606936c290c675dcf56730307002d8d4fcf5d9914f616a1bfccb5d5b82636e12

Analysis

max time kernel
3s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
09/07/2024, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3161c69c344bb7475d720d3194f1a867_JaffaCakes118.apk
Size

5.6MB
MD5

3161c69c344bb7475d720d3194f1a867
SHA1

1a0576cdf06409f7dce3eb8fc30b8c2d3cb56b04
SHA256

606936c290c675dcf56730307002d8d4fcf5d9914f616a1bfccb5d5b82636e12
SHA512

fe07e22ca795f9a55f9cb347c13143c241d4f96c55e919fccfaba3ca0ba6cad51506661878b64a2bcb09eb7b24dc14767f6930d92797316455fbb5b638a63563
SSDEEP

98304:3dZFUMZ4BE8wCaA30tumaqpspOgmDktBOESV6P/RGupq3TCb1hC/3tVbU6bf:/FUMZ4O8w8kfWA0HFSVgRRpq3TCbzuX3

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.device	com.shoujizhaopshipinhuifu.yi

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.shoujizhaopshipinhuifu.yi/app_AdServer/AdServer_asset.apk	4441	com.shoujizhaopshipinhuifu.yi
/data/user/0/com.shoujizhaopshipinhuifu.yi/app_analytics/analytics_asset.apk	4441	com.shoujizhaopshipinhuifu.yi

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.shoujizhaopshipinhuifu.yi

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.shoujizhaopshipinhuifu.yi

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.shoujizhaopshipinhuifu.yi

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

com.shoujizhaopshipinhuifu.yi
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4441

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.shoujizhaopshipinhuifu.yi/app_AdServer/AdServer_asset.apk

Filesize
1.1MB

MD5
73c2ac27961b9db4274ca13a178c0fa2

SHA1
3d1b1a8f6c9bc63fc88068c71e98bbe70797d03e

SHA256
751012d560a3c16a6f377f403ea12b9c6805a279d84c08210f9a5543c5bef42e

SHA512
591bf3bd1316189616aed273c5bdcb49ed1c46fc7bdf6ee1db9ce11b317dbfda5477989cc3ceafaa2e02dc6555afa1ac4ba872ea27d9a8ae9b5a9ac3abadcef8

Download Submit
/data/user/0/com.shoujizhaopshipinhuifu.yi/app_AdServer/AdServer_asset.apk

Filesize
379KB

MD5
e865fc4fa68968e2f5375e94d8b9a9ed

SHA1
ba765ce01cb46ddd73de57ee5035e39133840d1b

SHA256
b1fff92a015efe5fbe4c4dc2c23fbeb7b10682dee887d91e80d7db939ae91e5c

SHA512
cf5ea475bd4e5edb0e6e1a5e30e979edb49e6d683370fa05e410635c1251e5293ab59e830e5840556b0721e22b954b2c50341f26eae4a3e71ce5280246259b94

Download Submit
/data/user/0/com.shoujizhaopshipinhuifu.yi/app_analytics/analytics_asset.apk

Filesize
159KB

MD5
d2e90bb505f20fc73baf25805b0273aa

SHA1
240fbbfda194a65761baed6f3546bc4c744a1850

SHA256
77060ad812f5e6e9e896c39bc548f8295238eaa9941e1986e8e024e7d2114309

SHA512
c2ef3f79b6cfb171b0904ff8138238cbf985344d91d6d9ec35472d14233d1b108cc0234259e8286cbb099747cc8d9d2f74c8c7394ab3a6dcfc2cc95e168c8c85

Download Submit
/data/user/0/com.shoujizhaopshipinhuifu.yi/app_analytics/analytics_asset.apk

Filesize
132KB

MD5
6d363f8778efe0e54f37ccce23d16fbc

SHA1
11d186169520c633d09a1a775747ed0fe5181c55

SHA256
b1b9b928f020d1ecd232211f2733dd1fc640f5101db35794ef43dca96766aa55

SHA512
e375c9d975e4c44d7424c43f7c01cdb5db474a71c4658ca1a021a5cd3265a8e5027f671f3d04ddee962a34f65ae4eeba5c45c36c286a8016277993a1d6931cb9

Download Submit
/data/user/0/com.shoujizhaopshipinhuifu.yi/app_analytics/asset_lib/libanalytics.so

Filesize
105KB

MD5
cd1cdef06a5e2a33c5c9e7d4a6cb915f

SHA1
8df09fd32c4fa6b821d9dee89a4fcbf7d32b9b02

SHA256
929c2b04d1495dd1a8b8b72552daedb5d8c385526fac224f5e3c466f748467bf

SHA512
8518002482356e5caad64d33f74172f13fdf3150a05d3dd20662bac8e3ff3e95986a5a7331fc60753d6db8eb5aa3e0779127946505d1fbd03e197359203f88f1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads