Analysis
- max time kernel
11s - max time network
139s - platform
android_x86 - resource
android-x86-arm-20240611.1-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system - submitted
15/06/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
ae00f5e967b15ea492ffe1500ea489a9_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
ae00f5e967b15ea492ffe1500ea489a9_JaffaCakes118.apk
Resource
android-x64-20240611.1-en
General
- Target ae00f5e967b15ea492ffe1500ea489a9_JaffaCakes118.apk
- Size 29.0MB
- Sample240615-mkh2dsxcnd
- SHA256 6d03219e119a399057a6ca0609740b246fb5e0bed73501df8c2647a11e051974
- MD5 ae00f5e967b15ea492ffe1500ea489a9
- SHA1 4f6af731aa2be5fd20770ff7bada3713e72a8dee
- SHA512 7c70acc29e56b5829fd070987a1209d2006a9b267c84add7b4371f2e70cc05aa670c5b68c307fd5327e40e95f7e96e181f722ff04836b889c449194f77d6536f
- SSDEEP 786432:khyzO1BDRjkDG6aXAeIlabhrt5IZ/xK5uJ:jzWBDRjIG6aXnqalbIm5w
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/data/com.jsbzd/.jiagu/classes.dex 4268 com.jsbzd /data/data/com.jsbzd/.jiagu/classes.dex!classes2.dex 4268 com.jsbzd /data/data/com.jsbzd/.jiagu/classes.dex!classes3.dex 4268 com.jsbzd /data/data/com.jsbzd/.jiagu/tmp.dex 4268 com.jsbzd /data/data/com.jsbzd/.jiagu/tmp.dex 4335 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.jsbzd/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.jsbzd/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=& /data/data/com.jsbzd/.jiagu/tmp.dex 4268 com.jsbzd - Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.jsbzd - Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.jsbzd - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.jsbzd - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.jsbzd - Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.jsbzd - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.jsbzd - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.jsbzd - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.jsbzd
Processes
-
com.jsbzd1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4268 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.jsbzd/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.jsbzd/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4335
-
-
ls /sys/class/thermal2⤵PID:4382
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.jsbzd/.jiagu/classes.dex
- Size 5.9MB
- SHA256 da118f1ec14e5e90c57cdf94c40eef27bb2bb3964457288f5384f895e103e00a
- MD5 9b6b39202b4febc56b1cc50a45d15fb6
- SHA1 006cc6657df0945f9bece01be7d84273c3a41a70
- SHA512 669ac941dab1ac0aad89b2b0ab0d6e9868518613f68c66937514437f1fb564f268d561d92114db8199332ff474db35be303a7856a8d60d8048671a0b24a79fa7
- SSDEEP 49152:CVqA3PVvsppBgUvWSDlvNLOfl0fG3K62yab70LHEegsgSAqQCv0Ig1eWaCX+BwT:CVquPVvs+AU6GK6254vMMs
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.jsbzd/.jiagu/classes.dex!classes2.dex
- Size 6.5MB
- SHA256 56d265164154b7f43ed4f407cec707dc920a817dbad90f8cce5e72c05a71a238
- MD5 989166643c9f19c9c207919b970da40e
- SHA1 fc38a53d0dc9d108e73fba1836963e62f1898a11
- SHA512 6e5a65811293a8bda7efada855a53583397378be67a8a93d47835e2099b7683cab3ed4c169454bfde5a2b13f627ec2408a8a535115e6b8e831fb73c6e20d23ae
- SSDEEP 49152:O8HfNm2FJXvU6fpiTUAnAC4+dz6rUTXj0D4fKxFe5yF4jkpYYXxUVz3c:jHf7FJfU6gNu4TTBfgbHT
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.jsbzd/.jiagu/classes.dex!classes3.dex
- Size 314KB
- SHA256 f478cbf396c104f8c2b6edb3e4afb4ea6667208e854fefdfe26d8277930419dc
- MD5 106b97c90df2ad2dccf96631e4cbd001
- SHA1 a68cf3de8e1b09f969977bec42462927f716438a
- SHA512 9caf7d43246b615fd70ca498a38e51eae61497de64b20131b5117da36553e292d8c05f5b8f4eecb6b0b7b55d3e11181cc48439c52b995d475529a39e178e0a4b
- SSDEEP 3072:xkYImG0KYuQdJ5vRi4ssUe69s51VTSCYGqIILWssgAF+zCIINlRRICQ1KaeXrEUi:QrlQdXtUe66YGFECI6z5XlqTi+0whf
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.jsbzd/.jiagu/libjiagu.so
- Size 477KB
- SHA256 99cba035cae818dbdef989e70e738463798528b8ca52dbf38d2b8a72152680c0
- MD5 39d77dcad8e2a44dd7226f442b3a6c92
- SHA1 6560fa96c6b5a038abaeee5f139a16e46088d9d7
- SHA512 7ddfc6c05839160813e58e8f8c50d2dcda7e7b5e7f1d27cffb802ee91de4bb664bc5c257137d39152ed6e8cad0d3c1b067bf8aeb7e53f884893887b54480a5e5
- SSDEEP 12288:7JP4fCZt8eKrlQpfhFJfmibPkU3JlDBbilVm9n7Wo+:7JQfw0gjJVbMU3nBbiyh+
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.jsbzd/.jiagu/tmp.dex
- Size 284B
- SHA256 9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
- MD5 f1771b68f5f9b168b79ff59ae2daabe4
- SHA1 0df6a835559f5c99670214a12700e7d8c28e5a42
- SHA512 dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/databases/MessageStore.db
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/databases/MessageStore.db-journal
- Size 512B
- SHA256 f8d3b4b8966a52b70a7711a090540558e87ffc8c8f4a45c905727f0860abbcb3
- MD5 e7bb012899955e45d7576e8bd5fa11ce
- SHA1 06eac71b060ca86106fc74e3b020de1215544a2d
- SHA512 70b4f85ef5b9220062ddcfc9ed14c7449074ae312e5f5f467f42eddffeebe910408fdb3fee5405202167065980ca3e33a587cd4594d37e77e40505f33878c514
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/databases/MessageStore.db-shm
- Size 28KB
- SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
- MD5 cf845a781c107ec1346e849c9dd1b7e8
- SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
- SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.jsbzd/databases/MessageStore.db-wal
- Size 48KB
- SHA256 48d9e7c07e98be027ba4110bdd1ac07ebec634b2bb85f268fba0a6579a9d0e31
- MD5 f197054d970a5664e0c130f8b4754ebb
- SHA1 d24e5d29e744dba13cc0b34d7331a732a7a8239f
- SHA512 926eba95e090988c53387e50eba1483293954fcb83e6fd0d75310465c938683e1787739e52736ee8526233d6eba5f34332b43be489f40587d1b68289a4d4cdac
- SSDEEP 24:KcgzyGSP/ml3k0flUi/UPzmD6ZWaJyZ4M0yAN9GSP/5gmltCpl:BgzNSP/S3hlBRvZ4M0yIoSP/mml
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.jsbzd/databases/MsgLogStore.db-journal
- Size 512B
- SHA256 5fd5af46be3675f702d6e842a122f734307967071276c7e278d58ef911b99eaf
- MD5 06f0291b1a7dcbc54c77b97e8a06b0e7
- SHA1 d23d7d515aac1e3b3bde8b2499a9cd61a0c53e1c
- SHA512 e49880880114014bde32a47a0afe06af45370b7dcd0f3fad2bad886d779abe3744c338b49b048fa00101da2957f5e079007d76f13a25d6a82175a3a64ffb5989
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/databases/MsgLogStore.db-wal
- Size 68KB
- SHA256 825aad68018825691959f89472290758933378fcb13ee3c4e64dce1d319495eb
- MD5 ae47916a7691ec73ca98972909a99af7
- SHA1 7814bf7ca208d48b3c6e3858e47335993aa5a19d
- SHA512 3b093cbccb4c97ae57158c85091f655bd1d6adf40326dd1c30e919d9aeb52d2f1c8c9b6ff55e0af13d0746f949b1524cb6888311bb24f80491160070377afad0
- SSDEEP 48:BzNSP/3e6pGF33QO+t070OCJfhF8GIUWZw3RSP/YjXG:V0PPe60tQG0OIwPQjXG
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.jsbzd/databases/accs.db-journal
- Size 512B
- SHA256 39c35308c7e12863d8509e51223409ff72184d42dde5b537e47bc1166d67021d
- MD5 0a205fbb03699d6856985b48db736eff
- SHA1 ac254da211a8e39a76afbd62196273ea23c980f4
- SHA512 c7cd5e00c882d31b97fb2594d18e2bfe71700cf6e11cefdd90f999dc8d0201995cdb9b0ff182f1c4bf7b369bfb8325f07f05997ba4ac9e5cb5cf21c936b75bfc
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/files/.jglogs/.jg.ac
- Size 32B
- SHA256 a62043bd93892b168f3657038320439811e424bfbab64e519a9081ebda1d0b78
- MD5 fa96c004f75d873c75948fce17a0284f
- SHA1 82043a99b8cf0f7255a2092349d2bcec8fc51f01
- SHA512 125d711ee9f3593dac4140faadf8e65eb6433a7d24e1ab06bdd4399af13d4e4d32bcc44496db33ae052583133a132b1aa9a416491cee787e6051cb5ce227a3f4
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/files/.jglogs/.jg.ic
- Size 32B
- SHA256 866cd979137c9add0b8b036eae5499426be93acf8af5676436c0eca101b08fbb
- MD5 06ea330ef44ed7a59c71087008ef297b
- SHA1 7cefdc485705de20c724304a82988d3074b67cd6
- SHA512 d1982dc61122a574c6573893ff083771f5687da503cc3c89da93c98a3f48b03228c695605c669eb1d86ea122f0f5982f359c7b85319debeb3608ab175750c129
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/files/.jglogs/.jg.pk
- Size 32B
- SHA256 67101450843018ddfae5f0a621b2d169eaec536a173072641cdafab850b0c036
- MD5 0b5aeab6522406d3de22e3ec40bd504a
- SHA1 7f0b66fcd9cbc1aec0a25537797b7aade67fa794
- SHA512 7af9ebb0dbee31ae31f31b2ed11345471d2a9670b6dc126556cee1167505d7a1c252cc97ee697c6ab44801374c49ece2c5235db962b7ae767b5812dffa73a018
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/files/.jglogs/.jg.pk.h
- Size 64B
- SHA256 15ca26171774e38232601e2698135793b2ceb9e44737fcf3c692d9024bfd5e27
- MD5 df5b5a4cb1afc32150538b6f218f49ad
- SHA1 a4103ba3766692c80d4b21522440a39483d1f53f
- SHA512 cbb6d3027acb475a1206d5769f5d412e175f37c546ea2b18ee70b32f0ed9bcfb3f2a5bd2e1ce0b4f9bc2e33b870c97bf067639c018c1465f57d9ab00aedae36a
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/files/.jglogs/.jg.rd
- Size 73B
- SHA256 221fc169fbe3043e7e07a93e1417ad1968688d8fe1c48674a82759afd38deeb5
- MD5 463f39816723ed65fa5263168b8b6c80
- SHA1 e965b5c69315a177bb9c14ab28a423a92b65c200
- SHA512 0a7a23742263368b7503e103a20edac02d0a0b5b902d2a6aecf9d50ee0e9686bdd8eb9c89d30de1e9937d2ee6781f63d172dc37399ba33606092d24895bf7d45
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/files/.jglogs/.jg.ri
- Size 307B
- SHA256 7a2a6ab9146b6adf594591eaf89024e220833571a80ba9b0805a68bef3245ca7
- MD5 ea5dde856c3f2fb2840b9e5e436e1153
- SHA1 882c7a501b35f1bdef65b244f34bbb24a95232cd
- SHA512 9b522f0cc165c508c26b64c172439cc8f2e5cb72db8281b6220e9e7254fa3c638a66af501498ab5af555d4f79356cf4b9fd57467302d516fd8456ca4ce312949
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/files/.jglogs/.jg.ri
- Size 314B
- SHA256 ad44bedbdf34817aaea4c14e8af0a3803db0033dbfe0a8559ea6f2b60eadead2
- MD5 37fca394be30a7d971ab62f302e5485e
- SHA1 e667c0e262f9bce7505e687effe395889d8c3625
- SHA512 8a9cf7ad1eb8e89a76421f08d9657089a88dcd1f683e5b682a9d43a87a031e28fcabeac3d9f2f11180573910f7b121c10033310ba534e561c75a75edf3d3381b
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/files/.jglogs/.jg.store.report_pid
- Size 32B
- SHA256 4656d55e2491a15bda72f9c3fc0b02e26c1491f8bc1acaa53b1218a0d36cd795
- MD5 80eb0c49a8eece8d0c0b974bba88b82f
- SHA1 c233c70d71b12346a8d37d800e67a3222f1c006b
- SHA512 5c21f596cb433b478e9ca01d75c3c3d834dd20749da77ff0aa64a10a9230d55c9d3110cca10cb48d310e384ab0a6b97baa54c5caed59759eed3c3608e4a04ab0
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/files/.jglogs/.jg.store.report_pid
- Size 54B
- SHA256 dbf0975bde2f8ab5d0b200292951e22f0d8e81f1e915521a5c342bb2b7f78dfb
- MD5 8e2b483c64d97f5543b36f6c4f62d480
- SHA1 d6ebd34c70c96e18e7baf35ce29597834890296f
- SHA512 bdb27e41da6b2d6552da37e4b782f76d51277119cb5ba2f34a6b44b9536b10f91f574329e279bd12a38f99d8b27627159349e93db7da9a03ad87b911dac65e3f
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/files/.jiagu.lock
- Size 27B
- SHA256 392ce7336977f2b8bbe549a293553ca44567b60685b241be2fe156c1ebb3e932
- MD5 87d16a6287fd91c38a90510d6c486232
- SHA1 63840af962dab6616d04c1fb87c8dc27c869c7bf
- SHA512 fc6f183f635f1f4140c22fa3faea300b19a90b1411ce911f4d3bd55b1fad61487416832259e996f21174f897fe0b03f2ae185f7746aceaee70a483b4305c2bae
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/lib-main/dso_deps
- Size 252B
- SHA256 adf9a6f1036177ec9ccd7c66c38aa62e19bbd0cf4e7550060c29b155c630fcfd
- MD5 89024cfa30a153bddc34340e2dca8163
- SHA1 0b86dfb993a91fd31f4d030742d4dddcaf3f6fea
- SHA512 8cd3b23cc18cdc3412deee453d3b167f6c0ee8d4641d35cf38e577605f9fb847d0d00e775dd89d9c8790017b10dda2502d71ce55b65a37e8e364ccd3d465b840
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/lib-main/dso_manifest
- Size 5B
- SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
- MD5 c06857e9ea338f3f3a24bb78f8fbdf6f
- SHA1 c5a0a2529d2deb60fec041b4fbd722a2ebe31702
- SHA512 29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/lib-main/dso_state
- Size 1B
- SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
- MD5 93b885adfe0da089cdf634904fd59f71
- SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
- SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
- MD5 SHA1 SHA512
- Path /data/data/com.jsbzd/lib-main/dso_state
- Size 1B
- SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
- MD5 55a54008ad1ba589aa210d2629c1df41
- SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
- SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
- MD5 SHA1 SHA512
- Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
- Size 65B
- SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
- MD5 9781ca003f10f8d0c9c1945b63fdca7f
- SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
- SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
- MD5 SHA1 SHA512