4f3baa9d3ce93e7275e58725e32af2f4cbf5a96a21dffea756c9d4462e2ce0ab

General

Target
b7dc0d0ab7358d9479fc3aac860f8893_JaffaCakes118.apk
Size 14.7MB
Sample240617-laf9davajd
SHA256 4f3baa9d3ce93e7275e58725e32af2f4cbf5a96a21dffea756c9d4462e2ce0ab
MD5 b7dc0d0ab7358d9479fc3aac860f8893
SHA1 7218cf44f6298f85d505535a1bbb59a59cce724c
SHA512 ecdd3e9b81f40521404e8d1c85bb37eea57672b13dc0855eba9306e5cf8c5375f3c0a7ca13caa45068b025cc9ec0ccf0cace82e0105363cd8dfb3f511fa544c7
SSDEEP 393216:XeoO2JPB8rhxOnk1lshnZf3FbQsHWIvfMmbu5YY:XeP2JPBahxOk1lshnZ/1nWIvfY3
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.huasheng.travel

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.huasheng.travel

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.huasheng.travel

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.huasheng.travel

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.huasheng.travel

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.huasheng.travel

com.huasheng.travel
1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5045

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

bugly_db_legu

Path /data/data/com.huasheng.travel/databases/bugly_db_legu
Size 116KB
SHA256 0d770995e938ea93efd267d499764361bdbccfeaa6570e5644b36bdcba5a2348
MD5 9bad85ee8b5ad9abca729c411b0d2f99
SHA1 56d38ab8ba27cf70a48950ce67393ca9fb0ac9ae
SHA512 bf9a2712c75d47671939701d4ad4f23832737ecd4b8ec88167531cd6717158de5076ceb4670c8896750204ca77e503702ba3fc32be90788f95693a8be240a515
SSDEEP 768:Rcj0bxg+N1YjwlOlZZjwiJI+oVZjwbjf0Xa1XJfuIdvwfTfGSS8ZRwDqi+mAhELO:yICwLIC
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.huasheng.travel/databases/bugly_db_legu-journal
Size 512B
SHA256 03e155175ebcd9602cdac1e48215e064e607237f991d40cc558f57f0a0ca34e0
MD5 c3aa568cc1822b70cd309d63ebf14f57
SHA1 752c82f81828e8a3f718397c06b8560382564ba3
SHA512 2d483c00aa3d54f52b90082b74e1f3472a0111e96819cc05b822c34a378ed504b7dbe97fd37fb7eee5e14237270bc58a40acabbf3f0d14162c52165024a68e41
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/data/com.huasheng.travel/databases/bugly_db_legu-journal
Size 8KB
SHA256 51ce22f83f62f1a820d4b8dec7b9de72485f3ed2cf8dffaf5c88334002108b49
MD5 aa9038d90cc852955b13f62b4364bb7d
SHA1 255fa9f2da924781d08237c13989c0bf61dc7dad
SHA512 7b4f9e82aca856b75b2379a8606bf9ec023c601ddf29cc95eaf6c88862116da25e37b6262c922b96a37e691937de9eda46af5554e8bc43ea9872042610b40e90
SSDEEP 6:7+/l9wn1Pg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKJ+:7+tcqLiuWdwRmBEyPbI+
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.huasheng.travel/databases/bugly_db_legu-journal
Size 8KB
SHA256 73b6a9b69013e6644fa81782ba6ed996f36bf8d3958d0cd2a111c89fc844b739
MD5 12372ace466ca7a4976a19efd280ef07
SHA1 286ed82ad9084f1b37b7116380fbb3adc18e8b63
SHA512 66baab5740c4939f5d065c4278cf1e0e2993bfbe219a6825a91069f5af7f370adf7ed4ccf95a8a941a1761298f06c9fb4777213648e71eebc75a8887164d5f04
SSDEEP 6:7+/l9cPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKMKga/B:7+t+qLJdTRmBEyPbzqB
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.huasheng.travel/databases/bugly_db_legu-journal
Size 8KB
SHA256 4aec74b109abcef29125edd3b8aa4dbca5efa1ff49b1e5f9c113b736d25888f8
MD5 f42ba72d546dd81db1646647dd6eb64d
SHA1 191af450df9300cf51ee7641b378a488c1df9d3e
SHA512 0b0fe686582ae4458a4d7aeb398034dcdfabfb36bd5e21e46418cc9e21ac5326b9c1d925e36e36b8d36f533d8fdfa252cd48052e089916273aacb8cdab86a52c
SSDEEP 24:7+tBqLTt/qqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSc:7MBqDfrQiw6uMg6/YBg72meposSc
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.huasheng.travel/databases/bugly_db_legu-journal
Size 12KB
SHA256 b8c3ce08f22ff5fbe5004d6a8b93984c66cb26f98784bf2bda813dce2d392003
MD5 9a0ec92b161f6ec0ca0ca713e813d358
SHA1 4fca6336e40641a4fea83a528694a02c87bbf407
SHA512 1a3aa6852d9541dde8d42a82188cd2fea4e9e46e572a0d24cb420cdf0bc521712944a36b6d4785a089dbf973cc305d607847b3c77bbe46fce1f32d8b275e5a70
SSDEEP 24:7+tRqLMvtslqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSXG:7MRq3DfrQiw6uMg6/YBg72meposS2
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.huasheng.travel/databases/bugly_db_legu-journal
Size 12KB
SHA256 9f265c9f1d52381204f9a1bf8f4ef68827c11cb0b4e304e3d6d78daf4da60193
MD5 bbdc84232ea68637c37d0f8e7d588c95
SHA1 5504742a7ece89124868c7757de0f1405117f6cf
SHA512 2d3a09c59db3cf4d351f6df3db5e89dda12015a18d6d03420e4e45fa2d0fcb52a4ac32080739e97cb4819779afc89cd7378049d623073348d75efa50bab761ec
SSDEEP 24:7+tzqLmt+qqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSHKn:7MzqzfrQiw6uMg6/YBg72meposSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads