976cc5ec0ff2fa47b69cd0c05c89646220177849f2ad9db459f99f63bbb0cb29

Analysis

max time kernel
3s
max time network
147s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
13/08/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

939a478aadca94bf92bd4fd9170308f0_JaffaCakes118.apk
Size

13.8MB
MD5

939a478aadca94bf92bd4fd9170308f0
SHA1

8af41a80aad05f85f1121506ee6f217272bcc4f5
SHA256

976cc5ec0ff2fa47b69cd0c05c89646220177849f2ad9db459f99f63bbb0cb29
SHA512

6b7e77bcde8c4c919def53c8aac7b53dbf2fabda63c506dfe36e86df2936a1743b8401e2cd720e493dcfb34cb61915ab7d1922479c60b90b80c48998aa825802
SSDEEP

393216:xKI+wAoQPd3POasnXnTNaEwQm+s52qOBvIE5EibICZ1YPkM:xxKhP9PVEXnAdaVvHJdG

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.lc.fujin

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lc.fujin

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.lc.fujin

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lc.fujin

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.lc.fujin

com.lc.fujin
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5004

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lc.fujin/databases/bugly_db_

Filesize
40KB

MD5
9b7cb0855add584cb30a199fc18b2ff5

SHA1
f325b62e984a92a9bab8d85b150044c39371ce61

SHA256
9af99535de586933d4615a3429ca6974242765d4215b727ab2a890f710396e50

SHA512
343083da76574bbf7c827bc2392c42f00ac34f2d918b95961d1d7d497e8d0bc1e1be1a0b1cc42fa3125c98997030e7cbcd8b8c7530f23381ce0b635ec184c779

Download Submit
/data/data/com.lc.fujin/databases/bugly_db_-journal

Filesize
8KB

MD5
ce3c6ffc269fb02c16c68a3e12fd4676

SHA1
880d46def429fd4b5637b5ebdf5e57e261c925ee

SHA256
7750f0cb421594ffa6a1ede8fc15f214fe9755f448591e69dc341ee282cb64c2

SHA512
f71ce0a0b8c957205f0f89586c6d39a69bb4e6baaeccf02816dfe0bb91b501819a74299bd2af5413eeae91aa168c8c36d65640eb79ce9d5ed2a2b37d95061052

Download Submit
/data/data/com.lc.fujin/databases/bugly_db_-journal

Filesize
512B

MD5
de077711724b3d3cbc6a09c3c3b78e17

SHA1
c65f7bb8ff31cc34e1d66d37f185404e8f842687

SHA256
47b8ecd64243b806566fbff138e8e136a63e1b2d0d0f5e31a5768e4b67da76f4

SHA512
866e08dde85e67dd9caaaae1a3d038ba423f4c77e52a848ca44eaeddf52e69084453c8110596545c18a6645976a020620d73dd7c8069ad8fdadae79fbacda872

Download Submit
/data/data/com.lc.fujin/databases/bugly_db_-journal

Filesize
8KB

MD5
8301162702254baac1bfeee8fd6a74f2

SHA1
461204735e73a3c4bd575330da20594892de7064

SHA256
02bc144808b22c93992532d4b020fac29051b0721b0d3e4bda781dc3a837df88

SHA512
7befab7902d378a16bc91ecb8668458680ebc5bdcadc59915f9375b6a84317d015fb0a8a11876870c1e4964ac1a359691493469b8e4ca374a77b4666af2d8e3a

Download Submit
/data/data/com.lc.fujin/databases/bugly_db_-journal

Filesize
8KB

MD5
4ac2b2aa6fb6c8d86f27e9171a872903

SHA1
b1a1af9cbb748c18d85cafbe47630b23298e7d83

SHA256
5eb3855f8e8dea764563951b4b81de6ccb7f50c290c71d8c7761b405e6b835aa

SHA512
73a0ac43687a055afe0b924d8e374ffc2706a284635abade8b78c709b58c0761ecdb88533dfa389a24c828aa2e22a117a161b51fec99bc246f65c48ffa0bba86

Download Submit
/data/data/com.lc.fujin/databases/dynamicamapfile.db

Filesize
20KB

MD5
d505db4bb9a0c36589db4d1853867791

SHA1
aad475b5974f46d8cb5eae497a1fa541ffee99c6

SHA256
6d82ef6a44919e1e77d94e4d6fcfb33b0f04d48a7846fafa58d343b20968af32

SHA512
2edfc04b01683a4df0ae3b5ceb7b34448f06551743689842f18ce88ff979577171ccbc179ca6f06f1e238dfdbe035e411239797ae23780ddb35a778fe6d03a87

Download Submit
/data/data/com.lc.fujin/databases/dynamicamapfile.db-journal

Filesize
8KB

MD5
ce12e223e90f93f282bccc7910cda245

SHA1
48cfdab83c14b7916bc4cc5ff1f0e3e961da1bcd

SHA256
592ade7dc684bda8049a5bc2fa91567218c01c1c8599d0c5c08fa3f43dd7285c

SHA512
cd5d5bd37058ba30eca1ca2d1ec842133a3e86687bbfc87f353df33b776f99f7686d12ccd5126b520e3dd487ea28ddfd9c7111995c7d3fd99af7ee71b980f248

Download Submit
/data/data/com.lc.fujin/databases/dynamicamapfile.db-journal

Filesize
512B

MD5
af7dd9f4b7a4f7e460b21f28af84a6b7

SHA1
6b03b6fe0ef84b44994cec675ff8775a095c5a6e

SHA256
7ab77f50297c36632da346b1ec963d24f5565ef32b38689db84fe5e5727a7389

SHA512
59067aabb7e474fec4b73d8bd26a6331938073293c1da03bb489a999c3e5900ffd89b5f6159dcacf0e5e59a8b637f07c00118881b2c3ad267c31daab35fd3659

Download Submit
/data/data/com.lc.fujin/databases/dynamicamapfile.db-journal

Filesize
8KB

MD5
880045a20d15935c16d01d0d0316f963

SHA1
cbaba3c74ffeed80cba0ead30d3829192e8ffef6

SHA256
8f15e6c031e34e318fb54d0f8ba7d4e482f7a0d8275a92f97fff824f1b72869f

SHA512
be723bdbf0aa71012e2fd43726dcdf7c21e145c0fb48fa35ace96fe38a423659b346e7f87c02296d764c3fe5459c6a730f923641e84a0ee0f60ccbb51e4af077

Download Submit
/data/data/com.lc.fujin/databases/trinea_android_common.db

Filesize
36KB

MD5
44158f8f979b5eb92cd1c8bcd767c5f2

SHA1
6135f1ead465d9d4d0310a93cd4e0f42fef4ab7c

SHA256
209312419bf18ec5eddd896b40034c5d61aa7cf049f2b4aaa842217d44de405c

SHA512
989415600cdfd665cccf215592fe61ba6209e20f63b86a3acd8577bacb466ca5981c0caaedd379116cd43c75a84bf4f94a9b5ff83d2926d4d9ad37d23d6278a2

Download Submit
/data/data/com.lc.fujin/databases/trinea_android_common.db-journal

Filesize
512B

MD5
1938fd7a390988d6078c3d4b01abc606

SHA1
26c7c88ce45cb2a17ba676be43a80bd6d54d5a5f

SHA256
982adf436f879a3c5401120d74afd01bfc9b1d2fd4e9c81d15539cae7f848711

SHA512
5e7b17d4a82b1ec8cb42d4cd86e831df08a4302aa5dc9219ec8de45675a0230024050996bd52ed28e8e04da961af159aa7124cedb9f71ee4ae979a65e755f137

Download Submit
/data/data/com.lc.fujin/databases/trinea_android_common.db-journal

Filesize
8KB

MD5
ae30ff44ed595da8f7a92d48e372a50c

SHA1
0d072f576f62cb104a7ed3930649dc3d272b2334

SHA256
7e370f2e29b2f6607a639f1698f3a8d7676ca7f895bec924432640824bc71038

SHA512
014c270385995e3ea3d03cb4c575e912b570d64ced4a73c7915620643943d8c6df3a94d5fee9619a14bf20e98c2a0c4a769376cfe0a6502eefa6e8bc3419154f

Download Submit
/data/data/com.lc.fujin/databases/trinea_android_common.db-journal

Filesize
8KB

MD5
38cb8f34891d7849f69b6b7c98cc6eab

SHA1
d9c18a98dd95ccd1c15332db6b3b1bfac712b7cb

SHA256
f8f239e7ed156db6a0261286fe1862ade9254097470029d1fdbf0247c3f7db7d

SHA512
056417f38e7903c67bc5013ae7e68dcaeea4797ee5c9989f8d4a59c7ce84153007015d0c7faa824dea046368039c501c130db6f78743bb578ba6dc900bbda3ba

Download Submit
/storage/emulated/0/mshw/journal.tmp

Filesize
36B

MD5
37e8e716e0e2f4a0b05cd9571d95b84d

SHA1
f8d068f6931707bddb8cd69f706f2224ad1fea3c

SHA256
7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca

SHA512
e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads