Analysis

  • max time kernel
    30s
  • max time network
    190s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    16/06/2024, 22:54

General

  • Target
    b59bc915e3623e94b99c6223a9cc93ac_JaffaCakes118.apk
  • Size 9.3MB
  • Sample240616-2vmvnasbqc
  • SHA256 34a49c3275177b982b842f8c1d0041c2a377ee2758f54b97408fc309543c7aa9
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 3 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.mopote.app.market
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:5259
  • com.mopote.app.market:pushservice
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5598
  • com.mopote.app.market:pushservice
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:6417

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.anzhi.plugin.h5web.apk.raw

        • Path /data/data/com.mopote.app.market/app_plugin/com.anzhi.plugin.h5web.apk.raw
        • Size 130KB
        • SHA256 36c1bcdc853e392bc1f6ff3276f5abc32a4fb75f3616bf6bc293935978176a93
        • MD5 SHA1 SHA512 SSDEEP

        com.anzhi.plugin.push.apk.raw

        • Path /data/data/com.mopote.app.market/app_plugin/com.anzhi.plugin.push.apk.raw
        • Size 41KB
        • SHA256 fe20daf98ed5117dc4f24b9794329c4da1d713f6e1ba36708b38ab6a009c92a8
        • MD5 SHA1 SHA512 SSDEEP

        com.anzhi.plugin.snareden.apk.raw

        • Path /data/data/com.mopote.app.market/app_plugin/com.anzhi.plugin.snareden.apk.raw
        • Size 197KB
        • SHA256 e41e21c2377172811bba0fed31005d67330990924fa0fdbbd6bcbc04ecff41bd
        • MD5 SHA1 SHA512 SSDEEP

        com.anzhi.plugin.h5web.apk.cur.prof

        • Path /data/data/com.mopote.app.market/app_plugin/oat/com.anzhi.plugin.h5web.apk.cur.prof
        • Size 94B
        • SHA256 578b779ad61373da445984dbd43deae839f268005372c612c6ba3b6dc5b7f7e3
        • MD5 SHA1 SHA512

        com.anzhi.plugin.push.apk.cur.prof

        • Path /data/data/com.mopote.app.market/app_plugin/oat/com.anzhi.plugin.push.apk.cur.prof
        • Size 103B
        • SHA256 10a2002f0b2c8eade75c074125864e49d685cc7f8c4dbce7e4c0b437825ff32a
        • MD5 SHA1 SHA512

        com.anzhi.plugin.snareden.apk.cur.prof

        • Path /data/data/com.mopote.app.market/app_plugin/oat/com.anzhi.plugin.snareden.apk.cur.prof
        • Size 115B
        • SHA256 f00df288bcfd1ecbedabe860cd45016987b7366de3f8bd9896b99f7e8960be40
        • MD5 SHA1 SHA512

        1401095385.db

        • Path /data/data/com.mopote.app.market/databases/1401095385.db
        • Size 120KB
        • SHA256 21978acb1bec1432b56b967da5d63cc6debc89e1341b8983ceebd88ad6ed7fe5
        • MD5 SHA1 SHA512 SSDEEP

        al_events.db

        • Path /data/data/com.mopote.app.market/databases/al_events.db
        • Size 16KB
        • SHA256 b3aa8190dd69e1cbbea712e5cf20913309d03c0ee64b93d50f8ff36f716c70e9
        • MD5 SHA1 SHA512 SSDEEP

        al_events.db-journal

        • Path /data/data/com.mopote.app.market/databases/al_events.db-journal
        • Size 512B
        • SHA256 6951b385873747d609f0016b5823fb6b30b3f0c721082c856ddcd0573a85eff3
        • MD5 SHA1 SHA512

        al_events.db-journal

        • Path /data/data/com.mopote.app.market/databases/al_events.db-journal
        • Size 8KB
        • SHA256 be05a6edaa76988336d3f9b2990b10bbb29e40d26d1a58ce1318927aad0d65cf
        • MD5 SHA1 SHA512 SSDEEP

        al_events.db-journal

        • Path /data/data/com.mopote.app.market/databases/al_events.db-journal
        • Size 8KB
        • SHA256 4a875281e52122ec8db41910a04b521ee8e9e39149c2db79c302edacc93b6dfe
        • MD5 SHA1 SHA512 SSDEEP

        al_events.db-journal

        • Path /data/data/com.mopote.app.market/databases/al_events.db-journal
        • Size 8KB
        • SHA256 2e1cc173f21562c4b164f9e5b9234a175f7e867bd3d36346557d34c1bfa1c5b1
        • MD5 SHA1 SHA512 SSDEEP

        al_events.db-journal

        • Path /data/data/com.mopote.app.market/databases/al_events.db-journal
        • Size 8KB
        • SHA256 6ac28d61659206f213575c438191bc30ae48e8ff49b734d58a5a25b410adf7db
        • MD5 SHA1 SHA512 SSDEEP

        al_events.db-journal

        • Path /data/data/com.mopote.app.market/databases/al_events.db-journal
        • Size 8KB
        • SHA256 3e5f37980a9b22288cec105f55010de990618af4e8627a4404ac66c3d40b548f
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_assist.db

        • Path /data/data/com.mopote.app.market/databases/anzhi_assist.db
        • Size 32KB
        • SHA256 d0ec3567dad96384d8c9ca7b2aa233d3e324c030e183938b6ca1b61058c1debc
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_assist.db-journal

        • Path /data/data/com.mopote.app.market/databases/anzhi_assist.db-journal
        • Size 512B
        • SHA256 631eb7507f3860daf1e4388cd1763a53c3f47d5d590ac8427526720fe6d6b474
        • MD5 SHA1 SHA512

        anzhi_assist.db-journal

        • Path /data/data/com.mopote.app.market/databases/anzhi_assist.db-journal
        • Size 8KB
        • SHA256 88c646b0fe37adc25251992051a115feca653223a3d5304acbaa50029c6db824
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_assist.db-journal

        • Path /data/data/com.mopote.app.market/databases/anzhi_assist.db-journal
        • Size 8KB
        • SHA256 1d517419ae61cae2ddf0eb20f20c819316ecd9fb7511d490ba299a812612fbd9
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_new.db

        • Path /data/data/com.mopote.app.market/databases/anzhi_new.db
        • Size 176KB
        • SHA256 734d29bb757fe577d570f617661b6871e33537e9a0e4ef0e7e9fef2c4e1a7564
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_new.db-journal

        • Path /data/data/com.mopote.app.market/databases/anzhi_new.db-journal
        • Size 512B
        • SHA256 7ed6e989af437ccf156a877711fded59d0671b21038d928cfef0ca0f1eaa46d7
        • MD5 SHA1 SHA512

        anzhi_new.db-journal

        • Path /data/data/com.mopote.app.market/databases/anzhi_new.db-journal
        • Size 8KB
        • SHA256 02ddeeb91637c9af08a419d4de3ea7fea5d66b2a0d4996d75ee7c74bd05e8cb9
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_new.db-journal

        • Path /data/data/com.mopote.app.market/databases/anzhi_new.db-journal
        • Size 8KB
        • SHA256 995817596febf5accb5953999817346b0daabfdac7d7a76295149956077fe952
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_new.db-journal

        • Path /data/data/com.mopote.app.market/databases/anzhi_new.db-journal
        • Size 12KB
        • SHA256 9ff8036d1be2b2ca70d2de1e214ffa280334176ef7fe045f978a594aaa358f01
        • MD5 SHA1 SHA512 SSDEEP

        appmarket.db

        • Path /data/data/com.mopote.app.market/databases/appmarket.db
        • Size 20KB
        • SHA256 8261fdd52a9d91790160fd73924f2ce219d51161fff1472df3de9e1561414d4a
        • MD5 SHA1 SHA512 SSDEEP

        appmarket.db-journal

        • Path /data/data/com.mopote.app.market/databases/appmarket.db-journal
        • Size 512B
        • SHA256 0724228b8110a23f73a43a4b4a0d4a50d92c71a493ae275d75de7f18cc7ea037
        • MD5 SHA1 SHA512

        appmarket.db-journal

        • Path /data/data/com.mopote.app.market/databases/appmarket.db-journal
        • Size 8KB
        • SHA256 0c34fbc6ae5feca422cde77658a4b3f1019e0758e3d10d6aacc2e88254a0dbc9
        • MD5 SHA1 SHA512 SSDEEP

        appmarket.db-journal

        • Path /data/data/com.mopote.app.market/databases/appmarket.db-journal
        • Size 8KB
        • SHA256 7a8282a9e27bbe89415716a115d2d598e38535c124ad8907723a44d68bda82d5
        • MD5 SHA1 SHA512 SSDEEP

        com.mopote.app.market.db

        • Path /data/data/com.mopote.app.market/databases/com.mopote.app.market.db
        • Size 24KB
        • SHA256 f12dd3c81d592f9b76fcdfe45e0806c518bec9ff7de6005d1601e9de2d3c3b10
        • MD5 SHA1 SHA512 SSDEEP

        com.mopote.app.market.db-journal

        • Path /data/data/com.mopote.app.market/databases/com.mopote.app.market.db-journal
        • Size 512B
        • SHA256 eab59635a5a50b46f47d7ad7c53664abdcbf43bb016378a98b00aa51b354e652
        • MD5 SHA1 SHA512

        com.mopote.app.market.db-journal

        • Path /data/data/com.mopote.app.market/databases/com.mopote.app.market.db-journal
        • Size 8KB
        • SHA256 73147fa42b4eeb6317bad9ac5883f1909fa73b2c1b921c614db7f29d76d702ee
        • MD5 SHA1 SHA512 SSDEEP

        com.mopote.app.market.db-journal

        • Path /data/data/com.mopote.app.market/databases/com.mopote.app.market.db-journal
        • Size 8KB
        • SHA256 af6f1cbeff10fff6fafc119339060db905fde5acb42226d92072d05c28e213de
        • MD5 SHA1 SHA512 SSDEEP

        gtc.db

        • Path /data/data/com.mopote.app.market/databases/gtc.db
        • Size 28KB
        • SHA256 5c63019f5661e3ce545b65ce36460121fb291e7fee9fb223e50c4d429a4a1111
        • MD5 SHA1 SHA512 SSDEEP

        gtc.db-journal

        • Path /data/data/com.mopote.app.market/databases/gtc.db-journal
        • Size 512B
        • SHA256 61996803eda10dc11eafe6eff8d0d1dfbd4013eb91e8d29a22e3009f667cd603
        • MD5 SHA1 SHA512

        gtc.db-journal

        • Path /data/data/com.mopote.app.market/databases/gtc.db-journal
        • Size 8KB
        • SHA256 fed723da354d6f7fed5dff4aa7aeab610e119035211a65f6b3e91b31d09f465d
        • MD5 SHA1 SHA512 SSDEEP

        gtc.db-journal

        • Path /data/data/com.mopote.app.market/databases/gtc.db-journal
        • Size 8KB
        • SHA256 b2c707c5292d9b3489acdbd82b65472e5c8b0d098c107d40f7b8d06a2a66557e
        • MD5 SHA1 SHA512 SSDEEP

        gtc.db-journal

        • Path /data/data/com.mopote.app.market/databases/gtc.db-journal
        • Size 12KB
        • SHA256 e71cde52a3e5aff165e82ccf26a792a11e6c3a045de9d6ed4faeeaaa9af8aac2
        • MD5 SHA1 SHA512 SSDEEP

        gtc.db-journal

        • Path /data/data/com.mopote.app.market/databases/gtc.db-journal
        • Size 12KB
        • SHA256 bdabc9a0b94ffcd22195148689a0783de961e876c3bf8e877e1451834616888b
        • MD5 SHA1 SHA512 SSDEEP

        gtc.db-journal

        • Path /data/data/com.mopote.app.market/databases/gtc.db-journal
        • Size 12KB
        • SHA256 1d9e56ad46416c94c6129038b79944bcb07885d6774e4a6eac880de8fdaf7933
        • MD5 SHA1 SHA512 SSDEEP

        packet_data.db

        • Path /data/data/com.mopote.app.market/databases/packet_data.db
        • Size 20KB
        • SHA256 504ff074555678d58dbce5d57ab34a07dc3eb10e74e7dd543c44170b5ad208f6
        • MD5 SHA1 SHA512 SSDEEP

        packet_data.db-journal

        • Path /data/data/com.mopote.app.market/databases/packet_data.db-journal
        • Size 512B
        • SHA256 fee844c0abeb487c3887d419d8c334d17458f1bc3f5612108992136b5622676c
        • MD5 SHA1 SHA512

        packet_data.db-journal

        • Path /data/data/com.mopote.app.market/databases/packet_data.db-journal
        • Size 8KB
        • SHA256 8571622cfaadaa45b5866f4644751be984d734ecb5660afffd938ca70e69f743
        • MD5 SHA1 SHA512 SSDEEP

        packet_data.db-journal

        • Path /data/data/com.mopote.app.market/databases/packet_data.db-journal
        • Size 8KB
        • SHA256 2b67bb6f526c1c244e9c157c95a402abf41938a6c7030248b89683db897207d9
        • MD5 SHA1 SHA512 SSDEEP

        z

        • Path /data/data/com.mopote.app.market/databases/z
        • Size 20KB
        • SHA256 624d4550cc21234a2899fba719ae87c64b0b947c17d5e5265a12bad9675d7c3d
        • MD5 SHA1 SHA512 SSDEEP

        z-journal

        • Path /data/data/com.mopote.app.market/databases/z-journal
        • Size 512B
        • SHA256 638d1c9772338d434ecc2aaa41d329e4cc5f39151b94f8c7e7529818da1f3ff0
        • MD5 SHA1 SHA512

        z-journal

        • Path /data/data/com.mopote.app.market/databases/z-journal
        • Size 8KB
        • SHA256 1ab8c1bba87e5ec145b68a307a03faead3e33fe8255fbb23ad84d5b9467a413e
        • MD5 SHA1 SHA512 SSDEEP

        z-journal

        • Path /data/data/com.mopote.app.market/databases/z-journal
        • Size 8KB
        • SHA256 69ef5a32068f80dd50205ea0946ca8f2c30161e311bdba0effaa2f763a48b8df
        • MD5 SHA1 SHA512 SSDEEP

        com.anzhi.plugin.h5web.apk

        • Path /data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.h5web.apk
        • Size 177KB
        • SHA256 5a4331a4e09479778c01e18cd9950f0a98aa614324cb4e01c0715838d65949fb
        • MD5 SHA1 SHA512 SSDEEP

        com.anzhi.plugin.push.apk

        • Path /data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.push.apk
        • Size 78KB
        • SHA256 4a34accf323c10a43bfdd2d3eb38dbee203a7f5abe7b2091f94d020edc977531
        • MD5 SHA1 SHA512 SSDEEP

        com.anzhi.plugin.snareden.apk

        • Path /data/user/0/com.mopote.app.market/app_plugin/com.anzhi.plugin.snareden.apk
        • Size 168KB
        • SHA256 c6821e9fc86683b0fdaf95f37eccfb038fcdfbfa1fe3960fcb093ff09c037e24
        • MD5 SHA1 SHA512 SSDEEP

        .userReturn

        • Path /storage/emulated/0/.userReturn
        • Size 67B
        • SHA256 e160821e9c94cb956302268e3668282873b55a8c8e9d05178c7daa1c7f9e0956
        • MD5 SHA1 SHA512

        com.mopote.app.market_.db

        • Path /storage/emulated/0/libs/com.mopote.app.market_.db
        • Size 68B
        • SHA256 52e16e2cd11ef5b61084302ec775c8159addf5d599ecca881160468a07633858
        • MD5 SHA1 SHA512

        anzhi_push

        • Path /storage/emulated/0/usercenter/anzhi_push
        • Size 32KB
        • SHA256 22a464de02619d43ce2a5d34f9944ab5ccea3577f73b44d78b001b65ba2676f0
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_push-journal

        • Path /storage/emulated/0/usercenter/anzhi_push-journal
        • Size 512B
        • SHA256 10d66e6fb324a01dff89ad6ec69bea8e66dacea7b2461fdc79f9c6c3bd21eca4
        • MD5 SHA1 SHA512

        anzhi_push-journal

        • Path /storage/emulated/0/usercenter/anzhi_push-journal
        • Size 8KB
        • SHA256 a93177c5856d324ad35f9b0edc4d2a1aa621ec72b6d986af6adfe82f860c9242
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_push-journal

        • Path /storage/emulated/0/usercenter/anzhi_push-journal
        • Size 8KB
        • SHA256 2a9a80468f0741f50fb805c13da6f6f598b3f483075ab8e65853a746f7bd6129
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_push-journal

        • Path /storage/emulated/0/usercenter/anzhi_push-journal
        • Size 8KB
        • SHA256 e78ca5a4de9c47ecbdeec0f53e5c14ba7191ff730646a4767bab282996b46456
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_push-journal

        • Path /storage/emulated/0/usercenter/anzhi_push-journal
        • Size 8KB
        • SHA256 c941e3a7b010735ef64f624eb917c6e0173bf3b3bc03cafa31beefbadb80e655
        • MD5 SHA1 SHA512 SSDEEP

        anzhi_push-journal

        • Path /storage/emulated/0/usercenter/anzhi_push-journal
        • Size 4KB
        • SHA256 99eee39d9db2da38d3327cdb5aacb76da8c2abe5a1f051fc5a5d5f17efb304c0
        • MD5 SHA1 SHA512 SSDEEP