0/Android/data/com.smilingmobile.seekliving/cache/nim/log/nim_sdk.log

      Filesize

      79B

      MD5

      66579b0435d8f3ec691a0a62bd0a7d18

      SHA1

      01016c8e996ac84c307cdd67adb3abbb9d874333

      SHA256

      5d59b8b2081c071ba91319043bf6efe86b6551e95cef6525313708204b8e0b94

      SHA512

      7625584e4048428f08413fa7acf8a7397e5748ffa59fc5b6e794775e7bf744df815baf5f8ab335a6ae9c26cd5d84479c79119cce08e2b9a0a4ee28141af27b0c

    • /storage/emulated/0/Android/data/com.smilingmobile.seekliving/cache/nim/log/nim_sdk.log

      Filesize

      163B

      MD5

      859e02675e4ebefef6070559f5cc92d9

      SHA1

      c2b4b2a1b00ac55407f67ebbb10eea9bf6418595

      SHA256

      9d6d8678026c16255553bd9e0cd694fbf83e650c81ffb32bad21d3099ffec355

      SHA512

      b03c0c48dd18706e5c0c1bef12585140b21d1fdaa74376e2e1f79a88bd79c12c70f759ed6c3997cb267bd30c8980b82acc69e3de9d2c2681cd0657a45313e5fe

    • /storage/emulated/0/Android/data/com.smilingmobile.seekliving/cache/uil-images/journal.tmp

      Filesize

      48KB

      MD5

      34d7b11df0908b64ca79dba2c8866acc

      SHA1

      9e12ff88896094e34366d25594b4963cb093a5aa

      SHA256

      9697b8bc25a527210f83f264a60a38e1769f4873267ae791ab9b1ce6c4688cae

      SHA512

      584880e5af118493a63fb40badb959997e7a638f65b028e792bc41cc2b14d9125e8f6565417da44fb6d48bb9faf19cee4fa008016f37e72a2f4cad516e29b750

    • /storage/emulated/0/com.smilingmobile.seekliving/log/demo_20240615.log

      Filesize

      112B

      MD5

      1bdea594e115b11a545872a68061ab5b

      SHA1

      0ae305d4aba9b4c8e2fc159aa66f10521e4f31be

      SHA256

      c6686ca92caa2eb11d6a95cc5305c721bb63863559ea8a333f821d4a63618e0c

      SHA512

      7efbe97f61bd816d430481dec09410ada3e672aa935d802f2525cf49b903978036dc60ab0de318143d2026b364429c2b1e361115927e50ce71fdf954102be086

    • /storage/emulated/0/com.smilingmobile.seekliving/log/demo_20240615.log

      Filesize

      45B

      MD5

      bea3be64393f37aca73644af4858ed29

      SHA1

      e3f6f974c7e35f61510157a81341986b5bff3081

      SHA256

      8ab869b18f2bde6ce4cd72ea3bfacc78df5444dc6b4b54d49d810101889f4f23

      SHA512

      8b75be96843858320c6daa14c514b4ac7f41f40a38c9214334b6f3d1ea151e66467ceec4196fab9f353676e2c81e108e5c720366903acf5032c1647114849f6e