34a49c3275177b982b842f8c1d0041c2a377ee2758f54b97408fc309543c7aa9

Analysis

max time kernel
177s
max time network
185s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
16/06/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b59bc915e3623e94b99c6223a9cc93ac_JaffaCakes118.apk
Size 9.3MB
Sample240616-2vmvnasbqc
SHA256 34a49c3275177b982b842f8c1d0041c2a377ee2758f54b97408fc309543c7aa9
MD5 b59bc915e3623e94b99c6223a9cc93ac
SHA1 d4034e9916460b39367ce9acc24e8d753a1483e8
SHA512 42e62213a976ed19cbc2941be021d055e1dceb6f484e9e66c9966abea501c06d1583c232d7565d32627ddd8ae5bc13e3b147c3243ce3e26ed8dba6913e12d9c3
SSDEEP 196608:1Fuv0PT2SVYB6dTEb7zJ0yl9W9D/6W/QIiM2w4bEMn0Mk/7N05:+0C14TE7+oI9Dya5ikGEM0x7NY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.h5web.apk	4207	com.mopote.app.market
/data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.push.apk	4207	com.mopote.app.market
/data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.snareden.apk	4207	com.mopote.app.market
/data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.h5web.apk	4604	com.mopote.app.market:pushservice
/data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.push.apk	4604	com.mopote.app.market:pushservice
/data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.snareden.apk	4604	com.mopote.app.market:pushservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.mopote.app.market
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.mopote.app.market:pushservice

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.mopote.app.market

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mopote.app.market
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mopote.app.market:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.mopote.app.market

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mopote.app.market
Framework service call	android.app.IActivityManager.registerReceiver	com.mopote.app.market:pushservice

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mopote.app.market:pushservice

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.mopote.app.market

com.mopote.app.market
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4207

com.mopote.app.market:pushservice
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4604

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

com.anzhi.plugin.h5web.apk

Path /data/data/com.mopote.app.market/app_plugin/com.anzhi.plugin.h5web.apk
Size 130KB
SHA256 36c1bcdc853e392bc1f6ff3276f5abc32a4fb75f3616bf6bc293935978176a93
MD5 c1570daad8a3b52e79f4016218940391
SHA1 5534c66037564b0de9b3c803cd654af4d0b24e74
SHA512 e15e1062fdcd605992df044c3853944b2270500a1b4e6cff9cc85e17db3685eca4a47a57fd08d59c74794950635fe60b230eac8d359ae4d9e5abde5f5d55ecf2
SSDEEP 3072:38Op5d6ZKxX08ou2qf6FchOm9HGE4ln4bYe:/l6EC8wghxmhne
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.anzhi.plugin.h5web.apk.raw

Path /data/data/com.mopote.app.market/app_plugin/com.anzhi.plugin.h5web.apk.raw
Size 130KB
SHA256 3928b9989eeae2f7590c80d3d5559b331b4e301e9dc5cc627fdff9d389418cec
MD5 f570be6e4cdd0741df4bd1cd5b7d89fd
SHA1 3811d79fcf75cff1790e1115fb3db5f87cc8bfc7
SHA512 8199a5d75240bcd7e31368f4d4d397b0fe7f5d97d3ace71a9b84299fea0c0896609a6d7d1c598cf7be7cd80a421a2e94ea2f4dad559f1b0b1030921efa013bce
SSDEEP 3072:3wO15d6pDxX08ou2qf6FchOm9HGE4ln4bYe:7B6dC8wghxmhne
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.anzhi.plugin.push.apk.raw

Path /data/data/com.mopote.app.market/app_plugin/com.anzhi.plugin.push.apk.raw
Size 41KB
SHA256 fe20daf98ed5117dc4f24b9794329c4da1d713f6e1ba36708b38ab6a009c92a8
MD5 c84d54a9dc3077293d30594efe03de5d
SHA1 14e739b3d6de4bc62234c0c75e682e6c3cb0cc24
SHA512 7849168b65f8eab21edcda80f648a8027729585d76d6bfb58f835d08634c3e64ee801436167744a949ac380330809807ef98741ef1874453552e3e975797ec8c
SSDEEP 768:qFeCJZ5scifbtJp4k+3lxp3kbgzybMDLwUTB5871shgfU0Tty6iAs:qFpJZWcifbXp4k+e0ebMgEE1MWbTtoh
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.anzhi.plugin.snareden.apk.raw

Path /data/data/com.mopote.app.market/app_plugin/com.anzhi.plugin.snareden.apk.raw
Size 197KB
SHA256 e41e21c2377172811bba0fed31005d67330990924fa0fdbbd6bcbc04ecff41bd
MD5 79029ee81645afa9ff5f72be2eee9887
SHA1 bbadd44ace1f0b4584c1b7c679208f6116780c90
SHA512 cc8810c9ea3479eaadb2819a8b98f87599c6d40f8d39cb47e69c57887c286c27f0d1012e542ccdca2415f819cc261f1fc4aa7459dad317d5c8967fe438841fe1
SSDEEP 3072:NeltrxVSZy3ej1gMtz+hu6ryKZxrvu3aD6hz0sRqZn8HfgR1Z1YlEvkFlIEkrzJA:i8E3eji8ziHxoaWxgCQ1glEvkTIEszJA
MD5 SHA1 SHA512 SSDEEP

Submit Download

1401095385.db

Path /data/data/com.mopote.app.market/databases/1401095385.db
Size 120KB
SHA256 21978acb1bec1432b56b967da5d63cc6debc89e1341b8983ceebd88ad6ed7fe5
MD5 2271a9090e380810dbd2701d83edc294
SHA1 b58116b0b77cacda4be2cb4ac6a62e1101fd1063
SHA512 06a67668d6ab4615fa3d5d91e7390775d48da2679c68a38ee33b51b340b1c472a7142d0dd07cd386034cdeb1bdc2d20d5ee1aea7164bc3851bfa7b66ec08dcca
SSDEEP 3072:lT63ORLC5OsoRpGpQnQOvPRs1OhT6zjdCJFidEgRl:03ORPsorR7hT6z0JFZu
MD5 SHA1 SHA512 SSDEEP

Submit Download

anzhi_assist.db-journal

Path /data/data/com.mopote.app.market/databases/anzhi_assist.db-journal
Size 512B
SHA256 4ec0dbb7b7bc2b929702af4eabd08a214d3db71a1359611b4c4e21fb6c1dde6b
MD5 006399f82cb4e4ecf44952fe9fd0447d
SHA1 fdbb36d478625b9a519e651c535cf5cd674c70ad
SHA512 825068daa5273915c4eae785cfe7c38b4c515e82464c992591885e81845d2baaf6b906124b13c509cd04a5e6aaa92286d804458ed8f0549a0d0b34fa3274c1e4
MD5 SHA1 SHA512

Submit Download

anzhi_assist.db-shm

Path /data/data/com.mopote.app.market/databases/anzhi_assist.db-shm
Size 185KB
SHA256 6cdbdb44601d44aadad3bdb5618113ae5f45254bdbc37905b8038c983d0dfdc4
MD5 bb02b68ca4dd96d95069a66e30d4732e
SHA1 8068ce1540d27193d858f6cd1afb976e7b452aeb
SHA512 25d14db29322c9b77e80d26a0d63c164f521225e775effd783d476bac1d0763767eca82b964965b3ba5eaf57d33bde606578c97536b221df4f9ff90f3d9e887c
SSDEEP 384:N+XH+G1wtFvx/O2QQBRiB5mWVzTufuvRV/Y:N00
MD5 SHA1 SHA512 SSDEEP

Submit Download

anzhi_assist.db-wal

Path /data/data/com.mopote.app.market/databases/anzhi_assist.db-wal
Size 44KB
SHA256 bc3c8d907071b1e31b5ad008e5ddfcf5e43c51a2d483d058809d9c44e7dedf22
MD5 f5544bfca6513458d8c600edafa9a4fd
SHA1 4099829efff2d30a57bd769e8d337b9351e5ed1b
SHA512 ac863d76bbb9d5e6ab715b3fd4c6b6386b623a560ce78e9103f86d3616cd8e0b2e0ed0623edfcd0f80056266c790775cbe7ed21c1e6642aa5b301fd362af7f51
SSDEEP 24:7+t/2GSP/sTpy1EB0t2FCO47ylwnPMFNoRmu39cXCBsKGSP/W2R:7MRSP/g4eB0t287OwnOeRzkCBsVSP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

anzhi_new.db-journal

Path /data/data/com.mopote.app.market/databases/anzhi_new.db-journal
Size 512B
SHA256 4b49cac0b11eb4a82c225e653563a8da7b5be0ee041868baa6f8aa114d82c852
MD5 e26d6b4a1c4df162bba237c99666ffb2
SHA1 aace13471754b8940a46c609448ddfd105b726e1
SHA512 acb556b158df3a544dcb9ab216f9de587d1682456e36e05366f0f49bac2762847fa52f546525358ea8f6c609128f2ab998965252a7ec7ab7753e0293d9d80b31
MD5 SHA1 SHA512

Submit Download

anzhi_new.db-wal

Path /data/data/com.mopote.app.market/databases/anzhi_new.db-wal
Size 189KB
SHA256 60d619ade29c1ea032cad46b93fb39b09c79c222aaf138a3ecc315f022878812
MD5 472389b5c25c0f764f3fcb3e8b220652
SHA1 d32098c0c0c28958fd8f2130fd25ec3e86bfd0b4
SHA512 735910a528962864f11d8096974f19b2e0a418f51fa6ea288dc78051ef9fee0c3df194ddd8321220f2695980deb6349762ce017b1cb409eeb9344d3acd76e9ac
SSDEEP 96:p0Pk+qcrVibgRXrndR3MzflatsAbFZSocsDSeQUshn13oRWm5wkQ6zfhRmQV:aZqyVHhrndFsfAjrBXJghn1QW1+fnms
MD5 SHA1 SHA512 SSDEEP

Submit Download

appmarket.db

Path /data/data/com.mopote.app.market/databases/appmarket.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

appmarket.db-journal

Path /data/data/com.mopote.app.market/databases/appmarket.db-journal
Size 512B
SHA256 0adb662ce0e22603af6fdda2bcde8a632dbe27830e4ece871e3b0aa17f0d73fd
MD5 73847c9db56cbd483e522cbd311c94c2
SHA1 dc3480139c5d0e13c8b7a871e3b9e32d588c8336
SHA512 bff9f326eb7bfc24d1229b25d231ef99c3245c0c7b6ce21a624ddd8ae12fd59d9cc12f0a55634ee75b7881a6acde730bbba0586716e813afb5320294dcfc0aee
MD5 SHA1 SHA512

Submit Download

appmarket.db-shm

Path /data/data/com.mopote.app.market/databases/appmarket.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

appmarket.db-wal

Path /data/data/com.mopote.app.market/databases/appmarket.db-wal
Size 32KB
SHA256 ba96d779b1629cc88c851aa35fd7ae0bbd32359692dd98cf08ee8e3c87ad9afb
MD5 3bd7f3cd8241dc8d02f34e75f3bffcf7
SHA1 ab45722e58d32b2cf18e2d07c80d5a818f1d951d
SHA512 458d5a0ecceadae8d65121296650c0d623c7db838132de9b0ba83ed0b49c05bf9df4e382b083e50f45bb603966e79fe7e855d9f28513ca9690c696ccb9ea54db
SSDEEP 24:KYLkg8zyGSP/WcGOLeh+mGz1vL5eL5rQfL5m9ngKuqcGSP/WwnL:qbzNSP/ByEz1VerQFm9ngKhbSP/B
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.mopote.app.market.db-journal

Path /data/data/com.mopote.app.market/databases/com.mopote.app.market.db-journal
Size 512B
SHA256 0af0d37e058737b523088fedace5db7b712d14234f4a73172698031da144ca71
MD5 e97f15f6fa6919cf24c49e07372ad6cf
SHA1 13dfa1eea2542e5c6e0caaf69014a107329a0b42
SHA512 8b5f2ce1c03c916c628e6e4ac37dd0b1226a5889e56ffbd088c545816429830a5cda44a818a639a388b42cea3f4cd17eb20e1a29b66928f1243c3e954fd03e47
MD5 SHA1 SHA512

Submit Download

com.mopote.app.market.db-wal

Path /data/data/com.mopote.app.market/databases/com.mopote.app.market.db-wal
Size 36KB
SHA256 e2ab6d5c7ba8e9a93d9eea51aee4357e7f97dc1b7936a679a1e2013dd284d490
MD5 7c96285136af40038c449bc762b457ea
SHA1 090a7381595ffdec71bf038d0a409aaa7a48ede7
SHA512 138eb1f8bae8f1cfaed7b1bc8fabb7ee351b42ba59bda15f9b1b2c23a815e579e9609f69813acbaf4493b6b07e0767e04082d0260fed7cd2b6b517a64712df52
SSDEEP 48:qzNSP/8jHvd7jp88+J4V7Wupce5SP/Ce:60PETBFOBHjP
MD5 SHA1 SHA512 SSDEEP

Submit Download

gtc.db-journal

Path /data/data/com.mopote.app.market/databases/gtc.db-journal
Size 512B
SHA256 9a2d2891eb151d26d9fd4ccf89653645baec34ffcc89332da5a147af00470cd5
MD5 98f80f27c31d3566e452f10102975086
SHA1 40aac1686e8a4ad433bfd768e7ba92046a04c001
SHA512 6799b707710351123278e37d2d23e199bfc5422b609e7bea0170f786fa059fba4b97d3cc459ad19810acccd1196f88ef7252dbf4056cde44d8159825694abd1b
MD5 SHA1 SHA512

Submit Download

gtc.db-wal

Path /data/data/com.mopote.app.market/databases/gtc.db-wal
Size 128KB
SHA256 80012ac04cc2c3b9dc8baf839f00675943224e9cf369a827dd90410b0d576c83
MD5 d81b09b82663726cff7a3297283413b0
SHA1 8adcaaae018875b452e1ed26f7f165de73c8f3bc
SHA512 f80ff44af28bc5a78bf6ddab5c7bafd38bbf777a5b91f087d8ce6e39640e0818f080890b02887022b265f2257d2eac8070276de73b73fdd49304dee947e773f0
SSDEEP 96:20PBUfMPLsz9cHdtr4ZryJrKFrwHrLer1ZUrd:R/L26/WQwsWHEd
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.anzhi.plugin.h5web.apk

Path /data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.h5web.apk
Size 177KB
SHA256 5a4331a4e09479778c01e18cd9950f0a98aa614324cb4e01c0715838d65949fb
MD5 e9669f9b9f8abf55bc261f57905bc2b8
SHA1 588506982b4de4b52bb646894c0cecd791294c3e
SHA512 e7db40eec28fecf71f1ec0edd9fa026781c399163dee16d4f9e40a49c4875f6ab0aace1800def25826a4e7b895c49a9536f5d71301565ea8f384311b969071f3
SSDEEP 3072:iryYPduaXE3yJl1r0Gb92u21G1RnEZe7YjzhlsPA49d2MxLStMHzu:iryYzXN3929yOMa
MD5 SHA1 SHA512 SSDEEP

Download

com.anzhi.plugin.push.apk

Path /data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.push.apk
Size 78KB
SHA256 4a34accf323c10a43bfdd2d3eb38dbee203a7f5abe7b2091f94d020edc977531
MD5 0ba8ab7884d7809051c6b4c51d74804e
SHA1 0b19cdc38ddfd5159a52d893fd838026344519e3
SHA512 8dcb78b2c1d8455c412d4f76856e3eb779e417ab0ca0975865d5a5800e35f682381b0abf2b8c9b4e4869b21f90a67d05f73a0452993e52856e9aca60c450ac70
SSDEEP 1536:zDIBKhLDmPsVm2rvWy/da7qveGGIFYS3PLVyUNueOUMoQ:vSkKYm2ay/syeGG2jVyUMcMoQ
MD5 SHA1 SHA512 SSDEEP

Download

com.anzhi.plugin.snareden.apk

Path /data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.snareden.apk
Size 168KB
SHA256 c6821e9fc86683b0fdaf95f37eccfb038fcdfbfa1fe3960fcb093ff09c037e24
MD5 dc0bf2503b641eb1ff2caf66dff662b6
SHA1 4f8874fad2ce58371fcc497856e369fda904f381
SHA512 ba947435c7cc7d2412f9672887c1072f4d898883bb653f10b624664c7c268512789fdb030ae6ae85b903f48c33d74a2ecf2e62d992eb1ec8f7e5e908e30e3e92
SSDEEP 3072:44uhhGmi/rIpM7g62ISQtxaWj3TMLJ9y7/w0/8V0h5olnKb3SoP2oOZoijMzvSpt:44yfi/rIFISQtxaWj34J9G/jhe7Mmt
MD5 SHA1 SHA512 SSDEEP

Download

.userReturn

Path /storage/emulated/0/.userReturn
Size 67B
SHA256 b0bf0a7e6657d1541c70c23c701a0ada330c073c6b15467bdd5c1b02072a9cf1
MD5 d19362def1068453135f986a30e45b54
SHA1 9bcf20852530fe441860032bb5e85d18ead5abd0
SHA512 452844b15512ba34f0f03c5e7d988d555c31377081557b8ffd30e9913d079fee5c62d7396c5e913a8ae2bb7ceda30b9c37f23a4b48858ca3a144257e85f92c15
MD5 SHA1 SHA512

Submit Download

com.mopote.app.market.bin

Path /storage/emulated/0/libs/com.mopote.app.market.bin
Size 67B
SHA256 fd44cd4d5bf12f3f2a2a9d1c1c1da2db2a2ebdabfd9128a2cecab82c6da63f65
MD5 a58460065fa07e2f310e9949a9fa46e5
SHA1 70419a714aaddb6db5bab7337e4bad7031619c9f
SHA512 e2c17c47f1e43abbfed018f1625767f21fa9333d3630319f5075e8f3146ea7535ac488d0aaa9f29f1af8a5d23b34972047f305140630bf72954bfcc9dd9165a2
MD5 SHA1 SHA512

Submit Download

com.mopote.app.market_.db

Path /storage/emulated/0/libs/com.mopote.app.market_.db
Size 68B
SHA256 de56f51c46f80ecec2fb34449acd1992166671b7278cdb3c79279323ac8654f0
MD5 349ec36f279d100d8800394105eefbb0
SHA1 2b13e96600ce9193acd6c8ded203180a6aeaad0b
SHA512 0901599fd6ebb1fa55e577fa4777a165b36b195f46e97512953fdb43a31c32e5b63a1eb157c610b2481f87efb06b4b44ac11382a10b5e91f719659cbe289d8e6
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads