46909eb1f9bc29d5524ed6985dae7b4cc7c06fffebb20ab99522848dabbccea7

Analysis

max time kernel
6s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
23-08-2024 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9a5feb1f01d2e6f2bc4450e370a13cb_JaffaCakes118.apk
Size

8.3MB
MD5

b9a5feb1f01d2e6f2bc4450e370a13cb
SHA1

ac3395c682df22870ac8d105d180dc41feea38fb
SHA256

46909eb1f9bc29d5524ed6985dae7b4cc7c06fffebb20ab99522848dabbccea7
SHA512

6f828a6d680f0afc2d321061f5e7d84c736f09a022d0f36c5408df80131cd527aad082eb857dd3dd6c34e2caa89796c41cdd98ebe4150429800f973fb4ed9e8e
SSDEEP

196608:K8ZtE+c6vpg/c15hr4NsQUsKsisyscseNGpJXTBB4I/f72aWcmaCWqfvw/Ca:KSte6v1agG3z4IL2aFHCb4L

Score

6^/10

discovery evasion

Malware Config

Signatures

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.vfou.locker
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.vfou.locker:pushservice

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 2 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.vfou.locker
Framework API call	android.hardware.SensorManager.registerListener	com.vfou.locker:pushservice

Checks CPU information 2 TTPs 2 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.vfou.locker
File opened for read	/proc/cpuinfo	com.vfou.locker:pushservice

Checks memory information 2 TTPs 2 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.vfou.locker
File opened for read	/proc/meminfo	com.vfou.locker:pushservice

com.vfou.locker
1⤵
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
PID:4328

com.vfou.locker:pushservice
1⤵
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
PID:4421

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.vfou.locker/databases/bugly_db_

Filesize
12KB

MD5
edb655088d1ed9f33f9d0d499b7a3ef5

SHA1
565c4f4e43179dbfc285cd6331dc8ac75a901af8

SHA256
bb9e45aad35b43e895393e7a66e4ead6a5f728f90b7627e3c741d391bf65d4f9

SHA512
98cbf923880de82921c38973fbc6d711dc39884428d1eb4ead33658a5a7f163734e5121823d5b043ca44554d19c5b6f966674ac7291513944a94cec97d5be599

Download Submit
/data/user/0/com.vfou.locker/databases/bugly_db_-journal

Filesize
512B

MD5
b51a84ffc84aeddcf9e097daa0b38c3a

SHA1
a3a3aa14f7739772075304b0e3aea745d34f6266

SHA256
5e8aca7d5ebdce6d81f84f49569a3639f8c84995407765e13c1074c2fb14322a

SHA512
8a6f2e5bb474708dd71f22baaab0cc7004fc7b03f4417f36c81ec557a4a2455ba21c57c1e5b22312feb245c8f09bc7ad7852b494dd4ac6d00fd72211c740b6d5

Download Submit
/data/user/0/com.vfou.locker/databases/bugly_db_-journal

Filesize
8KB

MD5
c85a5da9f46481276d72134cc20eae9d

SHA1
51acc91c4fff84fb3d72238e813e21d347e6b532

SHA256
b64d861bec941ac6a1aef4d83d0f5c059fb0f0494d7db8ebec9facd4aa2b6f9d

SHA512
b869e78ff00f0bde075d1f353d4b15833ea4e64221fbdde7a527c529c13e2b047a26472d28bc19fd9ab13ee5ac382dc2e8dc638179eaba44c09f0a7dc507715c

Download Submit
/data/user/0/com.vfou.locker/databases/bugly_db_-journal

Filesize
8KB

MD5
20f76fd1492298ba6e333599611523a8

SHA1
bd926c627e26d15b60c49b713fda354333976b8d

SHA256
5f6ecd57bf0d605cd591c29c0453945a3503546d32afcc39431e31d3bc3a7b77

SHA512
e8a18f8f343ebfd9100e3c5eeb25b6ce56d42f0623dbf9dba1b72f1f96ba689a14d5d5da0d0b8fb04f59847068e609a6f986622c4734dcf6eb8ddc87e95461d5

Download Submit
/data/user/0/com.vfou.locker/databases/kuzhuan_user_ad_state.db

Filesize
20KB

MD5
a6f5ee951df154633051eef7523c4211

SHA1
316adfcbd72ad3bcaa21e76086633b1262f2e2d1

SHA256
2eedeacea8a0bd5ebd8498367291328cedf9dd456f57cae9a31ef94da9b0c0a4

SHA512
729032560a398239b602e91f914b37c39046df14688dc7a418eeca65789e5009fd4482f5a38bc9d2a231d7e9ebb07a818dc675e7ae61bfdf3167435f50c274da

Download Submit
/data/user/0/com.vfou.locker/databases/kuzhuan_user_ad_state.db-journal

Filesize
20KB

MD5
eb0a883469798345c8085afbc6371272

SHA1
26a7ce4fd4090346cc9af05606cfe292a83e3643

SHA256
0a97ec73dbb7341f768cc49d36c061045b2f12ad627ee4997fd1fe6ffbddf092

SHA512
c6c6c1bf2b5474127410b3cede4a04d1d0ba2252f20c36a77daa3564eb6ffa812d7da66ab1bb13c8b16a0e3da8709c9711c5af8926e59b46017fce6856a14167

Download Submit
/data/user/0/com.vfou.locker/databases/kuzhuan_user_ad_state.db-journal

Filesize
8KB

MD5
190140375cc006ca1e6dcb656084a681

SHA1
5c0a6503769ca3bb787b515d07aced31af335826

SHA256
130b88ececcd8cec14c7c4ea8cee4dd1bc0b153cfabc4eeb492bea20a605adc9

SHA512
098a9dbdd554f643e90709bc48a8ff91234c4af6e148fbbf21e6739a87e38195b4cbeafe175a99e44915ffd598482a9f43b6d05a6c565228a66cc5bb926cd080

Download Submit
/data/user/0/com.vfou.locker/databases/kuzhuan_user_ad_state.db-journal

Filesize
8KB

MD5
601ea530a717c14fa8e73de21a58259a

SHA1
19b1ee3ae78f38c49b384341c21b6d4d5303d5db

SHA256
679a20e182308945fd86fcf74e982ba14ba76cba7d2407d668c37f3783c33d8a

SHA512
84ab0aea0fc634dae0cc57c9e0c387ee7772f9d89f5ef0c8af1d8ef0e12e5ff3069715ecce52f999e0c36a7070b24ffa0e271e2803960a76ff22f45ff7a7a178

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads