ddf60e062eba4daca08ba2add4e522fdf71cfc25a9c310b4145b0019f3a456e5

Analysis

max time kernel
104s
max time network
187s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
15/06/2024, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae1d085e491ac29135dd2551f368161f_JaffaCakes118.apk
Size 4.2MB
Sample240615-m4w3cssajj
SHA256 ddf60e062eba4daca08ba2add4e522fdf71cfc25a9c310b4145b0019f3a456e5
MD5 ae1d085e491ac29135dd2551f368161f
SHA1 4025d4c0e73e9134594e97712ce471d64adf4f6b
SHA512 5e3616e20fbd8686e04c620463647f95803ba0e9482bb6f7de341f344eaf5556e3a9d339ac9ec6cf1e5720e2a56a0792360f97289e65ad52928d5aac4205e8ba
SSDEEP 98304:icMN5nxig4VsNi6hI+mzFN0o9OmE6cDTJsDV+cEezf34TRGnZOBz79uwDB:ib5nxR4Voi6Rmpmwo64VsR7HQ74wl
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.shiqidao.quban

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.shiqidao.quban/mix.dex	4667	com.shiqidao.quban
/data/data/com.shiqidao.quban/mix.dex	4667	com.shiqidao.quban

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.shiqidao.quban

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.shiqidao.quban

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.shiqidao.quban

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.shiqidao.quban

com.shiqidao.quban
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4667

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

mix.dex

Path /data/data/com.shiqidao.quban/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

tomb_1718449315176.txt

Path /data/user/0/com.shiqidao.quban/app_bugly/tomb_1718449315176.txt
Size 135B
SHA256 476f57a955c02a87991933ce7a690d9215c54ea132c37d904f7de5a58cc1cf52
MD5 3c3d47287c8906c9325f013011c4d3a7
SHA1 7b827a8772d3cda4547bf4b9c71b763e269d4ee8
SHA512 c69429ed5ac11a3dc9dd236cedcfeefab429c43145cc39f319737ce3153f1959236ea799c123c73fa849323633c4f22b1faad1c934de48d5ffdb4c14e055af79
MD5 SHA1 SHA512

Submit Download

bugly_db_legu

Path /data/user/0/com.shiqidao.quban/databases/bugly_db_legu
Size 116KB
SHA256 8e3ff1e38b93d1d2e926479c9b2ac4008b9866f0013b76dde061314df0f5012b
MD5 37275c92b8d34be73a1325f2c952d187
SHA1 8c1e609f036d33f258e3860454b31e7be01d55a1
SHA512 0d1ef9c212fe5b316845514bc3833f6e9e73cb3991df3e02031b7b800038e83fddd30acc344dd91bfc76fa85a65cf2d4ba7c9c8037b0e7d079ef20805ff564ad
SSDEEP 768:J89mJRjcEsE0pBUmQExIGXNTID89fVpYuYdBtdExlmOQH3v1vlviymvy7qubcKe6:rf0Qv1vlviyTD
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.shiqidao.quban/databases/bugly_db_legu-journal
Size 12KB
SHA256 f329ff5cd61324c83a10cd7a0ecb8cce398e0540c45f1cc27d95773b226d5c9d
MD5 4274d3b63881f470c449ed83c1deff0c
SHA1 ce60babad5da4122eaaee3457a05805a495a95fe
SHA512 12684214d255cb446fc8938d8d6e8645231ce7ad0ecb12876bb6fc62513fa6daf7d7923e057a0113180d97e89eb86e532a45167cd4cc958fa44728fdb3ea1159
SSDEEP 24:7+toqLmtmrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSpv:7MoqFZfrQiw6uMg6/YBg72meposSpv
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.shiqidao.quban/databases/bugly_db_legu-journal
Size 512B
SHA256 9049200649fe6edef3dd6f7e6f41ae10fa3869fa8eb4446ee8986ff5321ec6a2
MD5 96ff822742b17e8d795ddcc03a24cdeb
SHA1 dfb2b682838877d8aa9c2ed8b19605faa9a9aaee
SHA512 f1ee911940eb3891b7089da92e28e266f3bde7faeba08271f7f03273f9e960f91855382d85580f840bad6aa43234ae861bc3a2056a98f15c615f76ea2a7b798d
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.shiqidao.quban/databases/bugly_db_legu-journal
Size 8KB
SHA256 25bfd53249d7c70d8d7acd2f36209053f9d936a2313e030e59ca0d1870688c35
MD5 65df92af611f556ea66898daa891b46a
SHA1 d20b9c174e13f5037c032fccec7372f2cc5d3ac6
SHA512 667c625de25c6adb6d4fee0e252281a4bc7c9e77c4cadb940a0b0df3089c23c0c0f8fcf0a6dde99a0acd7965c26b5f2756ec8a3915a9def55645634851e46579
SSDEEP 6:7+/l9YrAUHn1uAW2vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK8Xn:7+tIAU9RqLiuWdYRmBEyPb1n
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.shiqidao.quban/databases/bugly_db_legu-journal
Size 8KB
SHA256 fbe5c92caca7db8101e44a80ebfa141feeda62e6e81373ac3412c04b90d400fb
MD5 cd3514bacd817ff8c848f733a19a8f62
SHA1 964e2285f49bfd1625adec9db6df0992aacebf02
SHA512 34ec99e149ec4e9fa03115a919f4cc7e57b822ab0a12c33e275576efc6d766b981b473ec649865b42c0384bab188ba1b36ed1a6f44845c19d106ad190e5076f9
SSDEEP 6:7+/l9vHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK5C/U:7+t1qLJdeWRmBEyPbTU
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.shiqidao.quban/databases/bugly_db_legu-journal
Size 8KB
SHA256 2454dd7f290f91d93579882b4bdc21879b15e9a7be736a48799a578dfcecd41c
MD5 435e7e7e646968f4465abdfba325ecb9
SHA1 441c398eb4b1c9ab44b13b23c2939a574a4f714d
SHA512 32d58d322bbc5c9c201b43ec6b24a63e40dc2df94d0d890f79ad8e8848811d2041a5df034ac0975d13175596e89f56bc4b713cb27c1b13b1e0cb43c1a9d9cfd0
SSDEEP 24:7+tIYjRqLTtrrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSV:7MDRqVZfrQiw6uMg6/YBg72meposSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.shiqidao.quban/databases/bugly_db_legu-journal
Size 12KB
SHA256 c684ffaad373f4ede199c224e06eb67d87a77dbb930b258728cd050035a7bf5e
MD5 666d415721a2f5ac6c6c7d2fddc5fb60
SHA1 b71507d5b222dc26e1c085a585a790b8b2a159c2
SHA512 d90fc6499e45f8b204dc55b606c260feb3be973e253bc31f0740227aebdb4d22423eb270aea70e9417dbb0b40426def34462f94e9182c41fc0522e09a50170e8
SSDEEP 24:7+tTrqLMvtYrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSi:7MTrqlZfrQiw6uMg6/YBg72meposSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads