44dbf73c644d4b6ccc2d1a4a4970229a83c5e03b72cd552b4337c399241f3320

Analysis

max time kernel
48s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
26-08-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c297e98c0eef7e14645041027ca18631_JaffaCakes118.apk
Size

21.8MB
MD5

c297e98c0eef7e14645041027ca18631
SHA1

2f3a00668a3c854c228c23f16a1ba4739eb5d423
SHA256

44dbf73c644d4b6ccc2d1a4a4970229a83c5e03b72cd552b4337c399241f3320
SHA512

10eb560e9f7b1e31b32bd4de18aeaf8e01a43317f594b74f08c088a6e16486116ec2d456173cb5bb82b003b46657d842b1be6be499699d5092f197ad81536311
SSDEEP

393216:xM83la2kDyuOUjJNNjVLX6LTXmPOhA9cuTfU0xLp4PeZvMDaY+YLOXo+UT:/3la2kDcWNjL6LKWC9cNuLlEB+YaUT

Score

7^/10

collection discovery persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cootek.walkietalkie
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cootek.walkietalkie:present
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cootek.walkietalkie:andesremote

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.cootek.walkietalkie

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cootek.walkietalkie

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cootek.walkietalkie
Framework service call	android.app.IActivityManager.registerReceiver	com.cootek.walkietalkie:present
Framework service call	android.app.IActivityManager.registerReceiver	com.cootek.walkietalkie:andesremote

com.cootek.walkietalkie
1⤵
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4248
- logcat -f /storage/emulated/0/andes/log/andeslog.txt -v threadtime
  2⤵
  PID:4423

com.cootek.walkietalkie:present
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4286

com.cootek.walkietalkie:andesremote
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4311

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cootek.walkietalkie/databases/google_app_measurement.db

Filesize
4KB

MD5
43f17f0b79a2308673d7f2a5556c766f

SHA1
3da9c1630bac8ba7eb11a12e016a2d6d75676828

SHA256
6b419f1336b2a0984424aca189119472dd030996b996c7f9ebc49f41c21bc2e1

SHA512
8fc16d6ef619d61cb1881af83931d6eaca8b058d19a12da49e3fff88d8e94e2a1e4cf218fbb7cbb3ca5a01b82af0b24b808c37c06d8a26662187a361a19c77c0

Download Submit
/data/data/com.cootek.walkietalkie/databases/google_app_measurement.db-journal

Filesize
84KB

MD5
37d703ea9d7fe4937010a456b79c5847

SHA1
8802ccdd2b0ef5576c9296bfd6774ae8ada2ee4e

SHA256
a2ead99b7f53c15f9e9e86f0f35e48ccda4d958ebd592b60f0c15fb128f9adb9

SHA512
ebc525ecced420ddf92e0edd845e090df6f56fb9fcfcde4fc8037a95b60bf5bf8bf5c92041f22bc0569a57dca4c64a0da6d85038d380fbb6dd4f9f700993510a

Download Submit
/data/data/com.cootek.walkietalkie/databases/google_app_measurement.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.cootek.walkietalkie/databases/google_app_measurement.db-wal

Filesize
209KB

MD5
b3f50147589ecd5d3d447c82b33b8fae

SHA1
4505cc4b3375c441c2ec4d73780fbe59bdc3666d

SHA256
4e41ce143eafc16dffdc2630fb9564d791a5259d20943d7b0fcc80ecd6a2e01d

SHA512
a650686c5a3f94bd6dda6bf6ba669dc7fc9278d0ad48d0daa17f33bc0b1b5f8e1d0ffb18b4d82d4e16d481bdf7041393572bab8345b277fd16aaf25afd76baba

Download Submit
/data/data/com.cootek.walkietalkie/databases/preference.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.cootek.walkietalkie/databases/preference.db-journal

Filesize
512B

MD5
039a42557c36a7f8d9d4b1303473a8b6

SHA1
e42554b8449fe6885036e78d982b07ba4d6f54c7

SHA256
78f2f6e34bcbbeeb67acc5a75721666111533a41a92273010acb127258e8d1e9

SHA512
6db41aa4cecfaf74f514eecdbcb1915395a11039dd76c3726ffe68eb7710c58507648bc5776e7f8f7123086bb67cedde427ec45893c96fade7842b92731f5bd1

Download Submit
/data/data/com.cootek.walkietalkie/databases/preference.db-wal

Filesize
88KB

MD5
c17a150ef5d447a75ed5e3952e8ca068

SHA1
affae7dd6c4b31724600d1d935f005db7ee9415b

SHA256
9f56d36ac433c53a4efbe6a9e37ae412f4813035b0b8bf247b50d7f35c1b08c8

SHA512
9b71b4fb01eddd3157b5c8b45f13778054e5299e8d2bf60fecbed89464e77dec8e5599b63143dcc1596ad3fb7a31ae586caef6ff418f21e3878f08cfdc5b1037

Download Submit
/storage/emulated/0/andes/log/logutil.txt

Filesize
45KB

MD5
f14f6b2a2feb01222c5aa60110a30322

SHA1
ea2009768cb8d962fd75a688c47d460b0a415c2d

SHA256
8afd2055079887a3306b9f551a5e4eb325f3cb51cdee5ae4d5b7d67fe173f98b

SHA512
0441a4a3cad556781a8a44b6d7417c99f8978410fa2f8466e20b0735c60acaf4a26f37900027c28a5601c9480b78439f58739559c8a722fc835b1202687b5cbf

Download Submit
/storage/emulated/0/andes/log/logutil.txt

Filesize
5KB

MD5
6469e4c5b618fc46e666a3ddfa68cc2a

SHA1
39accc68d3833462398728153518f196c1d33755

SHA256
63199ddcb8681bb12049164a02318a746926a109f0bc397750006e5f103057cf

SHA512
43329fef23941ec28a7c830389fb9a2d6ee5c7e50db38d41073978acc7347c69a7df47309746420683f409b4be61253658d56063e6e727d108de8dc3bf1c026d

Download Submit
/storage/emulated/0/andes/log/logutil.txt

Filesize
5KB

MD5
f250544982bd780bd4a061e6a5d93264

SHA1
6d1531afbf075368286571ae8ba65718cb2f22ba

SHA256
69652019f27001a94db4790c8f74bf52bf5433d43a96e40f21b9db4685a4398e

SHA512
4304cedc085da3c5645b0bccf428692e4fb2f2b25a2509f1da97888d7abfac6c30335a9354377e89200b170c64e69fd6fada9f3d84919b96a8266b6860e9e810

Download Submit
/storage/emulated/0/andes/log/logutil.txt

Filesize
1KB

MD5
bb471e6061473bfa064f16c1fde6b310

SHA1
9a7f5cbb4c2032586fae142fb82a351effe032cb

SHA256
3635b7dee58e6e60a2e616942024ef65337aae8cc742610e71ee0703847bfb43

SHA512
e07076d97c97ec2fa569ce04ea0fc36412afcd747ca5463b7c7a2f4d64d9f2964dc33c83e812f06be1e240290543d5fba825a38f6da8a998cdcd39b617d24483

Download Submit
/storage/emulated/0/andes/log/logutil.txt

Filesize
1KB

MD5
d46f11a05c56aa1ada33ce7d3902e9f4

SHA1
31b275db373733cf5abbb6d0a860a09b63c61b11

SHA256
4c2a4719bdde0eebfa610f778f7a811eece31976b5a82b379f3a9a7af2e15dba

SHA512
4c4876dcbe69f2b567808e959cca1a656f4851cf2ef89dcc744ba5e8c84115368b08a4dd5858d4740374837d5dd8f81fe038fa66d2baf4d46d2926ad0f7a7eb8

Download Submit
/storage/emulated/0/andes/log/logutil.txt

Filesize
5KB

MD5
823ff2885ca0a4019ca6f96fc5fa44ad

SHA1
4f615054c26e6a6ffbc106b86c73c54bc95715f8

SHA256
7926abd6823e404b39e98aa0e3828657ee9a9831391ce26d65bc9403546537cb

SHA512
e4a50404045f3ee3ec6a50ca6f1f2399ae87b939810fd2bea48cc4381ae8967dea1fbb5efbca8e08439c87ea036d2db92035e9680b8e0614e17a217b250f9e16

Download Submit
/storage/emulated/0/andes/log/logutil.txt.hist

Filesize
5KB

MD5
67a198c306078dcd62ae5d3e43360cf0

SHA1
c929ed4b0874364d4c98196af85e8f41532e52f9

SHA256
e9ca8b34a204ad7cca8778d2f3554ab1051adede1c460ddf543c1483fc72b6a3

SHA512
77dfb35cddca8142663b31697ecc2cb7efeaaed5ed80e6704599bcb34737d44b871dd01e4a246cf5999f3ef425e8e74b4e0dc88b226a10b3629dd4767813b01a

Download Submit
/storage/emulated/0/andes/log/logutil.txt.hist

Filesize
1KB

MD5
e3544c996a15744679d535b049a579a4

SHA1
e064e416d62bb595e325e59f80986a8e09b7a17b

SHA256
778a2fa34a1a796a1dd63b7426efe4b01546371c993146c65fe5eb28c22f59a9

SHA512
57517021d424253cb0643004d2f05f663b3af88564db4a98ad45231d325f9f382111e0d891d20a2b599d7ed85611896a77a6922f3994aa33b19fbadf4c9ea9e0

Download Submit