Analysis
-
max time kernel
160s -
max time network
166s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
16/07/2024, 05:42
Static task
static1
Behavioral task
behavioral1
Sample
4d074696c1302ceb44c106581300bb63_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
4d074696c1302ceb44c106581300bb63_JaffaCakes118.apk
Resource
android-33-x64-arm64-20240624-en
General
-
Target
4d074696c1302ceb44c106581300bb63_JaffaCakes118.apk
-
Size
29.7MB
-
MD5
4d074696c1302ceb44c106581300bb63
-
SHA1
e79e7557103f2b11f19e20aef40b2cc971ec73e8
-
SHA256
792afa64573533b95c3cfbfa46ad27fd27b4385db0043b64218ae607852bbac9
-
SHA512
2bba95ab11cfdf87068885333cc233099aa948dfb6e3fec9285adee24191096589e65c9604053fed6250996a825dbf2abbedbe56bbe364f30bdddbf0839e050a
-
SSDEEP
786432:L0C5cboBEehOT10Z6JOwDu2sn00/NssPoMnSeeNX/:wCgouT7AwDu1/WsPpnSjl/
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.hlys.yjbm.nearme.huawei/app_dex/ddai300_ds.jar 4252 com.hlys.yjbm.nearme.huawei -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.hlys.yjbm.nearme.huawei -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
description ioc Process Framework service call android.net.wifi.IWifiManager.getScanResults com.hlys.yjbm.nearme.huawei -
Requests cell location 1 TTPs 2 IoCs
Uses Android APIs to to get current cell information.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.hlys.yjbm.nearme.huawei Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.hlys.yjbm.nearme.huawei -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.hlys.yjbm.nearme.huawei -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.hlys.yjbm.nearme.huawei -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.hlys.yjbm.nearme.huawei -
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.hlys.yjbm.nearme.huawei -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.hlys.yjbm.nearme.huawei -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.hlys.yjbm.nearme.huawei -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.hlys.yjbm.nearme.huawei -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.hlys.yjbm.nearme.huawei
Processes
-
com.hlys.yjbm.nearme.huawei1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4252
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
234B
MD5c8f3be2cf40dacaec1c4ca22b3a47ad9
SHA1310a50bf50fb7ed9857502406dd4ec4136a72216
SHA25683895421d70e7be29f6bff5bdaad88e8eb1219de01df330c8d17645b3f1361f1
SHA512084c1a292afd4293b9b01d5816fc5482f96eb8faad891b7709e960a4811eb9e3e021fcd6334061ac1f8150d91f3678e292f255dc98059a82d56938ad33172608
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
303KB
MD500dd6aa26ff8c3ba61a35eb8e2f89e3d
SHA131ced9346b7e9119f00dd7ff53b898311633cba8
SHA25668aa9cca86b71130fb9b828ed1b2c02f3df66a21629f6407cb39be0091bbfd8b
SHA5127c3f77f18bd9f081e1c751c7077e40b79a7a8fef54d21597a9135e4ee9f788ba87bebd472576ea97a92098b270d5f6b862360f16ffd03b0f41d5ca2a4e61f1b0
-
Filesize
315B
MD548bb02379dd13be61e495bdcdb24df51
SHA15012ec2a41bea3570e1a60af5d9d2ddbf9c66379
SHA25695b531061989f468c64e3cc1e70c656dcacadd4829658897889601c3264951f4
SHA512ebc4c0e475ac5867a2210ccf2e6fd54b6ca57f21b54c3b7d8a0faf00991c6ee67be15204d0932c83aff6a43880893c67e2967c58694e67529637480d73949562
-
Filesize
512B
MD53c5c069bbc155d3ff4fabaf493d68263
SHA124e9f06f23309ba1962d4d7bebe708c47a199e91
SHA256e81129c3094c6ddef4fadd24cac3b65bfd2251934f2942585513d909fd2f0269
SHA512eec7126708ffe59e3846128a802329f676c65b2ddb241187f6399ad2318d0b06115ab3686a080032c179a360e187fc2433346b26a05ad317feec7e4c559c4dba
-
Filesize
177KB
MD528d1b7bfe86295e0d496655ce0347b65
SHA14cd58c83edd59ba0067844a38bb3ab2fbb986978
SHA2569383553afba92eb8b4c54b1e7f09ce4b7560c1cc490f9761d8e7a9a89c59662f
SHA512236d87dc9ed5dd046be13c83884da50c2f47a08479b6b1121e55948876a2662f746d722b69686b9e3ca1803b8cb1f847a8119e08f558d1c9cc52759fb652ee3b
-
Filesize
512B
MD5dda80da9e3f9f548290378eac61b9125
SHA19f43347c0db9f953a1efbfed30114a5bd1f1f569
SHA256035ae9003e536532327b1cac5c1555a5ddd71527a30d44a0b5a25ac746342651
SHA512179de6a59431aeeec68622c7a7910acca6f76eefb9dfa6c568ac28c8a189adac327171bf5e73925a1c9fc0ae38d6753664c3fa13e2bc22447b670ba5ed4a6f8b
-
Filesize
52KB
MD5d6815195295a898dfdb03851083a9dc0
SHA18067e19c02fee8df9b0804286ba0f9cc9ad15d24
SHA256b354b5ea4df4c4ba7a387998b4b14985724318feec69274dd21e2b703be8542f
SHA512811ec18499db3778be84912906b9f0112b2adc7f32bd3af015f9de79e85d8ae8fb8150a9aee42cc8659f3e59f858636969ea1df33a25998f744079b34ddd67ed
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5aabfd35c19dde8e9d70d69ea43d1af5b
SHA1a29a2ee3bfc1107e9a80850142e53e8693414f54
SHA2563e2f0779516fc3fa905631bc42af7ec14603be935cf6551f1f50ad412f3aa7d5
SHA5126c32a985792fcd0b0382fee731419107eb757a957d6ca09716420312b472a7aa415293fc917f077f4dd8818206af627da8eb503432d7b5155b2af9dcdedad67d
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
72KB
MD5a7468dfd3b86f3174dc255bb177f3e55
SHA109c40ec60a46adc292f8e419e47feefe6388aefb
SHA256793c0126657574e1befb140608eebbddb3c2eaf29e61fb154b35c43792c8d627
SHA5128af58aa9a2295adb1a840f5230589a2625adb33006f0451278c01949a655417fbf2877ddea909a213b7a70241dcbf41b44c35629e48934c74977ca432a4cde91
-
Filesize
512B
MD51e4851ae1797b4d26d0c2b9f310592e7
SHA1799e5aa7a8e443ef9a0ec5f93d7fd0d0ca65b38b
SHA256993ea3fa6cef60701be319b733929a0c0a658681e5f9035baade585eed8996ed
SHA51271aed49117afa7008130aa4dde0691d014e7b5a0bbe77171875f990c0b02c8efef60bf7b35747360477e507eed9a5cebd1fcf9060c3815a7372b568c01bb0963
-
Filesize
52KB
MD5e1e9ce4ad7b2d357a186d0db0bba7311
SHA12f7f2c10f3ad95b78011bedcb79e86ff6cf7fbbf
SHA2566db4b08c120ea252a4fe0ae0074c3bcfac6610bda252691db9705278b7e5af37
SHA512f90d19922429a9c6e07e388b9127d68626061cbfb49673a77d9a2d0d14e442df3482ac75c11ccd68b92e0d147688e8c042b888cc86e25a349bf21c9ed722dbe3
-
Filesize
13B
MD570bd33a89d59606ee7f060aed39508fd
SHA10f0aa21bb01dd539c30520122c7a567e24bc70c3
SHA25656764616c966ba77e9f2556a6d89823fe66273fd87ecb607f1ec8ec16b70d45d
SHA5123ae5673d2b39d7885477b7358b73dcca53200b2ebeb04edc942decc32ca0d80632981aa72856193ffaab04f2d10401da3b086824211b1601297915631edcc52e
-
Filesize
12B
MD5111359bec2547726ac754a7b483227f1
SHA106ea5501a4fd47b56e1ce478984254618ee6f6f9
SHA256616c3cd44769cdd88b968f522766821062fe492ca29d9e57590b73892ea750a5
SHA512bd1e2035a13c61a90e4b5c89b3f0cbbdc3693bcb7f710e6d7f7e66ce99723adff60d2bc5d05d3d74d8f4d597cce72b46b92a9dbb9ff722248603dd2bc12c79c7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
13B
MD5b0ff25dd75edb1c24e5c9fa268c833b0
SHA1e5f019b8d186b05612c8990a5250782db6414291
SHA2560beddcce70104c4b6e31627044ce10c4acfd1712f2b76d09d0e83a394d1d4a91
SHA51281c7244d8797361e9af1db90714432f2fc9dbe85e66aed208a929b40d83722687b718ab0f842de2623904a057a045e7a4661686a82722fc0113af18162beaf92
-
Filesize
13B
MD55e88aacdd777d4ee7279f581ac11c5b9
SHA1d12694651c949a81adaf06018a6cd754bfd41c5e
SHA2567560d38337acdd684474acd964fd8579e8bc1d4e353f10dda769be7886be1c82
SHA5120bdb1189f524ca52327d3c2ee5bc20eb0f5edc0349f86b9fa5b0d75424d613a1d0827e06b8c51cf2c6af416a002fd98996ab1d8358108d301d9cf3e450bbcaf0
-
Filesize
13B
MD5f6607fcebfd8f425ecd93e2fb8c787c6
SHA1d145ebeb0ca99fdb93ae78c323f626afe634637d
SHA256442ee769eff7190ddb6d5ac045cb7b1c33d85cc1f794eab60443c0b50650738e
SHA512a6a3caf42707d28ed3368477f639261b957b6c0723ecc8a9c16c266d5b10c94283989ccf1041fce0cc7de3a99b4df688e9e5bde0eefe3598f59dd894fbace037
-
/data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database2SaaS/1721108575255_4252
Filesize3KB
MD5f27d92783a94536c6e4a77e17f70835d
SHA12b88eec2ac51259c919223feb5d6131aa013f96f
SHA256a3e9377b23e6d45953ce499c76f4825009268f23a4f7c40f28ab1f65fcc44685
SHA51215ab7add61e2047d898d4ecba640b3431cae07ccab1272af8ea8c67c24dee779540f9d9e56d62136efafd70cc6c6e8697ad8853ad393de63629f667a60c2108a
-
/data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database2SaaS/1721108575530_4252
Filesize3KB
MD52653c9d4344b7879d594f67a49ef72ff
SHA17a4bb652f4ead0d24ea8528d0a27ee946d6ae40e
SHA256857a4047c154597845b3e55b0946d6d75ad35abe5c7ae8727462ecd825496996
SHA51299b9b31591582822e315651f9bd12a19c005e42d99fd1c2fbbacf2f317e2844b1660650a02e8f2c5ac3d596af2ae1e6c4565a18790db58f1e7537979a34be867
-
/data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database2SaaS/1721108575877_4252
Filesize2KB
MD57ffa9e934bbe104538a0eab9463e18ca
SHA150a16060049e5b2d13bc74f23c45795da11d2fe5
SHA256189e332dc6d01d17d29de00dd2a65740c46fd8ffdf6e95102018cc8b02b77951
SHA51240cb27668954c6acc78fdd231ce6cc82895e845beb69bb2005dac6d13974991a8ef8789d031a144fb17f7def33541192265815ad4df47a2d2e0e46f14ca1ea4d
-
/data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database2SaaS/1721108577970_4252
Filesize2KB
MD5ed5698dfc7d9dd3aabb72897d4453a47
SHA13ada60fd04a5a0dbbcf65a91d5be2952c8e0231e
SHA2564096de9fa166848f06d96347ec4673e6ab7dd3025a984583cc7c3c40366397ac
SHA512d72cbfe5f2a6cd37ef2ca231547eddcb67c04e523ff397f3783058e1e1ab42758f8c8d54959059fd51195cc202315264126294aacf15443a39ef50820fd6d1cc
-
/data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database2SaaS/1721108578324_4252
Filesize2KB
MD5916a32de50fbffda6e9ffa65477ded8b
SHA146af9d8d5ca839492f76ed5124d8abe5970b7557
SHA2567dd2b932ed2ce265ccef25952801fdb9d7b6d75bcac62099ef69d093a0f65471
SHA512b2104dd7625c221aa12983a4a6fe4d62564709d11da7e9edbf73fc054d87a02a78b7aa7bca7d7d96964f29cddf85f0eadec52d6e656d0bf67d707309762638b6
-
/data/data/com.hlys.yjbm.nearme.huawei/files/__database_reborn_January_one__/td_database3SaaS/1721108575682_4252
Filesize2KB
MD5d57b15e0d132592ae88f55e0d32eb8f7
SHA106fc4aa9dd8d39b8df514b02869ee6d8967a2a45
SHA256c483917eba3053c66905dbc9788d50cc476366da94a68f988ecb253fd55f261c
SHA51276e585adbe7c3c475b6d25768576ef8d3d2d3acd05074981cd5fc32c32ac9698d47b70d54aea996f56202b3a7678931f4945b3f5eef4730f979e0e222afd9064
-
Filesize
338KB
MD59f1dd6cb9ceec3ac6b78e301580bec24
SHA1f3c97f946a643ab0621a051d4b649c3c71b10a61
SHA25628d59b5d6021fae6ce3f75b9396048fd88d621843423bf436370ac1cfd8d63c4
SHA5129ae2fd4db086ed89f1f49d9929c9eff566d5c2ad844ff83c95c6db3bb94d7295e0402ad922caae394329e9b26c1e3516539a2c9e8e4d96c1364ba30e7d7b5030
-
Filesize
322KB
MD5e4ea62407982581f7e8fb18a3542a1cd
SHA10a9756d084da93aaddc3f6d8cab81d5815f40b90
SHA2567e5fc5b1da3b04286f38109f80866cd47cdce432bd2c4efcd981e610dcd87e92
SHA512ab9477e36a596f82dc3c3d1d47b9ea14a5b36b97befb1a36919597b06623654490b5e22aeb1c1b5c0459cff62852de772f8ee688df0da6e2bdd95d756c414301
-
Filesize
63B
MD58fd1b69898b413fc1c3826eff94ce93e
SHA17905023cdc500cad7a75a1245045c9d1ee3e6fb9
SHA2563aad5c9034bc3b830e3ddb64a691528d7a0d24be1484543a7313e8dd77670ac3
SHA51299e6ab9f5d950b45778413687b1be1bc360825f686e5b2c78ba61fadaf0e5b7aa85c4471154cad2d3746f6bc32d7424277dd13dfb500a50b9c2bf1c163e963f3
-
Filesize
120B
MD55a70d20db489c3861478caccdac7ec19
SHA15af8138c9eb141a0fe77d599851e3e19102e934e
SHA256b98e2c217061653e7c94a8ce3a05f621ad85ff83234b4d4d08b04bfa37e4de8c
SHA512d6ac6c452b8f3bbb9920216b2ff44ba99760286a14eaded4f49f5cec81d48133aca26312fd8674f38cf4eb5b960cb07b1e83a7fe5f8796164153acaea9d2bed1
-
Filesize
871KB
MD5d04dfacaab5a0800b9bbe43ef2403417
SHA13567cd3486042785a7c0093e3686cc0db71585c2
SHA2561c2b50a19854466a64105c6bb2558bd9c4f1635b03352cf75ca8d385ddbf0b5a
SHA512ee07b01a65f432f8d46b6587b994caf076d15d419d9b2184353b0becdb59c4e2a2119de1dc097c6a0c083253b3f57582c5ea7cbffc817a666fa4875149fe5a8f