2ea91b8540ab86f1f14d6c1541401e3169a91b301bbc148dbdde9f9d92962197

Analysis

max time kernel
16s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
06/07/2024, 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27e859a205270f72e5062238a15f8614_JaffaCakes118.apk
Size

6.0MB
MD5

27e859a205270f72e5062238a15f8614
SHA1

1ddf0f8a833ed9475fbfa23276206a84b0b22dd4
SHA256

2ea91b8540ab86f1f14d6c1541401e3169a91b301bbc148dbdde9f9d92962197
SHA512

70c59dcbfe8b643665c8581e7548eab5b05ee2c7db645a58d20a73a8e857d980a2f2d52584dbfca7c6e49c11e55bbceb859e98fbea3d73ad3d746cc7525a38bd
SSDEEP

98304:+7o+JezFe+p8VQXazNqXO29rjgq3p4SXEtfK7DkMByz2/GNJpr39slVNfqgwDx:CJJUlKS4Chrk0u+DFy9h9yNLwt

Score

8^/10

evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	cn.gamedog.miraclewarmassist
/sbin/su	/system/bin/sh -c type su

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cn.gamedog.miraclewarmassist

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cn.gamedog.miraclewarmassist

cn.gamedog.miraclewarmassist
1⤵
- Checks if the Android device is rooted.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4260
- logcat -d -v threadtime
  2⤵
  PID:4319
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4339
- getprop ro.miui.ui.version.name
  2⤵
  PID:4339
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4366
- getprop ro.build.version.emui
  2⤵
  PID:4366
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4391
- getprop ro.lenovo.series
  2⤵
  PID:4391
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4419
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4419
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4443
- getprop ro.meizu.product.model
  2⤵
  PID:4443
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4467
- getprop ro.build.version.opporom
  2⤵
  PID:4467
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4493
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4493
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4518
- getprop ro.aa.romver
  2⤵
  PID:4518
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4543
- getprop ro.lewa.version
  2⤵
  PID:4543
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4568
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4568
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4593
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4593
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:4619
- getprop ro.build.fingerprint
  2⤵
  PID:4619
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:4643
- getprop ro.build.rom.id
  2⤵
  PID:4643
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4668

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.gamedog.miraclewarmassist/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cn.gamedog.miraclewarmassist/databases/bugly_db_legu-journal

Filesize
512B

MD5
a3638f7d9ffa7284858d5defebf7ac83

SHA1
215023f50eeb92943e645812cd097868f66a3bab

SHA256
c62de8f3ba8efcc036183befc3f5acafba1c7379bfbdb2c6ba77d39975abb5c4

SHA512
1457658bccdff9d0be13ab0643c3e9c2550ad8a8f01251d3b3f2bf88f8ffb93e1aeafed95a3d05603a4582ebe94780c4341a7838e612fc32150bc86778d001ad

Download Submit
/data/data/cn.gamedog.miraclewarmassist/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/cn.gamedog.miraclewarmassist/databases/bugly_db_legu-wal

Filesize
156KB

MD5
37b091ca62f18a84a67e73ce6360c42e

SHA1
7fe52c258d94daeb3cd1b7e5540356d074364d24

SHA256
e13d6b7d764c5a3cf9d58909723a308f853efc954170fe4e0c8d421b29688a20

SHA512
795ce0b0dfc497e9a74bc1df36e7f1cc22fdd36be84e02a0932e55c3a05cf21989b506a656476d6559d5e96d53b5ce71bdf3a4c93d8ff320b0c035e4ecba87b5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads