4befbc31a73490fd62a0e3a627dac2c0c5bcf4fa4bc1a077824757b873db490f

Analysis

max time kernel
112s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
09/09/2024, 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7120e9f07c1851bb370c4c164f8f418_JaffaCakes118.apk
Size

26.0MB
MD5

d7120e9f07c1851bb370c4c164f8f418
SHA1

5e9643be8cc7c610a56bdfaf40389ab3f2175812
SHA256

4befbc31a73490fd62a0e3a627dac2c0c5bcf4fa4bc1a077824757b873db490f
SHA512

9d7766cb700f1b9f6915d391c7f980bb748b42d28ee0ba7ead8aacd7bf44031d1020a708f8d723a4c5f3111d688bd1d54b9d881eb7f3e7e6eb5fddf10a869936
SSDEEP

393216:BcZCZ6PDBbr7l8eATTlz/boGotIrgnkHh+FJhXpZpfV1+oqNPqZSFO:BcZRPlbrieAXVo7WUe8PZZT1+otz

Score

7^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xiaopeng.quantitative/[email protected]	4750	com.xiaopeng.quantitative

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.xiaopeng.quantitative

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xiaopeng.quantitative

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xiaopeng.quantitative

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xiaopeng.quantitative

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xiaopeng.quantitative

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xiaopeng.quantitative

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xiaopeng.quantitative

com.xiaopeng.quantitative
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4750

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xiaopeng.quantitative/cache/weex/libs/weexjsb/x86/libweexjsb.so

Filesize
6KB

MD5
9bb067cd33b490d30f2c88054c732574

SHA1
d95a11e2be5c7a1fab9820e34cdd9e482523ea86

SHA256
fb993dc086feddf19af9700c7428386e3e4a5c67f273711c371ff4460a830ae9

SHA512
0b721c51332313c50ae466fff1b4bdb48a71791bca67ee83d2882a19e8abb59dc1406ed15d6dabbcd3ba922167fbf68a3828fd82edf4b2270ff0191b8fed0dbc

Download Submit
/data/data/com.xiaopeng.quantitative/shared_prefs_ext/test_app

Filesize
29B

MD5
acbaecb03b3b95c360da6867d31769ff

SHA1
d9735b61529c109bc3fe546b4a714750403d4ce8

SHA256
ad025068f5d192a4d69402882ff1757b7e594d774f55b154a10583ed28f118f3

SHA512
56a675cf01edaab699eeb06d511da9d87701de9f52e0cb320c8d51acbcb3db184b36c8c0c3c96701a61a4478c25ad78a4c473f92ec5adb4d024464f976651b18

Download Submit
/data/user/0/com.xiaopeng.quantitative/.00000000000/A3AEECD8.dex

Filesize
63KB

MD5
ed73a80eb949bacc52428b8d5a087fa5

SHA1
07e973549a2cee61ffeeb6439abc419cd8a489a9

SHA256
f0ead1ad60e0cc310c1a40685c28fc7a69aa346604552816c51dd3c1718a1e76

SHA512
4bc26c18ca3a2edfe38ca1e14ad1e1415268b4a69cdff3c0f8e2b8fa910c67c2e4bc4f32c21274e586e8e139122ea3dbde7ec507c4722b4a9a778ee2598090b8

Download Submit
/data/user/0/com.xiaopeng.quantitative/.00000000000/A3AEECD8.dex

Filesize
63KB

MD5
5061e4948844f7d366972ac8005e9f13

SHA1
a2b79a1c79afb095ddebf0f16a1f9db64482bcaf

SHA256
3aa6caecfcd101531539147e01382bc530b4fdc61e98937d63cc4648793c6a45

SHA512
223d18ce248912df18cdea3c8e864ea5e6ec058ca42cc5fde738188c54abcd260d7f24ac53d4987d3e32f4ae3e1e40e01354054d035bb100eef51b2d695f5299

Download Submit
/data/user/0/com.xiaopeng.quantitative/cache/image_manager_disk_cache/5057081f866c81d5744b78d823a5f139b4a253722fa376f5d98bd2381597c810.0.tmp

Filesize
631B

MD5
bda3ed424fbf694822d966447736b8cd

SHA1
9fe93f280ca737a39a592d4d0c81928be7a47df4

SHA256
0ccab85d9b1bc1d705d44028a78b3acb6452c2bb784083ddead8d27ba48bc5ca

SHA512
ccec09e3e57ca730d5567935d526c1a71b4d56110b08bec12ca5e57cfb3dae0ca35758df55d68047c8d7729bf7a0a3c1cd7d080596d0fdc0c5ae2b7535306ba2

Download Submit
/data/user/0/com.xiaopeng.quantitative/cache/image_manager_disk_cache/9aaaa234b199ae5330742d817361c40a39002b5967c74c755b0e21ce6f8cad7a.0.tmp

Filesize
1KB

MD5
5c7706f9257f9f6a959f68e05685f14b

SHA1
82c676c4bfee2e552edaa9135402507395973afe

SHA256
f5a9dcf976b5560ba5cfaaf88a2a21c7f79a2a09b257784672323fbaa0f000bc

SHA512
049d8829441604c5ba1237fe13fb7abefcdce5ec3566bb48657021d5bd14c3a7220abd22856ed01ac5cce7f3bc65e44052e0a49abba6eadd026f24c97fb012e7

Download Submit
/data/user/0/com.xiaopeng.quantitative/cache/image_manager_disk_cache/d8e55d23ee6fde43321daa0d13a4813a16e8425a45f2b0157ea332875fb8a503.0.tmp

Filesize
697B

MD5
19eb0556e6523881288474ac7b7b9d1c

SHA1
6db800630c458d3e0963a765bd6223dd4891aec2

SHA256
7d347a9aa0aa1ef36290e17826aa6b989918dbc034346e13b60c6d72acde7248

SHA512
fdb15f5a4d0c2d52ce3237307b65f64283052269482289dc3137d88101a3adde6b456df6b5a6a3a7fca5a9b83d8e5a298052f852b5cf250d3fe2c2d0acc3b728

Download Submit
/data/user/0/com.xiaopeng.quantitative/cache/image_manager_disk_cache/fa6588d0949ac9ec988f3f5c7c56246cc173c413b87ec68d97c7f323e2b3592c.0.tmp

Filesize
1006B

MD5
7005c719bd7866cb60360c71839b3f97

SHA1
695aef25cbf9f15c0ad1d9dc6b9fbc0f8dd8cd00

SHA256
eec88cc40410213c2b8cf92ff1fa87503c5d9f60cd0113a6a5864f61e2b0153d

SHA512
49ec58b319359e16886aff9837f7aeddc60833c515771b63743ee4b1358c853cda2275dc65ec74db917336ae408fe50ac5fc2bfe3f5ab030f1974b46ae2795ba

Download Submit
/data/user/0/com.xiaopeng.quantitative/cache/image_manager_disk_cache/journal

Filesize
617B

MD5
01df70c570e768a32a5cd8e1b5fdec29

SHA1
2eb26296b9372d582673a8f474fa51175f4ae07f

SHA256
4d190bc0226f98096690347e9abd0590d4ed78ae38ac3bd9146a40aa70b93c0a

SHA512
f3ffbe83576e97d7cd4c252d1ed76899ce2e7c44f609273a94571437a83aad7a490879dcd09c7a120b6919c086ab527103ad93f701d3660c973997f44efb72ba

Download Submit
/data/user/0/com.xiaopeng.quantitative/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/user/0/com.xiaopeng.quantitative/databases/DCStorage

Filesize
28KB

MD5
c5f63ad7b8929d5b1e9bc36da169625c

SHA1
3daa77a1aa9b4a5bf19e5d4117633df90b8d178c

SHA256
07461bbd5fbe55202c6f5bc2a8edd0be8d7d4e1f6b3d2db620441ec9ff5a5c44

SHA512
122c99a4b82f489bfad007f93365b7f11d5eb407158f60c2b1666351ef43e436957d68b97a6d2f6cef56715d9c37652d051973f4a43ae91ebf1aea69b2795a09

Download Submit
/data/user/0/com.xiaopeng.quantitative/databases/DCStorage-journal

Filesize
512B

MD5
1b5a603e42cc9422d5234bd2d28dd316

SHA1
9fc1d7bc90c0d12e815509e40f0623bd6a24ba76

SHA256
b38822245634f1e0b3a6eeb4eadcbf0757f5afb8ceca20e94bf6bb821bb946d2

SHA512
d5263824a51bde35b116c80a9307d41dbf923672f4d8f0d5ddcd516c218002fd7c31390b19556f206dfe59c4e8b8d454b860d9cef6cc8e9858cc00e9b1daf454

Download Submit
/data/user/0/com.xiaopeng.quantitative/databases/DCStorage-journal

Filesize
8KB

MD5
c88bd75d2298f0aa55447588fd5a0973

SHA1
75e508c5517cb9568a7446e377540571ef7dd341

SHA256
6a8431ffdf7330c492908043001f6e49549ed967d8e4e3e76baf24a20316e910

SHA512
32c529cd4da5c9ef47de2dbc0da1bd6605e4957f6b326f411e195b14004c7b6c68d2decbd879db78ef2de5abd17f4b0577e5dd6316cad5a22509a7e56e3957fa

Download Submit
/data/user/0/com.xiaopeng.quantitative/databases/DCStorage-journal

Filesize
8KB

MD5
3d0a2999a06df4ece2dd07332717d696

SHA1
b3ee39ed5b12e4bbcadd8b8411ec80932341eaa8

SHA256
cfead1606b1b72b03d7a8d6c394aaeb9c1612286cafcfa14d0e8ce7cc741b7fc

SHA512
94db86daef6f473cde449315c5c5821b9ce25ec8a3de26744dbe8cc9dad3aff3d8044ca60eb5224a33595b26dc8432727118c4ad4dbba62a4992d986bf7c6dcf

Download Submit
/data/user/0/com.xiaopeng.quantitative/databases/DCStorage-journal

Filesize
8KB

MD5
f5d087897ebdd841cac78171c061a33d

SHA1
a33caa2bec68746ee7f5e88f41d69d3be9483b51

SHA256
048c7da1276b5b1840be8585bc1663e73aacbde04c43de4eee99d792abc5f52b

SHA512
a6acec68f25b726c2f0e25c4fd1a1a2f48c3b376a37a2a0d6d4f2ff6e0e1640818bb0dc7fb66cd32765183a681b16b9229b22a61595e9cd7532d28163a581494

Download Submit
/data/user/0/com.xiaopeng.quantitative/databases/DCStorage-journal

Filesize
12KB

MD5
38b1d33fd40d9c1e3c05f66d31f35898

SHA1
7eb549baf0229f8dfdb3d9633461a20fca2b1e07

SHA256
f0478ccce523ecef37f1977fe6fcd4dedb8264d01804523dff41a9d4f5dca0d2

SHA512
27fcbbae5b21539d09f746fe7104f70e9e8e0e83ed2cb1acbea8f20b6b0b5c93bb42a99dd1000d092a55a9548820971dedb91f60c7b65f9f9b2f645485b1de1d

Download Submit
/data/user/0/com.xiaopeng.quantitative/databases/DCStorage-journal

Filesize
12KB

MD5
bc95ea9de4e4deda002a84801416bf87

SHA1
8fa98b01f1b719a71b5454f7e2a0a26166e83dbe

SHA256
33b8c8f0ee8f59efc4cefa5bda420177a3c7632c7bc139b7f1b58cf1c3b2b259

SHA512
2863f7eda966dc0e7f4c9c6e71b78bda81f0d35f67b760ce70064b63e916bacb19a2ff832b3f3a74aa2fc5169aa920b80260b5476fbd1d10f2703df615034d84

Download Submit
/data/user/0/com.xiaopeng.quantitative/files/.imei.txt

Filesize
32B

MD5
837dc2fd34d33902a31a0ea2c1841ca1

SHA1
94606f224df3eb4e12b685f47dcffb5ff0186feb

SHA256
821f1182977733aa5baefc6f96b3f300a844d9d2ef5c528f7298249d0e40b892

SHA512
056f6c26ee542f3fa52ba81599922b116e41748c95cfd59c2521ade7d9b0c75f4c092afa15c87dbf866d5ef0f6bab0676520ad30ab723ccb2f826d29c09fc6dc

Download Submit
/data/user/0/com.xiaopeng.quantitative/files/cnc3ejE6/eje3cnc

Filesize
35B

MD5
762298b93820a5cd8b6d8ec469078f7f

SHA1
d5b02a2ff3b235cd2b61ceff53a1d88b8984477d

SHA256
dc3f98a33c26c2796dc294b354831fd5ca9796295f4cb38479c80b145d4807db

SHA512
70f864211ce16679d0538abf9b7071d27c2d22ae458e32409d20065032c762dd186307ef33ede90abd9ac794a4ced8b163404e9799c05f0c515337249684311e

Download Submit
/data/user/0/com.xiaopeng.quantitative/lib-main/dso_deps

Filesize
424B

MD5
a084c155af787d489aba4202c4965d97

SHA1
f3f0b1fc752e9d969bb28731a3c3bd7b5b6cb81e

SHA256
65581f276a7ef909136301b273c8c9226dbe881812ea060629f0a8eb5f2d9a51

SHA512
084f10f211a3923663745cf7cf59833165e0edb8c925a3646bf3dbdbdebaa99c05efe890a7f7be38473500ad241d6f9fcd3ce041bd73bebd75305267cb8c505a

Download Submit
/data/user/0/com.xiaopeng.quantitative/lib-main/dso_manifest

Filesize
5B

MD5
c06857e9ea338f3f3a24bb78f8fbdf6f

SHA1
c5a0a2529d2deb60fec041b4fbd722a2ebe31702

SHA256
957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027

SHA512
29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1

Download Submit
/data/user/0/com.xiaopeng.quantitative/lib-main/dso_state

Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit
/data/user/0/com.xiaopeng.quantitative/lib-main/dso_state

Filesize
1B

MD5
55a54008ad1ba589aa210d2629c1df41

SHA1
bf8b4530d8d246dd74ac53a13471bba17941dff7

SHA256
4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a

SHA512
7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

Download Submit
/storage/emulated/0/Android/data/com.xiaopeng.quantitative/apps/__UNI__19BE1C6/temp/1725970688422 (deleted)

Filesize
736KB

MD5
1764ddf6d93a7dfed239472bb5178240

SHA1
4f8ffc0149e56d50d26389386f8cbe1ac79b4e43

SHA256
7080d39abc7ef6939130482d6a0e2b70feae4b3547e2b7a2c5a8d3d96082d6ab

SHA512
add699ebe3a704f63ddbd339b44c0b4fd3a9bb9e52146ec7baa395b5dbac5420e4e5385e7c40f35900f403f7eabcdd0dd2c0af44a03b1119f4c7965d435d5ac5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads