Analysis

  • max time kernel
    11s
  • max time network
    139s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    15/06/2024, 10:31

General

  • Target
    ae00f5e967b15ea492ffe1500ea489a9_JaffaCakes118.apk
  • Size 29.0MB
  • Sample240615-mkh2dsxcnd
  • SHA256 6d03219e119a399057a6ca0609740b246fb5e0bed73501df8c2647a11e051974
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.jsbzd
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4268
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.jsbzd/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.jsbzd/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4335
    • ls /sys/class/thermal
      2⤵
        PID:4382

    Network

          MITRE ATT&CK Mobile v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          classes.dex

          • Path /data/data/com.jsbzd/.jiagu/classes.dex
          • Size 5.9MB
          • SHA256 da118f1ec14e5e90c57cdf94c40eef27bb2bb3964457288f5384f895e103e00a
          • MD5 SHA1 SHA512 SSDEEP

          classes.dex!classes2.dex

          • Path /data/data/com.jsbzd/.jiagu/classes.dex!classes2.dex
          • Size 6.5MB
          • SHA256 56d265164154b7f43ed4f407cec707dc920a817dbad90f8cce5e72c05a71a238
          • MD5 SHA1 SHA512 SSDEEP

          classes.dex!classes3.dex

          • Path /data/data/com.jsbzd/.jiagu/classes.dex!classes3.dex
          • Size 314KB
          • SHA256 f478cbf396c104f8c2b6edb3e4afb4ea6667208e854fefdfe26d8277930419dc
          • MD5 SHA1 SHA512 SSDEEP

          libjiagu.so

          • Path /data/data/com.jsbzd/.jiagu/libjiagu.so
          • Size 477KB
          • SHA256 99cba035cae818dbdef989e70e738463798528b8ca52dbf38d2b8a72152680c0
          • MD5 SHA1 SHA512 SSDEEP

          tmp.dex

          • Path /data/data/com.jsbzd/.jiagu/tmp.dex
          • Size 284B
          • SHA256 9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
          • MD5 SHA1 SHA512

          MessageStore.db

          • Path /data/data/com.jsbzd/databases/MessageStore.db
          • Size 4KB
          • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
          • MD5 SHA1 SHA512

          MessageStore.db-journal

          • Path /data/data/com.jsbzd/databases/MessageStore.db-journal
          • Size 512B
          • SHA256 f8d3b4b8966a52b70a7711a090540558e87ffc8c8f4a45c905727f0860abbcb3
          • MD5 SHA1 SHA512

          MessageStore.db-shm

          • Path /data/data/com.jsbzd/databases/MessageStore.db-shm
          • Size 28KB
          • SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
          • MD5 SHA1 SHA512 SSDEEP

          MessageStore.db-wal

          • Path /data/data/com.jsbzd/databases/MessageStore.db-wal
          • Size 48KB
          • SHA256 48d9e7c07e98be027ba4110bdd1ac07ebec634b2bb85f268fba0a6579a9d0e31
          • MD5 SHA1 SHA512 SSDEEP

          MsgLogStore.db-journal

          • Path /data/data/com.jsbzd/databases/MsgLogStore.db-journal
          • Size 512B
          • SHA256 5fd5af46be3675f702d6e842a122f734307967071276c7e278d58ef911b99eaf
          • MD5 SHA1 SHA512

          MsgLogStore.db-wal

          • Path /data/data/com.jsbzd/databases/MsgLogStore.db-wal
          • Size 68KB
          • SHA256 825aad68018825691959f89472290758933378fcb13ee3c4e64dce1d319495eb
          • MD5 SHA1 SHA512 SSDEEP

          accs.db-journal

          • Path /data/data/com.jsbzd/databases/accs.db-journal
          • Size 512B
          • SHA256 39c35308c7e12863d8509e51223409ff72184d42dde5b537e47bc1166d67021d
          • MD5 SHA1 SHA512

          .jg.ac

          • Path /data/data/com.jsbzd/files/.jglogs/.jg.ac
          • Size 32B
          • SHA256 a62043bd93892b168f3657038320439811e424bfbab64e519a9081ebda1d0b78
          • MD5 SHA1 SHA512

          .jg.ic

          • Path /data/data/com.jsbzd/files/.jglogs/.jg.ic
          • Size 32B
          • SHA256 866cd979137c9add0b8b036eae5499426be93acf8af5676436c0eca101b08fbb
          • MD5 SHA1 SHA512

          .jg.pk

          • Path /data/data/com.jsbzd/files/.jglogs/.jg.pk
          • Size 32B
          • SHA256 67101450843018ddfae5f0a621b2d169eaec536a173072641cdafab850b0c036
          • MD5 SHA1 SHA512

          .jg.pk.h

          • Path /data/data/com.jsbzd/files/.jglogs/.jg.pk.h
          • Size 64B
          • SHA256 15ca26171774e38232601e2698135793b2ceb9e44737fcf3c692d9024bfd5e27
          • MD5 SHA1 SHA512

          .jg.rd

          • Path /data/data/com.jsbzd/files/.jglogs/.jg.rd
          • Size 73B
          • SHA256 221fc169fbe3043e7e07a93e1417ad1968688d8fe1c48674a82759afd38deeb5
          • MD5 SHA1 SHA512

          .jg.ri

          • Path /data/data/com.jsbzd/files/.jglogs/.jg.ri
          • Size 307B
          • SHA256 7a2a6ab9146b6adf594591eaf89024e220833571a80ba9b0805a68bef3245ca7
          • MD5 SHA1 SHA512

          .jg.ri

          • Path /data/data/com.jsbzd/files/.jglogs/.jg.ri
          • Size 314B
          • SHA256 ad44bedbdf34817aaea4c14e8af0a3803db0033dbfe0a8559ea6f2b60eadead2
          • MD5 SHA1 SHA512

          .jg.store.report_pid

          • Path /data/data/com.jsbzd/files/.jglogs/.jg.store.report_pid
          • Size 32B
          • SHA256 4656d55e2491a15bda72f9c3fc0b02e26c1491f8bc1acaa53b1218a0d36cd795
          • MD5 SHA1 SHA512

          .jg.store.report_pid

          • Path /data/data/com.jsbzd/files/.jglogs/.jg.store.report_pid
          • Size 54B
          • SHA256 dbf0975bde2f8ab5d0b200292951e22f0d8e81f1e915521a5c342bb2b7f78dfb
          • MD5 SHA1 SHA512

          .jiagu.lock

          • Path /data/data/com.jsbzd/files/.jiagu.lock
          • Size 27B
          • SHA256 392ce7336977f2b8bbe549a293553ca44567b60685b241be2fe156c1ebb3e932
          • MD5 SHA1 SHA512

          dso_deps

          • Path /data/data/com.jsbzd/lib-main/dso_deps
          • Size 252B
          • SHA256 adf9a6f1036177ec9ccd7c66c38aa62e19bbd0cf4e7550060c29b155c630fcfd
          • MD5 SHA1 SHA512

          dso_manifest

          • Path /data/data/com.jsbzd/lib-main/dso_manifest
          • Size 5B
          • SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
          • MD5 SHA1 SHA512

          dso_state

          • Path /data/data/com.jsbzd/lib-main/dso_state
          • Size 1B
          • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
          • MD5 SHA1 SHA512

          dso_state

          • Path /data/data/com.jsbzd/lib-main/dso_state
          • Size 1B
          • SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
          • MD5 SHA1 SHA512

          Alvin2.xml

          • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
          • Size 65B
          • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
          • MD5 SHA1 SHA512