ea7b9486d8adb78fa5fdd590a021943ff01403bc10152484477c263e7be5a005

Analysis

max time kernel
179s
max time network
189s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
18/06/2024, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbe0cf486163a3d784e9bcacec051b0a_JaffaCakes118.apk
Size 16.6MB
Sample240618-pex98ssgrb
SHA256 ea7b9486d8adb78fa5fdd590a021943ff01403bc10152484477c263e7be5a005
MD5 bbe0cf486163a3d784e9bcacec051b0a
SHA1 a16f250f2a15d23d3e3622d80b6c40a0caa965e2
SHA512 46a7de799122915785562b4cf0a4e16440ef56c0c0c5f2b00cb0df2a7af3c713560489093cb4241a6b9fcee7464961dd894f08071b289d8048d8acbda053e5f7
SSDEEP 393216:9eUikw0/nioah8a9qHbIeNs3j5rn9ZftuxOkjyI4x:9e/U/ioav9qHzNENTt9Xlx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.yiwyxb.jund24770
/system/bin/su	com.yiwyxb.jund24770
/system/xbin/su	com.yiwyxb.jund24770

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yiwyxb.jund24770
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yiwyxb.jund24770:pushcore

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.yiwyxb.jund24770

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.yiwyxb.jund24770

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yiwyxb.jund24770
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yiwyxb.jund24770:pushcore

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yiwyxb.jund24770

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.yiwyxb.jund24770

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.yiwyxb.jund24770
Framework service call	android.app.IActivityManager.registerReceiver	com.yiwyxb.jund24770:pushcore

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yiwyxb.jund24770:pushcore
Framework API call	javax.crypto.Cipher.doFinal	com.yiwyxb.jund24770

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yiwyxb.jund24770

com.yiwyxb.jund24770
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4202

com.yiwyxb.jund24770:pushcore
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4231

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/data/com.yiwyxb.jund24770/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

RKStorage

Path /data/data/com.yiwyxb.jund24770/databases/RKStorage
Size 80KB
SHA256 083e370e916d988b195c2e2a9210d6e40990f3c6680b3b70740ba0854f0900f1
MD5 735e19ddeb02d9ed26f5a52b0e3d3560
SHA1 ca12218d480cd3b08460d2ecf7ac1e4f249a6195
SHA512 f6b171806179f7cf6f66d5d1c308a691b87f0e432b9979ee7f9554e903c96470c8907fc4b3a231ccd3c04fd8567bd8362d589c34ecad4c4d372e0f2ee7ec50f1
SSDEEP 768:BfCQY4o/bXmBX9cLx758fp2X/6WfbCrRWmff3ARRP83RbjwAn0QXAfHhQJQcQ3Qk:QbXmBA758fRRJQvyqhg+4G5vgqhg+4C9
MD5 SHA1 SHA512 SSDEEP

Submit Download

RKStorage-journal

Path /data/data/com.yiwyxb.jund24770/databases/RKStorage-journal
Size 512B
SHA256 dd66b448582ad3418200593be72b8cb186f34926b59a8ebf6faf0d85080659f2
MD5 0712dde52cfbdadbe7ec5e17edf71d96
SHA1 231e6024e391c04c9857164602ee246b2f4949f2
SHA512 dcb1bfe5ac6937c2f002b297b92022d5bfd11c660565f3796defbd699b10a2eb9a49cdff75c50d96028084702bead816a62f2fd45269d12d567343f0d7de1f59
MD5 SHA1 SHA512

Submit Download

RKStorage-shm

Path /data/data/com.yiwyxb.jund24770/databases/RKStorage-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

RKStorage-wal

Path /data/data/com.yiwyxb.jund24770/databases/RKStorage-wal
Size 474KB
SHA256 57501c1cd9dcfed2ccae16b096d75f88f08b880506b85a7986fbcfd86d13e78e
MD5 3198a6b1e1de74e7afca5f17a3fb9e91
SHA1 c51e2b32203e24b6c3027819db68af0ca4d8c23b
SHA512 59d82143479066884512643a8802c43f4d9d560192a0b7d612388965332369748ed97227a02f86c021507b85b1a1d07e935f1af5f685690669797685d8f94d9b
SSDEEP 1536:LhbXmr72758f9RJQvGqhg+4n5vgqhg+4N+v+KLlQKR7i75JfRRJQvZqhg+415vgs:FbXm+w+dfEGbXm0YPKbXmHrJDJeebF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db

Path /data/data/com.yiwyxb.jund24770/databases/ua.db
Size 36KB
SHA256 1e17860bba2bb4e3e92df3890aa6dddc973d6602c71519a15556d37bb69de2a1
MD5 0adda9c85a5e4808f5b1b74c0a8591a5
SHA1 5048107883ab1e345af9cf2e6849ce46e0e612bf
SHA512 646061d3d5849772511bd94e36ca2d775a9a672851629d1812942ec0f0f925714eb7d4ebac44889911320cb6710a2f586014f6b1e126739cab653c4f8deef2d1
SSDEEP 12:TC+/ZapgPBuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPb8FOwIQQQ:TpoiD4PPvP/BlmqygGSgIQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db

Path /data/data/com.yiwyxb.jund24770/databases/ua.db
Size 24KB
SHA256 62a942addb68baabec9074359643f2dc1bff258b5337dcec9df9040ad9142e43
MD5 262213540d3d20fc8834bbe9074a3df0
SHA1 ed45f700cb073ca707f95713a600af712e429587
SHA512 7d0406941c1638afdc20fed8c954b65941b3a151166e874b3f23d95dc032d9efa3430e7bca3559b84329e1282490ce0c7f1ff31dce1487e2d8df00df4ed366ab
SSDEEP 3:pqAt/r4l/mAAUPy2PPRkUSC+1vlNkt/DUPy2PPRkogqW1leGn:pqAjo+JMPPRkT1zktbMPPRkhPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.yiwyxb.jund24770/databases/ua.db-journal
Size 512B
SHA256 0d1b8d4a27eb4dde2128a87138fae4200cd468cfbe6422e46fc83d1583bde39b
MD5 cac05e67e9e8c30b3de2405f27587e31
SHA1 e908f1ebae4260de3a352eceba7ff8c5ca91532b
SHA512 a851469f0d8425fb2326f080e212b59c847fc637147bd8aeb428825ecec17ce14461fb48196880b850defa3787bead1d388f90bae9f2c09d2c4706cb0fcffa3e
MD5 SHA1 SHA512

Submit Download

ua.db-wal

Path /data/data/com.yiwyxb.jund24770/databases/ua.db-wal
Size 48KB
SHA256 fd9a3270cecb83a455db653fcca335a158d28fff74dabd6429ec2e451464d594
MD5 e1e72686e81c969704641f16b921766b
SHA1 37e916a4a1b90cc5ef29b7e75346ffa6eecb2b9e
SHA512 68d43f916fe0c905b7ecbfc8c71bbdcc20291a1d66164f78a0b7c7b9d19d1031291eeee58d4510ccacc278ae46f9342e0d211ab2e7e6efe261fb90190c1581af
SSDEEP 24:KYzyGSP/ullxClpoiD4PPvP/BlmqygGSP/2tHFTB:pzNSP/YylWvf8SP/2tZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-wal

Path /data/data/com.yiwyxb.jund24770/databases/ua.db-wal
Size 12KB
SHA256 392fdfa970a17b846291ae39739e216cb82c5289c755e0ef47d302ef82389639
MD5 93f96343896ac1fe836e2bf55a7182ae
SHA1 ee99428562831a4cff10ebeb97c2d1694a465879
SHA512 11fc09586cdbc469e6741f0fe35f0158564e1a8a93c316b4a353a4b39fe8d051bbdc261cfc54c159555dc00a757f1271cd3037463c2e27c54b9726082a6c6458
SSDEEP 6:KccUvYQDacUYcjqjo+JMPPRkT1W/0cUywktbMPPRklLyMk1Pn:Kcl9Da3jYo+JMnUNkw1ngWMgPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

a==7.5.3&&1.0.3_1718712937331_envelope.log

Path /data/data/com.yiwyxb.jund24770/files/.envelope/a==7.5.3&&1.0.3_1718712937331_envelope.log
Size 1KB
SHA256 9f8d8d8d039707fdbd69fa1ff8b1cde267ecdca9c80460cd66bef3d884f06baf
MD5 258c9ab752242c72d423962348d469f9
SHA1 df8a12c4bf82979a44edd168b7c8a6921501429e
SHA512 a9c1907e5569f463230781b66806c113e6557de68c1a71cf8da5d2da895891fb9e4e6d2cc1d447059aacadef05b05cdfca7b9bb08e161b0a6860baabd8a0d3df
MD5 SHA1 SHA512

Submit Download

i==1.2.0&&1.0.3_1718712935470_envelope.log

Path /data/data/com.yiwyxb.jund24770/files/.envelope/i==1.2.0&&1.0.3_1718712935470_envelope.log
Size 2KB
SHA256 2cc279d9d2fd5adc16db9a5296eb69386c7f473b738cb09d5e21b71eec2ab218
MD5 ab93116154b5eb8dc81b135b48973ec8
SHA1 edb54d22449b99a1811d1bafb697ab939ee2316a
SHA512 801b5d5f14042bb8b30b9c46c277ab0b7a783cb107983567553a83d88c02f06cf214cf620475bead0489991a1adbc92c7f9ed9e1a1132dc13dc40b14ac391a52
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.yiwyxb.jund24770/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 af51450ee3402e53c3a5d6386f86f7bb1a4953244a235e6f135c9aae489c485a
MD5 f69e5481c10330b0696d2b6a399e2032
SHA1 a068db2e3a90c8eb42ba03384d1cbd92d1275fca
SHA512 7c0de74b3f9a9eabd19e931fab1963523f206ff04a439926cfd66c8f9a21d665e7d12c7c9ec6af6ea7afeb30d140b7869c6e2765582448feb4ccd40d627e22b9
MD5 SHA1 SHA512

Submit Download

exid.dat

Path /data/data/com.yiwyxb.jund24770/files/exid.dat
Size 64B
SHA256 b571b0cf0a2a963ae80b01f077bcfbd04fc4815c06ad8d5903e96c30146ac114
MD5 4b94987be0a93fb74f2dcb1c1cb47569
SHA1 00628288838d077b6e274ce48691c6dfe9d60082
SHA512 67a65b498cb4bcc2b1c62c75969a696bc26b88bf468505b1753b8704561be077bf1ff52dd2a08c077accfa27232d9702912c247023e12ef88e21a5a36c9376ef
MD5 SHA1 SHA512

Submit Download

d54141cd-82d3-44d7-86bc-e9f023535557

Path /data/data/com.yiwyxb.jund24770/files/jpush_stat_history/active_user/nowrap/d54141cd-82d3-44d7-86bc-e9f023535557
Size 159B
SHA256 2865718b06874e374c1eec7c7052a740c707fa704b459b033dd35c41b8ea40fc
MD5 0298b32dec8e9ba7572309ba5625874c
SHA1 d08129b0a192519fc2a3ed3ec8c929a71087f6c2
SHA512 6a1c5de09a5f53d25f094b18bab637e20187398710c5b2a3c4c775919622f2fdd2989c21566168f5aeb8281bd64dc84ca7a8c582f7ba91f22167e60162bafc42
MD5 SHA1 SHA512

Submit Download

dW1weF9pbnRlcm5hbF8xNzE4NzEyOTMzNjA0

Path /data/data/com.yiwyxb.jund24770/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE4NzEyOTMzNjA0
Size 1KB
SHA256 4fe5427119f30704d3c98f56c73595f553fc892fb6442e964c2ea8c5b805b849
MD5 07eeb099bd0de236479b9de996f5106d
SHA1 f96ab66801f3685eee3888e09c148c46825759f6
SHA512 3e3eb08f3a8171cec8e87263108adbb9e54d15d9299a9ac8823e594f87755a914a5bcde1d73a81962ac8a1693c1d5945a5b8c859f5824aa6db3233f0aff3bb15
MD5 SHA1 SHA512

Submit Download

dW1weF9pbnRlcm5hbF8xNzE4NzEyOTY0ODU1

Path /data/data/com.yiwyxb.jund24770/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE4NzEyOTY0ODU1
Size 1KB
SHA256 83a5c5dbf10f5d3ec47b7c8f37f71e20ea9a2102a6a3ca5df0e5fac7fbe795ee
MD5 d44a28f9540715719b57c0cbc8de62c1
SHA1 8805819c4baa5ba0c00a05f8bf1a225724cb1e4a
SHA512 71a433cb96f049eb2e23e2b1bde88d06ce129097e3e8b8fba266487d5b4079d92a336c6773b5dbb2de4a7eecf5e95b9162eecbe42620489b4ea6c23da1c78754
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.yiwyxb.jund24770/files/umeng_it.cache
Size 415B
SHA256 a0cea431abc8d7e718b333496ca64c4d29fb8a323b40e7b80f76ef44a5bdaf4d
MD5 36eba802d2f27774829dd5000d802a4a
SHA1 638e202b45295aacd5e11bc15eaad6ca953c1643
SHA512 69274e85f8727939b10ca6a31cbdd2503a4c69c189630573f9001d56e7a3966684ba3b7093b5f01e38fae754c4ad43dff67e05a16e7de3b71b64dbf257d1f84a
MD5 SHA1 SHA512

Submit Download

dso_deps

Path /data/data/com.yiwyxb.jund24770/lib-main/dso_deps
Size 148B
SHA256 0dac0741a4d3df247580dbcf35c9876372528bfdd84351c08fe3a2a23d9fc486
MD5 71b8c11a5a12378c1d310f274dc55f8f
SHA1 c3cb9ffffae75e17916eef9cc9d2a36f323b399b
SHA512 0397952b20a5dc50772de36263a39421763753ddfdb746e081c00bcde4a7297efd55a2b61513bb86837325967d39eb27911609dc63b5a55ccd4586335785b900
MD5 SHA1 SHA512

Submit Download

dso_manifest

Path /data/data/com.yiwyxb.jund24770/lib-main/dso_manifest
Size 5B
SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
MD5 c06857e9ea338f3f3a24bb78f8fbdf6f
SHA1 c5a0a2529d2deb60fec041b4fbd722a2ebe31702
SHA512 29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1
MD5 SHA1 SHA512

Submit Download

dso_state

Path /data/data/com.yiwyxb.jund24770/lib-main/dso_state
Size 9B
SHA256 84ba4bc68af8f591dbd78998df67a92a8e11e8923d925992ea8fee9abc6cd615
MD5 bf8feae6664953b133f31827c4d76db7
SHA1 7e05dd62edd704ef6214ec2fbab0fbb32d969193
SHA512 daaea951178d37e447b3737de33ea4e5985823308dd8006db76836957e5fe4757f6fc15499e3cbdc9d113a907cffa0bb0fcf34e85212b335d648233a66a49860
MD5 SHA1 SHA512

Submit Download

dso_state

Path /data/data/com.yiwyxb.jund24770/lib-main/dso_state
Size 202B
SHA256 92918201ed8f036db697cde559823c6a464d188ea1760d4bf831306ec72528b2
MD5 a5cf2201da1acab14516a0fbfc5aeacc
SHA1 668a20125b7ddd78226a459da411c12c7faec414
SHA512 e92e23a0d1ff7117b70bb17a959c6404665f048a1c8da8e73879de70d6c592ddd921c23ef51646e6bf2268f72810c4900462f07cbf2b8d7470f4ebaa290d62f0
MD5 SHA1 SHA512

Submit Download

.push_deviceid

Path /storage/emulated/0/data/.push_deviceid
Size 32B
SHA256 f4769a4bc20f1a67226a0584cfcc68cb97581642f6400c2cb4e96d56b33656af
MD5 59af03faefc88cef3142254e9b845ec4
SHA1 b46b52fe31f8d3c0713059e01df2798539986a54
SHA512 3edd9108aa283b5324776aa8985f11fba5355f34c886a44a143180e88abf107bfe0240ef339b948879584d63bdc619f1060ea3bec602ef5a2ac3cb8c1623daed
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads