Analysis
-
max time kernel
8s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system -
submitted
16-06-2024 20:28
Static task
static1
Behavioral task
behavioral1
Sample
b50d7cf6cf7c73d99c8d26805e770b79_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
res.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral3
Sample
res.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral4
Sample
res.apk
Resource
android-x64-arm64-20240611.1-en
Behavioral task
behavioral5
Sample
unicom_resource.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral6
Sample
unicom_resource.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral7
Sample
unicom_resource.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
b50d7cf6cf7c73d99c8d26805e770b79_JaffaCakes118.apk
-
Size
20.4MB
-
MD5
b50d7cf6cf7c73d99c8d26805e770b79
-
SHA1
1b7700fa020d3428bb1dc96a1d0e1c2aff92cafa
-
SHA256
b5fc1ec3dc01c08d17e45016a75074b10a0ab5211d486d8a09f93ae87fb239b2
-
SHA512
e4db04deba38efa9e6d0126118148fd1055912f70fcab11a691e7282e4282a35d76abe9d70d025e9b58140734b906f97af4b9f08de7b3fce3bc03ef76af1fc0c
-
SSDEEP
393216:VIoG0erFCMctQ+BvcKtBjIti86WcSaBOgA19vokUo/njZ14Ji9DCwulQMUn:VRGDLkkajIF7aBYTv7JFCxCX
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.qianz.magicgirl/app_payload_apk/classes.zip 4293 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qianz.magicgirl/app_payload_apk/classes.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qianz.magicgirl/app_payload_apk/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.qianz.magicgirl/app_payload_apk/classes.zip 4264 com.qianz.magicgirl -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.qianz.magicgirl
Processes
-
com.qianz.magicgirl1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4264 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qianz.magicgirl/app_payload_apk/classes.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qianz.magicgirl/app_payload_apk/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4293
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
233KB
MD51a4b3f98a73733181dc9667b9b51f20b
SHA1e5a4105f78e5b5f6f8382dde3cdc05c2e4c765cb
SHA256cbc412140284af8220559325d5820e208e084f327b31bf7d7ea5b90dde073f26
SHA5123dc0aaec049bbdf4b101ac41aa34a7bbd351c35bac7818298687d882134b736d0e74228e6d25bd838b210c2ac5d6ed1ff4d29d6b86bf3500c32de86ea23d08b1
-
Filesize
8KB
MD5f78bad637333e0c44b50e1337f5cdb58
SHA1224bde7cada6e85ba6c64da41cdcc5a67e319948
SHA25602e04bc50e3ff6352702fd508daefd0b22cfaa96e6bd2f20dc3515cb9fd63a66
SHA512a6f9f12e8ebcd3325e841bd5ec5d7559b0aee8ab59bd90725384211ba61ba5f487493345f8591ece7adc0f2ac71cbdcad11fd831f0c4adca72a525a354d787f7
-
Filesize
8B
MD5e15393fc9d8ffba7a31951984c4dbd03
SHA1204464094be0dce64ff1e39fab2c4af80a756c93
SHA2565512b2a96e37955a4ae15111813cd00488a4b3cf7b988a5865ed9338b7b31495
SHA51204bc780b126d08eadc23f9fd0f8e5fd8ff7af113f0633df17e4896faf3b89c2e70dc11f39b58e37a1e34d862660c97c4ef055c332c907e89dd2a93eb12fd8e70
-
Filesize
583KB
MD59acc2a366fb8d0020e534d7f122250a1
SHA188944f671633ca222ed9c30f6580895f47bbc4e3
SHA256c389ea9640bf025e212484fc3b7c2ee7ef9c5de2cf3ebb731c86eb8e0c1e9372
SHA5120b54f3a19721ee611edee1de14b508d734053d588b7bfec0d0594e4f804b159d75bc8e6474ff1eabb96e89ffeace5d6bbe17ec2bc350d085f08e5f584e0f9105
-
Filesize
473KB
MD5bbff94a6a56c9cfe022e2e8600417a57
SHA185e91e4c5e91fd7897ffb9de788e1eb10d28172f
SHA2565f473bf63702741457228d0be364547c025ce4b0f15563ee12581074e96c9e97
SHA5129628a05319f4b1b441529f5fe12dffd9cbc537b95d18813cee7c8db19ad4c2ae293398a9a83978e8558d35e98aeb9d08f98bed7e5a0773a0cee7511325a33834
-
Filesize
365B
MD57be413727ba42fe841e934ea68d44d05
SHA150e2ee4901d33e4f4369d338452604d8f5c3acb8
SHA2560ade6e0735943995e3d6d3f78fc7cf87903910712e562ee67f7cf86d0753fe6b
SHA5124bb0178ad33a91bf5ead022015f563f19000aa3f5b69288bc38a19298973f69b72fe288f1f10eaa21667335d07887dc44df25e0e661fa7109c9660983adde47e
-
Filesize
559KB
MD58678474cc1023258b6009bf5a2fd2ca0
SHA17d9985da7cf152aed9cf90de74d8f4ca90f8c809
SHA256c86210c78fba2b990960d00a582cd0cc4d3cbf4097136b6efc8d55b8e48ec436
SHA5123408a246085e7bb0b1a61f1d73bc61c72b232bf80b85026935e64c3de93ea4ce464e157eee68be8d8a4975907c987d619cc887fcd5636cdca0aa2d85e3ee456a
-
Filesize
559KB
MD5f78c6ef97d8da70a39aa8589c87c7da3
SHA12ff113f38841a12e1fe0f47cc93155c298c5dab7
SHA256adf3d6db960bc5eab88c1cc79e0bfa21484252dbc8ce481054818b2067e5b84d
SHA51293d71e05333f6c593e6566c10af77ba5f848bc2bf1a3a4de398366305fa15949b89babc017ee1c942a265b675165b45d3b73aa4d850cec2cb08b2d1903a9cf9c