Analysis

  • max time kernel
    20s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    16-06-2024 19:50

General

  • Target

    b4e7ead3d03edf554919e104007bfcf0_JaffaCakes118.apk

  • Size

    26.2MB

  • MD5

    b4e7ead3d03edf554919e104007bfcf0

  • SHA1

    8ccc8d459755e7e8074b834bf8e2b668209eefa7

  • SHA256

    4393aed58a3f682dc56206c1aac4a7f4d3a928935f96680bf6ac1e1294d7908a

  • SHA512

    e20f12a9d7f0f115c43c237077ee70a2060798a460ed8d09eb95d6a5488d413676b737967a628d830fc3ec89dd9b1fe688a4837a8b11c37bc495b1d5977401bf

  • SSDEEP

    393216:8JljMsbXz0NifOpyKrI+idRht3NifOpyKrI+g/my84WS9bcBMADCHF3cuTdS/0w1:8JljMI4eKji1BeKjg/bW+ADChKjD

Malware Config

Signatures

Processes

  • com.bolema.phonelive
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4260
    • /system/bin/sh -c getprop ro.board.platform
      2⤵
        PID:4292
      • getprop ro.board.platform
        2⤵
          PID:4292
        • /system/bin/sh -c type su
          2⤵
          • Checks if the Android device is rooted.
          PID:4320
        • /system/bin/sh -c getprop ro.genymotion.version
          2⤵
            PID:4340
          • getprop ro.genymotion.version
            2⤵
              PID:4340
            • /system/bin/sh -c getprop androVM.vbox_dpi
              2⤵
                PID:4365
              • getprop androVM.vbox_dpi
                2⤵
                  PID:4365
                • /system/bin/sh -c getprop qemu.sf.fake_camera
                  2⤵
                    PID:4390
                  • getprop qemu.sf.fake_camera
                    2⤵
                      PID:4390
                    • /system/bin/sh -c getprop ro.secure
                      2⤵
                        PID:4427
                      • getprop ro.secure
                        2⤵
                          PID:4427
                        • /system/bin/sh -c getprop ro.miui.ui.version.name
                          2⤵
                            PID:4448
                          • getprop ro.miui.ui.version.name
                            2⤵
                              PID:4448
                            • /system/bin/sh -c getprop ro.build.version.emui
                              2⤵
                                PID:4484
                              • getprop ro.build.version.emui
                                2⤵
                                  PID:4484
                                • /system/bin/sh -c getprop ro.lenovo.series
                                  2⤵
                                    PID:4510
                                  • getprop ro.lenovo.series
                                    2⤵
                                      PID:4510
                                    • /system/bin/sh -c getprop ro.build.nubia.rom.name
                                      2⤵
                                        PID:4536
                                      • getprop ro.build.nubia.rom.name
                                        2⤵
                                          PID:4536
                                        • /system/bin/sh -c getprop ro.meizu.product.model
                                          2⤵
                                            PID:4561
                                          • getprop ro.meizu.product.model
                                            2⤵
                                              PID:4561
                                            • /system/bin/sh -c getprop ro.build.version.opporom
                                              2⤵
                                                PID:4586
                                              • getprop ro.build.version.opporom
                                                2⤵
                                                  PID:4586
                                                • /system/bin/sh -c getprop ro.vivo.os.build.display.id
                                                  2⤵
                                                    PID:4611
                                                  • getprop ro.vivo.os.build.display.id
                                                    2⤵
                                                      PID:4611
                                                    • /system/bin/sh -c getprop ro.aa.romver
                                                      2⤵
                                                        PID:4635
                                                      • getprop ro.aa.romver
                                                        2⤵
                                                          PID:4635
                                                        • /system/bin/sh -c getprop ro.lewa.version
                                                          2⤵
                                                            PID:4662
                                                          • getprop ro.lewa.version
                                                            2⤵
                                                              PID:4662
                                                            • /system/bin/sh -c getprop ro.gn.gnromvernumber
                                                              2⤵
                                                                PID:4687
                                                              • getprop ro.gn.gnromvernumber
                                                                2⤵
                                                                  PID:4687
                                                                • /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
                                                                  2⤵
                                                                    PID:4711
                                                                  • getprop ro.build.tyd.kbstyle_version
                                                                    2⤵
                                                                      PID:4711
                                                                    • /system/bin/sh -c getprop ro.build.fingerprint
                                                                      2⤵
                                                                        PID:4735
                                                                      • getprop ro.build.fingerprint
                                                                        2⤵
                                                                          PID:4735
                                                                        • /system/bin/sh -c getprop ro.build.rom.id
                                                                          2⤵
                                                                            PID:4760
                                                                          • getprop ro.build.rom.id
                                                                            2⤵
                                                                              PID:4760
                                                                            • /system/bin/sh -c getprop ro.debuggable
                                                                              2⤵
                                                                                PID:4796
                                                                              • getprop ro.debuggable
                                                                                2⤵
                                                                                  PID:4796
                                                                                • /system/bin/sh -c getprop gsm.sim.state
                                                                                  2⤵
                                                                                    PID:4820
                                                                                  • getprop gsm.sim.state
                                                                                    2⤵
                                                                                      PID:4820
                                                                                    • /system/bin/sh -c getprop gsm.sim.state2
                                                                                      2⤵
                                                                                        PID:4844
                                                                                      • getprop gsm.sim.state2
                                                                                        2⤵
                                                                                          PID:4844

                                                                                      Network

                                                                                      MITRE ATT&CK Mobile v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • /data/data/com.bolema.phonelive/databases/bugly_db_

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        f2b4b0190b9f384ca885f0c8c9b14700

                                                                                        SHA1

                                                                                        934ff2646757b5b6e7f20f6a0aa76c7f995d9361

                                                                                        SHA256

                                                                                        0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

                                                                                        SHA512

                                                                                        ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

                                                                                      • /data/data/com.bolema.phonelive/databases/bugly_db_-journal

                                                                                        Filesize

                                                                                        512B

                                                                                        MD5

                                                                                        a9462fe733ffc4b257bcb20ef99e8435

                                                                                        SHA1

                                                                                        d289981b11dd75ad9a7f0d8652cd53f594fcdbb7

                                                                                        SHA256

                                                                                        2ca18bc59b07334e0ef87265fbd74849f5689c5d37f2ad4f4c0115565ff55bf0

                                                                                        SHA512

                                                                                        bce88e8fbca1a4c9f2227bffceb4c05df1e98f2d52d59033ad80f7211f4bd3b47a9fcbb5e1cf086b74832eeaf6e4ef1dfad197c57e00914beb05eaf3056e023d

                                                                                      • /data/data/com.bolema.phonelive/databases/bugly_db_-shm

                                                                                        Filesize

                                                                                        32KB

                                                                                        MD5

                                                                                        bb7df04e1b0a2570657527a7e108ae23

                                                                                        SHA1

                                                                                        5188431849b4613152fd7bdba6a3ff0a4fd6424b

                                                                                        SHA256

                                                                                        c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

                                                                                        SHA512

                                                                                        768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

                                                                                      • /data/data/com.bolema.phonelive/databases/bugly_db_-wal

                                                                                        Filesize

                                                                                        120KB

                                                                                        MD5

                                                                                        5c1aefaeb67ea2089c01723f6bec29d4

                                                                                        SHA1

                                                                                        81412dd4dae13fe6fbbac7867bf257edb0a54622

                                                                                        SHA256

                                                                                        4ed9a22251d66cd5bd1d8c6f07a46850992d2e3099bd218bd0e09873a4942c4f

                                                                                        SHA512

                                                                                        63aaae6d755e78054b9177d4a575e53a2ef69da2239ef3e8bc1165ed69f5275694deb34062cf514059b62175c01ca3fe8d0bebd3c0ffb4e8d103bc406d2f23d1