Analysis
- max time kernel
179s - max time network
173s - platform
android_x86 - resource
android-x86-arm-20240611.1-en - resource tags
- submitted
15/06/2024, 06:49
General
- Target ad37d6018e06c30c07ef9d0f6ed85862_JaffaCakes118.apk
- Size 30.4MB
- Sample240615-hld2ls1fmg
- SHA256 74710e39c89b62e7730d0d20eebe5b91d2bb10c76b89b7260867733f7ccf042a
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 4 IoCs
- Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
- Queries information about active data network 1 TTPs 2 IoCs
- Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 2 IoCs
- Checks memory information 2 TTPs 2 IoCs
Processes
-
com.youmeng.foodzombie.egame1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
com.snowfish.a.a.bg1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
EGAME_SDK.dat
EGAME_SDK.jar
Signature
egame_sdk_1.png
egame_sdk_16.png
egame_sdk_25.png
egame_sdk_4.png
egame_sdk_9.png
egame_sdk_bg.9.png
egame_sdk_bg_pay.9.png
egame_sdk_bg_ticket_left.9.png
egame_sdk_bg_ticket_right.9.png
egame_sdk_btn_back_normal.9.png
egame_sdk_btn_back_pressed.9.png
egame_sdk_btn_green_normal.9.png
egame_sdk_btn_green_pressed.9.png
egame_sdk_egame_logo.png
egame_sdk_game_icon_default.png
egame_sdk_icon_back.png
egame_sdk_icon_close.png
egame_sdk_icon_loading.png
egame_sdk_icon_pack_up.png
egame_sdk_icon_password.png
egame_sdk_icon_rmb.png
egame_sdk_icon_selected.png
egame_sdk_icon_spread_out.png
egame_sdk_icon_ticket_more.png
egame_sdk_icon_unselected.png
egame_sdk_input_box.9.png
egame_sdk_logo_aibei.png
egame_sdk_logo_chongzhika.png
egame_sdk_logo_dianka.png
egame_sdk_logo_huafei.png
egame_sdk_logo_jdzhifu.png
egame_sdk_logo_more.png
egame_sdk_logo_weixin.png
egame_sdk_logo_yinlian.png
egame_sdk_logo_yizhifu.png
egame_sdk_logo_zhifubao.png
egame_sdk_password_input_box_left.9.png
egame_sdk_password_input_box_mid.9.png
egame_sdk_password_input_box_right.9.png
egame_sdk_pressed.9.png
egame_sdk_tag_selected.9.png
egame_sdk_tag_unselected.9.png
libegamepay_private_dr2.so
libegamepay_private_dr2.so
libegamepay_private_dr2.so
.imprint
exchangeIdentity.json
duration
duration
duration
duration
duration
duration
egame_log_cached_file.log
egame_log_cached_file.log
egame_s9121354826993266617.tmp
egame_temp.jar
st_database.db
st_database.db-journal
st_database.db-shm
st_database.db-wal
umeng_it.cache
umeng_it.cache
egame_temp.jar
C545C57380E94F57133C605FF10B5E66
EE53AF5B170264468E95E783E26D76C2
EE53AF5B170264468E95E783E26D76C2
res.apk
res.apk.u