Analysis

  • max time kernel
    8s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    18-06-2024 11:47

General

  • Target

    bbc39f755b123ae1d1a2f8ed279badd3_JaffaCakes118.apk

  • Size

    12.0MB

  • MD5

    bbc39f755b123ae1d1a2f8ed279badd3

  • SHA1

    f86017a9216932f636e01cb89e53e2b707573311

  • SHA256

    3f8f6d307ff497b21fa48ecef396bd76e632f2fc7ac3a2f6963d737a9d5608bf

  • SHA512

    1e87bbad29d0fb84fba00cb5fcf7c08aeee9886d99651773c374d1cbcf9d8cf00b7645e34936d0cd7a37857c195d514b7e0940373da83e79e8b21acb205afeaf

  • SSDEEP

    393216:uYPRKNBATQF+pTvvtgmSnJyUuWaDPL/JYUQnLe9gROrksK:pPwN60F+hvvthSnJyUuZDPL/J3QLeOOQ

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.mobile.kadian
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4262
    • /system/bin/sh -c getprop ro.board.platform
      2⤵
        PID:4294
      • sh -c getprop ro.yunos.version
        2⤵
          PID:4313
        • getprop ro.board.platform
          2⤵
            PID:4294
          • getprop ro.yunos.version
            2⤵
              PID:4313
            • /system/bin/sh -c type su
              2⤵
              • Checks if the Android device is rooted.
              PID:4346
            • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.mobile.kadian/mix.dex --output-vdex-fd=50 --oat-fd=53 --oat-location=/data/data/com.mobile.kadian/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
              2⤵
              • Loads dropped Dex/Jar
              PID:4365
          • com.mobile.kadian:pushcore
            1⤵
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            PID:4437

          Network

          MITRE ATT&CK Mobile v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /data/data/com.mobile.kadian/databases/bugly_db_legu

            Filesize

            4KB

            MD5

            f2b4b0190b9f384ca885f0c8c9b14700

            SHA1

            934ff2646757b5b6e7f20f6a0aa76c7f995d9361

            SHA256

            0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

            SHA512

            ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

          • /data/data/com.mobile.kadian/databases/bugly_db_legu-journal

            Filesize

            120KB

            MD5

            410301444adb7b642d603f548b7f7606

            SHA1

            7750a42ac40b3bfbd81c38b1601bc9820a33e05f

            SHA256

            3d99637597dbdaf8ccc35daf6a10e2f857b5cf0c21bef802b99cd3486e8f5c10

            SHA512

            431b68e167b84dd099bfc446b6a53af91f9b2ef0363cc63afc754d88862c079b6cbd70d2c90cca8221d992695961603770fcbee7daadf0035403aeb32d25b2c4

          • /data/data/com.mobile.kadian/databases/bugly_db_legu-shm

            Filesize

            28KB

            MD5

            cf845a781c107ec1346e849c9dd1b7e8

            SHA1

            b44ccc7f7d519352422e59ee8b0bdbac881768a7

            SHA256

            18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

            SHA512

            4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

          • /data/data/com.mobile.kadian/databases/bugly_db_legu-wal

            Filesize

            92KB

            MD5

            506406bb68fa2fa3388786ab5c20305d

            SHA1

            e2d5ef60c2b6e7243fa9b90c453337c84909adbd

            SHA256

            5b920f4b559d9ed28e1ab55ba0184941b9f8f76c4041487c4f6dc2a836d5ab99

            SHA512

            1013fcf17a2af3e34d1569f02a8af8f0a23959e1d8509ab746a737d1ae85d105e6e9b0379eed9821260d9b45cbd20cf4e17619184f2f05d8daf3c3c60175714f

          • /data/data/com.mobile.kadian/mix.dex

            Filesize

            292B

            MD5

            63f77f99bd2c2b772a479923bde11974

            SHA1

            c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

            SHA256

            4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

            SHA512

            3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c