Analysis

  • max time kernel
    160s
  • max time network
    166s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    16/07/2024, 05:42

General

  • Target

    4d074696c1302ceb44c106581300bb63_JaffaCakes118.apk

  • Size

    29.7MB

  • MD5

    4d074696c1302ceb44c106581300bb63

  • SHA1

    e79e7557103f2b11f19e20aef40b2cc971ec73e8

  • SHA256

    792afa64573533b95c3cfbfa46ad27fd27b4385db0043b64218ae607852bbac9

  • SHA512

    2bba95ab11cfdf87068885333cc233099aa948dfb6e3fec9285adee24191096589e65c9604053fed6250996a825dbf2abbedbe56bbe364f30bdddbf0839e050a

  • SSDEEP

    786432:L0C5cboBEehOT10Z6JOwDu2sn00/NssPoMnSeeNX/:wCgouT7AwDu1/WsPpnSjl/

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Requests cell location 1 TTPs 2 IoCs

    Uses Android APIs to to get current cell information.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.hlys.yjbm.nearme.huawei
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4252

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.hlys.yjbm.nearme.huawei/app_crashrecord/1004

    Filesize

    234B

    MD5

    c8f3be2cf40dacaec1c4ca22b3a47ad9

    SHA1

    310a50bf50fb7ed9857502406dd4ec4136a72216

    SHA256

    83895421d70e7be29f6bff5bdaad88e8eb1219de01df330c8d17645b3f1361f1

    SHA512

    084c1a292afd4293b9b01d5816fc5482f96eb8faad891b7709e960a4811eb9e3e021fcd6334061ac1f8150d91f3678e292f255dc98059a82d56938ad33172608

  • /data/data/com.hlys.yjbm.nearme.huawei/app_crashrecord/1004

    Filesize

    58B

    MD5

    0d210bfb2a0e1f1b4c082a6a0f79de07

    SHA1

    bb8ed9e364db79d1d9f2fcde3f15091893222faa

    SHA256

    988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

    SHA512

    536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

  • /data/data/com.hlys.yjbm.nearme.huawei/app_dex/ddai300_ds.jar

    Filesize

    303KB

    MD5

    00dd6aa26ff8c3ba61a35eb8e2f89e3d

    SHA1

    31ced9346b7e9119f00dd7ff53b898311633cba8

    SHA256

    68aa9cca86b71130fb9b828ed1b2c02f3df66a21629f6407cb39be0091bbfd8b

    SHA512

    7c3f77f18bd9f081e1c751c7077e40b79a7a8fef54d21597a9135e4ee9f788ba87bebd472576ea97a92098b270d5f6b862360f16ffd03b0f41d5ca2a4e61f1b0

  • /data/data/com.hlys.yjbm.nearme.huawei/app_dex/oat/ddai300_ds.jar.cur.prof

    Filesize

    315B

    MD5

    48bb02379dd13be61e495bdcdb24df51

    SHA1

    5012ec2a41bea3570e1a60af5d9d2ddbf9c66379

    SHA256

    95b531061989f468c64e3cc1e70c656dcacadd4829658897889601c3264951f4

    SHA512

    ebc4c0e475ac5867a2210ccf2e6fd54b6ca57f21b54c3b7d8a0faf00991c6ee67be15204d0932c83aff6a43880893c67e2967c58694e67529637480d73949562

  • /data/data/com.hlys.yjbm.nearme.huawei/databases/addaicfg-journal

    Filesize

    512B

    MD5

    3c5c069bbc155d3ff4fabaf493d68263

    SHA1

    24e9f06f23309ba1962d4d7bebe708c47a199e91

    SHA256

    e81129c3094c6ddef4fadd24cac3b65bfd2251934f2942585513d909fd2f0269

    SHA512

    eec7126708ffe59e3846128a802329f676c65b2ddb241187f6399ad2318d0b06115ab3686a080032c179a360e187fc2433346b26a05ad317feec7e4c559c4dba

  • /data/data/com.hlys.yjbm.nearme.huawei/databases/addaicfg-wal

    Filesize

    177KB

    MD5

    28d1b7bfe86295e0d496655ce0347b65

    SHA1

    4cd58c83edd59ba0067844a38bb3ab2fbb986978

    SHA256

    9383553afba92eb8b4c54b1e7f09ce4b7560c1cc490f9761d8e7a9a89c59662f

    SHA512

    236d87dc9ed5dd046be13c83884da50c2f47a08479b6b1121e55948876a2662f746d722b69686b9e3ca1803b8cb1f847a8119e08f558d1c9cc52759fb652ee3b

  • /data/data/com.hlys.yjbm.nearme.huawei/databases/addaicfg_ke-journal

    Filesize

    512B

    MD5

    dda80da9e3f9f548290378eac61b9125

    SHA1

    9f43347c0db9f953a1efbfed30114a5bd1f1f569

    SHA256

    035ae9003e536532327b1cac5c1555a5ddd71527a30d44a0b5a25ac746342651

    SHA512

    179de6a59431aeeec68622c7a7910acca6f76eefb9dfa6c568ac28c8a189adac327171bf5e73925a1c9fc0ae38d6753664c3fa13e2bc22447b670ba5ed4a6f8b

  • /data/data/com.hlys.yjbm.nearme.huawei/databases/addaicfg_ke-wal

    Filesize

    52KB

    MD5

    d6815195295a898dfdb03851083a9dc0

    SHA1

    8067e19c02fee8df9b0804286ba0f9cc9ad15d24

    SHA256

    b354b5ea4df4c4ba7a387998b4b14985724318feec69274dd21e2b703be8542f

    SHA512

    811ec18499db3778be84912906b9f0112b2adc7f32bd3af015f9de79e85d8ae8fb8150a9aee42cc8659f3e59f858636969ea1df33a25998f744079b34ddd67ed

  • /data/data/com.hlys.yjbm.nearme.huawei/databases/bugly_db_

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.hlys.yjbm.nearme.huawei/databases/bugly_db_-journal

    Filesize

    512B

    MD5

    aabfd35c19dde8e9d70d69ea43d1af5b

    SHA1

    a29a2ee3bfc1107e9a80850142e53e8693414f54

    SHA256

    3e2f0779516fc3fa905631bc42af7ec14603be935cf6551f1f50ad412f3aa7d5

    SHA512

    6c32a985792fcd0b0382fee731419107eb757a957d6ca09716420312b472a7aa415293fc917f077f4dd8818206af627da8eb503432d7b5155b2af9dcdedad67d

  • /data/data/com.hlys.yjbm.nearme.huawei/databases/bugly_db_-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.hlys.yjbm.nearme.huawei/databases/bugly_db_-wal

    Filesize

    72KB

    MD5

    a7468dfd3b86f3174dc255bb177f3e55

    SHA1

    09c40ec60a46adc292f8e419e47feefe6388aefb

    SHA256

    793c0126657574e1befb140608eebbddb3c2eaf29e61fb154b35c43792c8d627

    SHA512

    8af58aa9a2295adb1a840f5230589a2625adb33006f0451278c01949a655417fbf2877ddea909a213b7a70241dcbf41b44c35629e48934c74977ca432a4cde91

  • /data/data/com.hlys.yjbm.nearme.huawei/databases/mta_cfg_db-journal

    Filesize

    512B

    MD5

    1e4851ae1797b4d26d0c2b9f310592e7

    SHA1

    799e5aa7a8e443ef9a0ec5f93d7fd0d0ca65b38b

    SHA256

    993ea3fa6cef60701be319b733929a0c0a658681e5f9035baade585eed8996ed

    SHA512

    71aed49117afa7008130aa4dde0691d014e7b5a0bbe77171875f990c0b02c8efef60bf7b35747360477e507eed9a5cebd1fcf9060c3815a7372b568c01bb0963

  • /data/data/com.hlys.yjbm.nearme.huawei/databases/mta_cfg_db-wal

    Filesize

    52KB

    MD5

    e1e9ce4ad7b2d357a186d0db0bba7311

    SHA1

    2f7f2c10f3ad95b78011bedcb79e86ff6cf7fbbf

    SHA256

    6db4b08c120ea252a4fe0ae0074c3bcfac6610bda252691db9705278b7e5af37

    SHA512

    f90d19922429a9c6e07e388b9127d68626061cbfb49673a77d9a2d0d14e442df3482ac75c11ccd68b92e0d147688e8c042b888cc86e25a349bf21c9ed722dbe3

  • /data/data/com.hlys.yjbm.nearme.huawei/files/Archimedes_p4

    Filesize

    13B

    MD5

    70bd33a89d59606ee7f060aed39508fd

    SHA1

    0f0aa21bb01dd539c30520122c7a567e24bc70c3

    SHA256

    56764616c966ba77e9f2556a6d89823fe66273fd87ecb607f1ec8ec16b70d45d

    SHA512

    3ae5673d2b39d7885477b7358b73dcca53200b2ebeb04edc942decc32ca0d80632981aa72856193ffaab04f2d10401da3b086824211b1601297915631edcc52e

  • /data/data/com.hlys.yjbm.nearme.huawei/files/Archimedes_p5

    Filesize

    12B

    MD5

    111359bec2547726ac754a7b483227f1

    SHA1

    06ea5501a4fd47b56e1ce478984254618ee6f6f9

    SHA256

    616c3cd44769cdd88b968f522766821062fe492ca29d9e57590b73892ea750a5

    SHA512

    bd1e2035a13c61a90e4b5c89b3f0cbbdc3693bcb7f710e6d7f7e66ce99723adff60d2bc5d05d3d74d8f4d597cce72b46b92a9dbb9ff722248603dd2bc12c79c7

  • /data/data/com.hlys.yjbm.nearme.huawei/files/TDCloud_Control_Cache_Param3

    Filesize

    2B

    MD5

    99914b932bd37a50b983c5e7c90ae93b

    SHA1

    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

    SHA256

    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

    SHA512

    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

  • /data/data/com.hlys.yjbm.nearme.huawei/files/_Ladder_Project/Archimedes_p1

    Filesize

    13B

    MD5

    b0ff25dd75edb1c24e5c9fa268c833b0

    SHA1

    e5f019b8d186b05612c8990a5250782db6414291

    SHA256

    0beddcce70104c4b6e31627044ce10c4acfd1712f2b76d09d0e83a394d1d4a91

    SHA512

    81c7244d8797361e9af1db90714432f2fc9dbe85e66aed208a929b40d83722687b718ab0f842de2623904a057a045e7a4661686a82722fc0113af18162beaf92

  • /data/data/com.hlys.yjbm.nearme.huawei/files/_Ladder_Project/Archimedes_p2

    Filesize

    13B

    MD5

    5e88aacdd777d4ee7279f581ac11c5b9

    SHA1

    d12694651c949a81adaf06018a6cd754bfd41c5e

    SHA256

    7560d38337acdd684474acd964fd8579e8bc1d4e353f10dda769be7886be1c82

    SHA512

    0bdb1189f524ca52327d3c2ee5bc20eb0f5edc0349f86b9fa5b0d75424d613a1d0827e06b8c51cf2c6af416a002fd98996ab1d8358108d301d9cf3e450bbcaf0

  • /data/data/com.hlys.yjbm.nearme.huawei/files/_Ladder_Project/Archimedes_p3

    Filesize

    13B

    MD5

    f6607fcebfd8f425ecd93e2fb8c787c6

    SHA1

    d145ebeb0ca99fdb93ae78c323f626afe634637d

    SHA256

    442ee769eff7190ddb6d5ac045cb7b1c33d85cc1f794eab60443c0b50650738e

    SHA512

    a6a3caf42707d28ed3368477f639261b957b6c0723ecc8a9c16c266d5b10c94283989ccf1041fce0cc7de3a99b4df688e9e5bde0eefe3598f59dd894fbace037

  • /data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database2SaaS/1721108575255_4252

    Filesize

    3KB

    MD5

    f27d92783a94536c6e4a77e17f70835d

    SHA1

    2b88eec2ac51259c919223feb5d6131aa013f96f

    SHA256

    a3e9377b23e6d45953ce499c76f4825009268f23a4f7c40f28ab1f65fcc44685

    SHA512

    15ab7add61e2047d898d4ecba640b3431cae07ccab1272af8ea8c67c24dee779540f9d9e56d62136efafd70cc6c6e8697ad8853ad393de63629f667a60c2108a

  • /data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database2SaaS/1721108575530_4252

    Filesize

    3KB

    MD5

    2653c9d4344b7879d594f67a49ef72ff

    SHA1

    7a4bb652f4ead0d24ea8528d0a27ee946d6ae40e

    SHA256

    857a4047c154597845b3e55b0946d6d75ad35abe5c7ae8727462ecd825496996

    SHA512

    99b9b31591582822e315651f9bd12a19c005e42d99fd1c2fbbacf2f317e2844b1660650a02e8f2c5ac3d596af2ae1e6c4565a18790db58f1e7537979a34be867

  • /data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database2SaaS/1721108575877_4252

    Filesize

    2KB

    MD5

    7ffa9e934bbe104538a0eab9463e18ca

    SHA1

    50a16060049e5b2d13bc74f23c45795da11d2fe5

    SHA256

    189e332dc6d01d17d29de00dd2a65740c46fd8ffdf6e95102018cc8b02b77951

    SHA512

    40cb27668954c6acc78fdd231ce6cc82895e845beb69bb2005dac6d13974991a8ef8789d031a144fb17f7def33541192265815ad4df47a2d2e0e46f14ca1ea4d

  • /data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database2SaaS/1721108577970_4252

    Filesize

    2KB

    MD5

    ed5698dfc7d9dd3aabb72897d4453a47

    SHA1

    3ada60fd04a5a0dbbcf65a91d5be2952c8e0231e

    SHA256

    4096de9fa166848f06d96347ec4673e6ab7dd3025a984583cc7c3c40366397ac

    SHA512

    d72cbfe5f2a6cd37ef2ca231547eddcb67c04e523ff397f3783058e1e1ab42758f8c8d54959059fd51195cc202315264126294aacf15443a39ef50820fd6d1cc

  • /data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database2SaaS/1721108578324_4252

    Filesize

    2KB

    MD5

    916a32de50fbffda6e9ffa65477ded8b

    SHA1

    46af9d8d5ca839492f76ed5124d8abe5970b7557

    SHA256

    7dd2b932ed2ce265ccef25952801fdb9d7b6d75bcac62099ef69d093a0f65471

    SHA512

    b2104dd7625c221aa12983a4a6fe4d62564709d11da7e9edbf73fc054d87a02a78b7aa7bca7d7d96964f29cddf85f0eadec52d6e656d0bf67d707309762638b6

  • /data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database3SaaS/1721108575682_4252

    Filesize

    2KB

    MD5

    d57b15e0d132592ae88f55e0d32eb8f7

    SHA1

    06fc4aa9dd8d39b8df514b02869ee6d8967a2a45

    SHA256

    c483917eba3053c66905dbc9788d50cc476366da94a68f988ecb253fd55f261c

    SHA512

    76e585adbe7c3c475b6d25768576ef8d3d2d3acd05074981cd5fc32c32ac9698d47b70d54aea996f56202b3a7678931f4945b3f5eef4730f979e0e222afd9064

  • /data/data/com.hlys.yjbm.nearme.huawei/files/ddai300_pngcache/b.gif

    Filesize

    338KB

    MD5

    9f1dd6cb9ceec3ac6b78e301580bec24

    SHA1

    f3c97f946a643ab0621a051d4b649c3c71b10a61

    SHA256

    28d59b5d6021fae6ce3f75b9396048fd88d621843423bf436370ac1cfd8d63c4

    SHA512

    9ae2fd4db086ed89f1f49d9929c9eff566d5c2ad844ff83c95c6db3bb94d7295e0402ad922caae394329e9b26c1e3516539a2c9e8e4d96c1364ba30e7d7b5030

  • /data/data/com.hlys.yjbm.nearme.huawei/files/ddai300_s_p287.dat

    Filesize

    322KB

    MD5

    e4ea62407982581f7e8fb18a3542a1cd

    SHA1

    0a9756d084da93aaddc3f6d8cab81d5815f40b90

    SHA256

    7e5fc5b1da3b04286f38109f80866cd47cdce432bd2c4efcd981e610dcd87e92

    SHA512

    ab9477e36a596f82dc3c3d1d47b9ea14a5b36b97befb1a36919597b06623654490b5e22aeb1c1b5c0459cff62852de772f8ee688df0da6e2bdd95d756c414301

  • /data/data/com.hlys.yjbm.nearme.huawei/files/mPBE/iv

    Filesize

    63B

    MD5

    8fd1b69898b413fc1c3826eff94ce93e

    SHA1

    7905023cdc500cad7a75a1245045c9d1ee3e6fb9

    SHA256

    3aad5c9034bc3b830e3ddb64a691528d7a0d24be1484543a7313e8dd77670ac3

    SHA512

    99e6ab9f5d950b45778413687b1be1bc360825f686e5b2c78ba61fadaf0e5b7aa85c4471154cad2d3746f6bc32d7424277dd13dfb500a50b9c2bf1c163e963f3

  • /data/data/com.hlys.yjbm.nearme.huawei/files/mPBE/salt

    Filesize

    120B

    MD5

    5a70d20db489c3861478caccdac7ec19

    SHA1

    5af8138c9eb141a0fe77d599851e3e19102e934e

    SHA256

    b98e2c217061653e7c94a8ce3a05f621ad85ff83234b4d4d08b04bfa37e4de8c

    SHA512

    d6ac6c452b8f3bbb9920216b2ff44ba99760286a14eaded4f49f5cec81d48133aca26312fd8674f38cf4eb5b960cb07b1e83a7fe5f8796164153acaea9d2bed1

  • /data/user/0/com.hlys.yjbm.nearme.huawei/app_dex/ddai300_ds.jar

    Filesize

    871KB

    MD5

    d04dfacaab5a0800b9bbe43ef2403417

    SHA1

    3567cd3486042785a7c0093e3686cc0db71585c2

    SHA256

    1c2b50a19854466a64105c6bb2558bd9c4f1635b03352cf75ca8d385ddbf0b5a

    SHA512

    ee07b01a65f432f8d46b6587b994caf076d15d419d9b2184353b0becdb59c4e2a2119de1dc097c6a0c083253b3f57582c5ea7cbffc817a666fa4875149fe5a8f