Analysis

  • max time kernel
    179s
  • max time network
    193s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    18-06-2024 11:40

General

  • Target

    bbbcee06e7c07e0c045ec97bf53e3602_JaffaCakes118.apk

  • Size

    7.3MB

  • MD5

    bbbcee06e7c07e0c045ec97bf53e3602

  • SHA1

    0e5421869446ecec12e8a654d1633b7a04dc4cdb

  • SHA256

    e7e7590cf0d0829520b1ba03f07f44ee5f77890a271596b6875fc7c4fcb78cc8

  • SHA512

    ec8a7ab796d1b5564c554d4e0b753610a3564e96d85f33091c4274d5b4f61641ec49194d49d9d53eed8bed56dab85ee18965b55915ebb6f27ced9d80d496c2f8

  • SSDEEP

    196608:TiIGAhei5M77rSVC81t4M2ICUPC410JpPRtVixpXw37YQ0:T7GC5M7nFwB2IrPC4CJFRD+XK7YQ0

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 12 IoCs
  • Obtains sensitive information copied to the device clipboard 2 TTPs 2 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 4 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
  • Reads the content of the call log. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 4 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 2 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 4 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 3 IoCs

Processes

  • com.jiubang.goscreenlock:preview
    1⤵
    • Checks if the Android device is rooted.
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks memory information
    PID:5213
  • android.process.acore
    1⤵
    • Checks if the Android device is rooted.
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Reads the content of SMS inbox messages.
    • Reads the content of the call log.
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:5254
  • com.jiubang.goscreenlock:pushservice
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:5385
  • com.jiubang.goscreenlock:com.jiubang.commerce.service.IntelligentPreloadService
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5543

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.jiubang.goscreenlock/app_zip_themes/com.jiubang.goscreenlock.theme.marx.zip

    Filesize

    873KB

    MD5

    fe26335326e5a3caa7448cea3db8b2a1

    SHA1

    85aaa1b8cd6ad9184f9e96ab2cd5f2b55f702be4

    SHA256

    0a0a8d2821b8cefab00aa2f5d76323fbd59b4176ae1b10f1fb3dec461301f9f9

    SHA512

    0192d7c83b14abbf23b6b7d01e781c307f0400a76c0d314dbe6479271a5f21078ffdc855d002455c9e117d1dea70baf7020a8410325cb04680f5288c289861b5

  • /data/data/com.jiubang.goscreenlock/databases/NewSetting.db

    Filesize

    24KB

    MD5

    86b33386a9fa90ed4c78f28dbf4303fa

    SHA1

    56688a4462571ebea9d6b25f84e83981391cadea

    SHA256

    0840b9401ccc29847e515de3f2334d93fbffb73c290cea103af8325e9a886df6

    SHA512

    539065dac8e5f679fc54ced7c2ed8e96f3f9d6bbe533e360c73ebb1d983950df3cd51b53ba1c99841b2b5b8abd3575d6cd8d42eae7b55d561fde1dc8cbd020e7

  • /data/data/com.jiubang.goscreenlock/databases/NewSetting.db-journal

    Filesize

    512B

    MD5

    e6771ae88765f23e1c5f6c79c37a0b84

    SHA1

    51998ee56d0f1910b16476824f0ea2d494ef4742

    SHA256

    54a2192848baf7a6d7ec5970d3e0bf37d29649d2a8c4dffb0188d7c96cec5656

    SHA512

    142f00cb7908ea4d1024f4b9a63b9981ab454ead0a5b6299371c8e431a98547ed4c27553a52faa1ad014fd5d0a60519ca27966e3fd59aae596f2ce1f2623ae10

  • /data/data/com.jiubang.goscreenlock/databases/NewSetting.db-journal

    Filesize

    8KB

    MD5

    3c12ac168bf1f068c4cd06d70335c700

    SHA1

    b15efb980cd22fdfcf57c45d581135b24f0dca7d

    SHA256

    1a413f0aea25147c1bbba545d7255105174922cce5c07a67075feb4c90815ef5

    SHA512

    4a1cfbd5666e96e3d43941dbc48dce3366058e36d1f703be09c8aad7bbb319c4f33e783126961ab9b07a5d87c070364b5cb712d3ca4dfb0649a4f425926876b8

  • /data/data/com.jiubang.goscreenlock/databases/NewSetting.db-journal

    Filesize

    8KB

    MD5

    0877a93bb05bdafa75ad4a5be34da849

    SHA1

    257c1e7d6d24f165fed105fc3115609d77cfe76d

    SHA256

    a7c7a52b55c943c3cfa8bb8c04b1338decbdc061aa98345e8a47c23490f379ed

    SHA512

    3bde6089a09d8d85ab7f2c4733c648887f6415bd6e8a27856414345adeb1809a34f1fda7f25aa3f0d2d4a004772412facd26a307efc74827a57400e0fe2e1ee6

  • /data/data/com.jiubang.goscreenlock/databases/ad_sdk.db

    Filesize

    12KB

    MD5

    556b53fe0a07fbf1f43171f688acb4f6

    SHA1

    d622362900064de386be48e078ceff35933341d7

    SHA256

    134db696b5803492990cb3da413e0e0736e0e2612ebd39a60858ffa99d3ed23e

    SHA512

    e3b8b27ebf7b49a285bf8dfcf5b246680c64ca658de172387841e038f78a2bfb214ba2be6c829a6c102cd3932df38b70abf9ab45a41f81bf97f14d772be065fb

  • /data/data/com.jiubang.goscreenlock/databases/ad_sdk.db-journal

    Filesize

    8KB

    MD5

    eff38813665d3bf3e468cc4dd2eaccfb

    SHA1

    41cc0a4e13aac966b6762095df18e3e380522df1

    SHA256

    4ee7120aa5fdbb1ca48dfcd425f2d3c6c16ab4a386852f9af9f0334d6082f23a

    SHA512

    ce62933ac6061b3f5ec214739fb640ad0e2dc96ba9d2e25588df722e1367875c53175bae64c4bd40977594a6027fdde5b371d8bf8852c53a43f6c51ed208b602

  • /data/data/com.jiubang.goscreenlock/databases/go_notifier.db

    Filesize

    36KB

    MD5

    25af6a059ff70428a975a943717689be

    SHA1

    64fffd0cb833e515e18a0804167bafdf66728a27

    SHA256

    9a3c374cd09bdd169c722c4ea4637aedcf20dae2e6259396bb2392b5d79f061d

    SHA512

    8451b81e1d55a1d14f95b872edeb27b69c635fed940460f8f3830552a6db20ba28b4fbb916a2770d84596f24b0f2bc5d419142ea270b55f3ffa01223f25ed910

  • /data/data/com.jiubang.goscreenlock/databases/go_notifier.db-journal

    Filesize

    512B

    MD5

    fea16faea94c02d6211784446be5b3a9

    SHA1

    444651c8a652792670150e6f239ee0e04059ece7

    SHA256

    d29d5939c8806b40545809d41bbe22f6b95ef61361ae56d9f04b462726e6ef08

    SHA512

    7391e0524282cc7c6153679c206f2c70556853f667ece637f281ad0c3a1a8ddab4f1e33b73abae83946f67157021ca014887a94a998c7dd64e5f1e697eeca45e

  • /data/data/com.jiubang.goscreenlock/databases/go_notifier.db-journal

    Filesize

    8KB

    MD5

    38a1c6a5a1471e93d0d03215f89ee4a2

    SHA1

    b722f7dd7c8b751bf35aa0eb53134170dc90f26e

    SHA256

    d429756873261395d018f4113a884d15e971423583984427fabe5a93fe104a6f

    SHA512

    9344a35dff8fb9f091c9fbd88d60648947ecb03f7fc2d6f0c44004e59b984ebe45ae42880b4beb139e5eccfccee31487ea50fc6b8531784e91970905a3437325

  • /data/data/com.jiubang.goscreenlock/databases/go_notifier.db-journal

    Filesize

    8KB

    MD5

    e289b1d75a4a7a9fe651cb227dc9c081

    SHA1

    6049b67e199116320731fb411881c51727bd2911

    SHA256

    7d842abb5353845fe16cc2e3a6695a34e92d8f2ad649d4d907529a2b293a3f2a

    SHA512

    273af97d04d62fe95d24fe90ba18d4db385327668b18169fa088fc9fb0a7c556d4f55e458a21b1be7d21f4593d8318bf50b3f78fa700d4fc2d95f39ce101fd55

  • /data/data/com.jiubang.goscreenlock/databases/golock_message_center_db

    Filesize

    60KB

    MD5

    7ff0635b42986173e7c4e3dd59709c3d

    SHA1

    4c63e3f08c6bd111fe55ab833943301f14be7ace

    SHA256

    dbbf6e6fbc75e726396a9779278ae79449a5314128ec3ed7279c3ecd87adc609

    SHA512

    1026d15528de6238e26908e506fbd540899f713c55f07ef84d7907b686fe6af16a5b02f0b7724e51580a23efbd9b73b7f6d7661019be5df5737749c9b068b880

  • /data/data/com.jiubang.goscreenlock/databases/golock_message_center_db-journal

    Filesize

    512B

    MD5

    f5e61d6e8ed1ba92bd5f8506f243f5a0

    SHA1

    1a1d8eb5cdcc4d6e8f748ac8e5324241dc65a205

    SHA256

    ef9a6dcf353dce8434608b0a45572535b23c5ff5e73a245a44372a0941b774c7

    SHA512

    f8c558974aae4e47ddd8bff75d60b3cac9e55ebd00822d01a424b2d0886e6ecbe4ad5574be4517c287954175a14a630acbc623542cabd4999da5c739921147dd

  • /data/data/com.jiubang.goscreenlock/databases/golock_message_center_db-journal

    Filesize

    8KB

    MD5

    d18dc76f1719b837200b5c7d48587acd

    SHA1

    403c1063a3edaf7797951be8e8f43b3697651cc7

    SHA256

    ae653ec224b151c1adb84e792ffa8c339fddffcc1ceb070fd4e61e6539364407

    SHA512

    b1ce5de8b477c1885d3ce3936e51974b28f534d806e04cfd7d23d00524c3efe3c0d65757f92342cd4e21c5eacb0fade48219b5997d6d1486bf97daf7f3a64b81

  • /data/data/com.jiubang.goscreenlock/databases/golock_message_center_db-journal

    Filesize

    8KB

    MD5

    2a78ee2d999a913df23076b71488e100

    SHA1

    c37767b55daa5cec684d60ec45e45a5a287908e0

    SHA256

    0bd848ff5c49b395763df491902778e6c1c5478376676ae240c12f90dd3e7298

    SHA512

    da09d1c868fb45e333d351e95c8c47608b9ab0a7104dd0ffdbe3a4f356a109daad3a8bfa727b4b2743b42b188d52c2698f6cbb1dbb824eb63a77a93855ee46b0

  • /data/data/com.jiubang.goscreenlock/databases/gostatistics_sdk.db

    Filesize

    20KB

    MD5

    45aa171387ba19718f53f4904c2006d1

    SHA1

    0be4d0a4a919b934a499eedbc72757e450fd573c

    SHA256

    fc4e1a2fdf244bcd9698eb6a834db9a12668c897f55833c64f1948a27791291d

    SHA512

    e2b3442be5ad00a74e16b2d15aa68b0f429f15c5b376befd9160f8f157e8a96acafeb50ef0022690ee93a477b1ab5878e5f1d0b3f34ba588ee9b3ca38d6536f9

  • /data/data/com.jiubang.goscreenlock/databases/gostatistics_sdk.db

    Filesize

    578KB

    MD5

    1de5746cab2f87e4e8a3eee7bb614dac

    SHA1

    bb615bb0f761e38b536c7454c5e6a8d3616ef8c1

    SHA256

    07b72473f39a4a369c46223b25016f1b32ff0b483552db08c536cc2653e15df5

    SHA512

    55e3b27bbf714adae8349687c64344200e05aaf1f172ea60a926b0a72a717e8af5f27fd9a19abc7adceb0ee17b7e8c300d69681aaf53875af5facf428515e17f

  • /data/data/com.jiubang.goscreenlock/databases/gostatistics_sdk.db-journal

    Filesize

    8KB

    MD5

    4a6fe923da8a878938be154b1fdcc834

    SHA1

    1116ebb53212cba081079748409a687112906e55

    SHA256

    5760a9bef25db88a4749a43df6bd2ec3aa42418a2382460d23f15dd7724eef7b

    SHA512

    ee3a0aca196d5f3f1509a97e0866f9e7705a25b8c2e11d6d8cbb09cc5faf8d5fdc322a1478ed5206a8f6bc56546ffc38b8fa7557f0ede39860293751193706e1

  • /data/data/com.jiubang.goscreenlock/databases/gostatistics_sdk.db-journal

    Filesize

    8KB

    MD5

    d68baedd8e5a85595afbec30f3ee5aba

    SHA1

    227f1fdc0cb39e4009c8973f5346816facc67e23

    SHA256

    b8d759185189f92e2d4ba8328d358b0cc317a5b65765a69c68d60bd8bd48e659

    SHA512

    58301519ed7d0fdef909995088e1d06c35732b5c6ff77323530b868b33a0cb4579e25a6bbaae04d1aa273d805f9a3f5803e7861a41c71182e350c2189535fc6f

  • /data/data/com.jiubang.goscreenlock/databases/gostatistics_sdk.db-journal

    Filesize

    8KB

    MD5

    230d65f3ca2b410e7226af4f85b49502

    SHA1

    e46957b71da629c4b31562bb0747da8285888347

    SHA256

    2ffe2298d39f865199ae1877cfe846273057ced243ad5e5dac0e88c969373ff6

    SHA512

    5802f576e88993a97a32377d82f22bfb586d6c815fd31abf77d2b2f777c2043e5d7d3f14416c9b1babe9778c2ced59a22a3496de3744a4218fa5d71b0cf8b949

  • /data/data/com.jiubang.goscreenlock/databases/gostatistics_sdk.db-journal

    Filesize

    8KB

    MD5

    8fe4d4f1f48d533468776dd910ef87b0

    SHA1

    46ed7899a17d7720c2038bd525f0c758e8ea3640

    SHA256

    e68b1fd0908c6581380f47e5ea8e4b0e300d0c8f77e974fac268222d6fefe894

    SHA512

    b4434db33b1553e9b389bb8ef219e1ecc99febf996469cdf949c9cc14b816aad854466c5139bb2d36563a63dcea83c9192fa65bbd1ca85e94ad7b4996eab24f6

  • /data/data/com.jiubang.goscreenlock/databases/gostatistics_sdk.db-journal

    Filesize

    8KB

    MD5

    b4195dc5bdc8229c1cb4152d6fff5ffa

    SHA1

    e0a9906c10a03180cbfd3f3a49ca3b4c2241a5b4

    SHA256

    b6b5c7f2e217c7f1523c11f615f3581addf0d0af6e15e98695411f464cb8cfb5

    SHA512

    2ad6dac6aaefe1b5954935448cce3a45e4025831db92f599177fa12c4a1857b615650af18d7502f2920b70f49099f237608770f106d1ba99011d33b0fa40167c

  • /data/data/com.jiubang.goscreenlock/databases/gostatistics_sdk.db-journal

    Filesize

    12KB

    MD5

    f10ffc40515cb8e52d1ef066fcfe2f01

    SHA1

    ac87588d0767bdc185265b5dfbf2f4aa35512098

    SHA256

    c465983adf0b660b42a078a857e97466a079692be28d5be3c3381e5980554def

    SHA512

    b91d1c3eb2feee2c99aba783d0ff4790c3437f22810557606c28734f43843636e981a2e2fd06696476316a1f7d553cb5adf98fcf0621bf611bde700d863b6a1a

  • /data/data/com.jiubang.goscreenlock/databases/notify_calendar.db

    Filesize

    20KB

    MD5

    75719be14d30c91b73e3bc0ff09c87a8

    SHA1

    9c56e7d046814ee76835d3cdafee06b4c225053e

    SHA256

    35dc12f0bc0811af34adc4d2ca851a5d649d9aebf234bb761cf6f0d0186fa567

    SHA512

    b07c47fca3d60c499c31063b1a0637f9ac6c093963ccb2b5a5d29cc1f9fbf16314e13a223c5888de7595b487e7b369c6b5bf40a89797b1a24d3d67c19f40409b

  • /data/data/com.jiubang.goscreenlock/databases/notify_calendar.db-journal

    Filesize

    16KB

    MD5

    6f4a9028e0b647203b0008d64e4340cf

    SHA1

    5eba4851edbca957f2ff5d5ec031ef73da1a5969

    SHA256

    ca7ea4a446f967c3c04310f856050888e7ac80ef9b013a880b407c959ac5fe34

    SHA512

    48f51f5db35e89a67b76c52b4ebf21c7875d7703dfc9221bd4067ba1c1502746276fb4f09dfd605cb2c5a41bce94f965d8020a75d75bd074d57bc8b2311c3696

  • /data/data/com.jiubang.goscreenlock/databases/notify_calendar.db-journal

    Filesize

    8KB

    MD5

    4a95f54809903c7f8e6c3cbb7524d8df

    SHA1

    1aeb6695be76adbf90331c42a1952d60d89aef3e

    SHA256

    8c931ca2132e9c3359c8a3e5967f89d2a57fdfdf4b65feeea4a587f33b35c22a

    SHA512

    59e86bda574ea9b809afded5aba969a6b77c80075bb44353ec702146ead28cd3c10152f25cf7c0e5d070e5e02f0c081e87049eec274555245c6724a987773a22

  • /data/data/com.jiubang.goscreenlock/databases/notify_calendar.db-journal

    Filesize

    8KB

    MD5

    eb4177879aceea54afbaded78d3d6247

    SHA1

    4e702d45a680d499eedd129eecc2434969ed0e0d

    SHA256

    08a553741660a7ffa424ae98bc5696216d30e393717d8836d91cb9320d575760

    SHA512

    98464cde6fb4d15bc1f2ec6b04d72365dd384cfe36fece6466b19a6ae125bf3a6bd015e2d07bb9264242079b39606bbc6ebf315985eca93eaf760c376e749873

  • /data/data/com.jiubang.goscreenlock/databases/weather.db

    Filesize

    20KB

    MD5

    e3c640da43721acd27e1aaaa1fa4054d

    SHA1

    d56cc0bd8d2eeea3c36fba97923577a2ab7973e4

    SHA256

    6c42fc780f932dc65b184e353f531b8f3cb7f4e2e4b0c76598e25b8d6f7d8911

    SHA512

    e437d176bc3e0974edcac3491a1908c1b1f1cb791a90e0bcb8a721f4313ed89831ec901caa91b7768cf7f1c5e080afa956f4db7e58d9f1a61bf81973ffb204a6

  • /data/data/com.jiubang.goscreenlock/databases/weather.db-journal

    Filesize

    512B

    MD5

    13da341d8ad3c916d7095a9156855722

    SHA1

    bd3abfe1c940c658ff630b263fcac3ce3cfa3b45

    SHA256

    12e5fac77e270b6454f31c98eba2234e449d4b3cc2dd35ca7d19c8942aed0ee1

    SHA512

    8e314b5cc17858ab5eaf76569acb8683a22b2c319aacd11395886f39e93e039908ce30c739c9aac0a935813c3d254460c4bd2b24433bcec959c6cb87c70875c4

  • /data/data/com.jiubang.goscreenlock/databases/weather.db-journal

    Filesize

    8KB

    MD5

    c46922265eb0813ae82407281e8c9c73

    SHA1

    7df9bf880fe2220480db7f552c2244b3a593249c

    SHA256

    8d66f27bce59886146e1957dfd07c74d55425a846eedfcb019ca48fe195954ff

    SHA512

    6b26915c8c4fb48435bbb1d5806bcfa0a91699db1d9e7e95438cb904b181d58a4bdd95f2e1b1135d7ccfc43503fa97536e6936f7a97a47da41aeef4678cb93b5

  • /data/data/com.jiubang.goscreenlock/databases/weather.db-journal

    Filesize

    48KB

    MD5

    64f84f1b5a4e9604e76af5d6adceac1f

    SHA1

    56e48c1b0f3679855d1dbbd2d2d803c0c174401a

    SHA256

    829c72450f96cb5b629b36050d7b08174367ccc870a4643f36d6ca38c57175c1

    SHA512

    fd9b9e5bb238a6dfeecc84b6410487a32b3630cef3c1952ca7a1679a1fff93b99fbd0a44ed3b212c06a85d71aa61ba6d47cdff45b0cdac7ddc226b8986952b05