537d8d6a36c10e7936c5f647c322def6f2f3c60184f9fa64aabb43e7c75c622a

Analysis

max time kernel
130s
max time network
158s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
25-09-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5b3793a3f07df987410be1e04d58cba_JaffaCakes118.apk
Size

6.8MB
MD5

f5b3793a3f07df987410be1e04d58cba
SHA1

7982de268ad7e4de56526fda28d5daafcfdab2fa
SHA256

537d8d6a36c10e7936c5f647c322def6f2f3c60184f9fa64aabb43e7c75c622a
SHA512

b436b6cbc0d7ec49314e3fa599af83f36e8dee7a95cfd1aeadd65b2aedab2cbc2990cb05295ed20edf136899b20d2c6cb73f8884bc2d9f907371615950dd22a5
SSDEEP

98304:Gr761NF7mPgOA0bzmrxQuB7MmNnt1d/AYs/I09XfbCFXruTcECHD+/OxN566D6bR:GrsOtM2uxMGwJCFFZ+/jqguPw

Score

8^/10

banker discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.qihoo.daemon

Checks known Qemu files. 1 TTPs 3 IoCs

Checks for known Qemu files that exist on Android virtual device images.

evasion

System Checks

T1633.001

ioc	Process
/sys/qemu_trace	com.qihoo.daemon
/system/bin/qemu-props	com.qihoo.daemon
/system/lib/libc_malloc_debug_qemu.so	com.qihoo.daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qihoo.appstore
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qihoo.daemon

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.qihoo.daemon

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qihoo.appstore
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qihoo.daemon

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qihoo.appstore
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qihoo.daemon

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.qihoo.appstore
Framework service call	android.app.IActivityManager.registerReceiver	com.qihoo.daemon
Framework service call	android.app.IActivityManager.registerReceiver	com.qihoo.appstore:critical

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.qihoo.daemon

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.qihoo.daemon
Framework API call	javax.crypto.Cipher.doFinal	com.qihoo.appstore

Checks CPU information 2 TTPs 2 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.qihoo.appstore
File opened for read	/proc/cpuinfo	com.qihoo.daemon

com.qihoo.appstore
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4220
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.88
  2⤵
  PID:4678
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.88
  2⤵
  PID:4794
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.88
  2⤵
  PID:4824
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.88
  2⤵
  PID:4856

com.qihoo.daemon
1⤵
- Checks if the Android device is rooted.
- Checks known Qemu files.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4251
- /system/bin/sh
  2⤵
  PID:4422
- cat /proc/version
  2⤵
  PID:4572

com.qihoo.appstore:critical
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4443

app_process32 / com.qihoo.appstore.rootcommand.persistent.CoreDaemon --nice-name=com.qihoo.appstore_CoreDaemon --daemon
1⤵
PID:4470

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.qihoo.appstore/databases/_ire-journal

Filesize
512B

MD5
15dc3da35c54cc00878ddc9b5a4eb596

SHA1
f4ff2d980bea0c7429575b87d6c6ba99fff02347

SHA256
c37658716446e8c655cc8b5ff5190b08a18ba6cf59e87dcb9711486a7a49a698

SHA512
537a6e785758c5fda624e3b77f406bb5bb039db91f5869ab87b4a4a0b8466d37b3c55fc8ad8870eb1b8f39bed7cf2ac38b8f4cd82fb33052f44d496bb0729d14

Download Submit
/data/data/com.qihoo.appstore/databases/_ire-wal

Filesize
20KB

MD5
d51f67f00ac5bf1e05c84e449b7707bd

SHA1
0899e65d286fa580b928839f755bac87c7ab234c

SHA256
e1fcb2013e5e37c4c8e2a705b5bb0ba8c155281617d591b74e91280c4567cce7

SHA512
b1aa16dba481122269c42db344fbb0f6ebba31c73b854718f60b9438738c104b1bc05a7c08bc03b06ce012101dcca7fb1c90304caea9ec6799122b2587c67d26

Download Submit
/data/data/com.qihoo.appstore/databases/download5.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.qihoo.appstore/databases/download5.db-journal

Filesize
512B

MD5
18c0d009ec7b1be964c7b9555c4ec312

SHA1
f40cc518a54511fe185279cf46d479e407dc051c

SHA256
38f2fec279a2c9cd9cf4837501c7164f255cf9c4f7a12d82f3361387e014ea33

SHA512
9b6d2f045181fe10dd9fe9a2d961f873f57e85fc7a930085411fd5ec519ad74b9307941ad3710439f13d5a4705730f7078636c4c3e8e3a33e1615ef489d696f3

Download Submit
/data/data/com.qihoo.appstore/databases/download5.db-wal

Filesize
32KB

MD5
0fca2d4c13389346accf75b7ccc35d29

SHA1
5b341d9af60cca6e13cd1f7d4e361819fbcaf4f6

SHA256
5ec974d3eab7d89360855944d4589e7730cd2559f5eeeb2603f5445608685503

SHA512
828dc6ff6102e0030768e6a90d85e4834deebeea0d600048bfb30d4215b08480785af62aae0e2ce415615108f9bf16ae02b5a23fb31a9dd240c2c5a19096a1ec

Download Submit
/data/data/com.qihoo.appstore/databases/filelist.db

Filesize
4KB

MD5
82280c2de44ef44554aa2c6e93db924e

SHA1
fce20989c520b014f366971392b493a7134c4ce8

SHA256
f778260d6670d2bc0b93732a5f28aa724129d2f1ecfb4932123dbcd7e0bf3809

SHA512
6326ef17627d5e7f2f60f0588672318ac42e22af614b73bdb9f582ee6b8895b05ce3821ad579288b8bcd7677bf3b269d9b90a0a76be0007e26f76d04a24c0863

Download Submit
/data/data/com.qihoo.appstore/databases/filelist.db-journal

Filesize
540B

MD5
c987dcef9c91310361d823360ecbb375

SHA1
84b07b672d572449c4b5a801a5fc85c00b9b77dd

SHA256
2fbb29423fcb879144cc0fc2331e385f427115263cee6b282ef239ee895a9073

SHA512
c6583ae64907b7a507f013bd9ce4e6fd8789cae1021206c43b78b65923c1707ebb366341c995cce92a0c44ecd66f954779b8df9ea356c59ab6b194560e99a085

Download Submit
/data/data/com.qihoo.appstore/databases/filelist.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.qihoo.appstore/databases/filelist.db-wal

Filesize
32KB

MD5
3231fb5bf449d632dfa2c644aaa633cb

SHA1
194d1f18a90ff602afea7ab69ff07e37c0f80a2a

SHA256
9d064c58b6597fb6c9c3e67a7d3e9d615c51cf5e0897787e52a0bba52692486d

SHA512
dfdf5ae0c9d7bde5a2946fdd2d27b5c951f3ff2c57969f5f09f0403903be462866326565788fac8bd2a9e0c6faa1010e50ed993bae8aa0c0742d4bd00c3c6197

Download Submit
/data/data/com.qihoo.appstore/databases/new_downloads.db

Filesize
12KB

MD5
3fe30614d7e0d11db870b4624f6c50e0

SHA1
053ff0fc621ab40f2afeddb3e7b4a73ee41ec533

SHA256
67c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d

SHA512
c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae

Download Submit
/data/data/com.qihoo.appstore/databases/new_downloads.db-journal

Filesize
512B

MD5
92b47aade17a494afcd7602a58f7f907

SHA1
90e155e1232405529d8c7b64679803be6398ce78

SHA256
e8f12d59d606b0f1474d9efc6e960dab5ed309aa7ebd4da105fc948c366411b4

SHA512
13d543a8eb765d7fd540708d646a22b54d1e1ee59f3a23956323fc829630e516b066219373444de5bf775741b42b7e0768f195c5b531a38935ac69c0048bb1b8

Download Submit
/data/data/com.qihoo.appstore/databases/new_downloads.db-wal

Filesize
16KB

MD5
b4e7b1cdb1ec19f214d47e2c7ddadb45

SHA1
a7d498e920c54bf979346b3b75396bb68af296b7

SHA256
85b02ec3b0fb3c4baa5ed5c1f92a6445aae1a011697cfbdc8365ac51c7268638

SHA512
76231c765bea808c97e0615b32e8df6bea3a47c941b08773710ea4e29397885f30731335913f942b04799901d3c692d5cf5af7da0ef68d38c761335198d2fd0c

Download Submit
/data/data/com.qihoo.appstore/files/360/sdk/persistence/Y29tLnFpaG9vLmFwcHN0b3Jl

Filesize
1B

MD5
c81e728d9d4c2f636f067f89cc14862c

SHA1
da4b9237bacccdf19c0760cab7aec4a8359010b0

SHA256
d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

SHA512
40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114

Download Submit
/data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl

Filesize
516B

MD5
f8476f5acce677dc7a2580e0af21c9cd

SHA1
701b117d7bf7d1ceb0885533a482a6f44b00a828

SHA256
4476d8aa93d4763b10b9f93c5faad5b4f885e884e91662c5019b2417d86132c1

SHA512
08dc566903dcb563b95ccbdcd3542a8f9495e221a8dc16218f4587a2b02dc9a3d6cece30842e9dfabed10c69528d3a43df6ef03246820fcc4f8742f47791be8d

Download Submit
/data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl

Filesize
632B

MD5
ed66a8bd600b86d5524af7385eb5bd4e

SHA1
fa301359b40dad136c82e2c34a051d911c463163

SHA256
520811f39e47b4e687a06c1f6df3555f1db7c64d18bd30517ade76e9f4e5d561

SHA512
6987518c7c20cb5dfaedd3610144f1b9b5c4a9829020ed9173b3b229a08c65e6da837b5c3e76d714ed65eb06cc8c950d9ced5a12b84a0f472d5bd50762fc1dae

Download Submit
/data/data/com.qihoo.appstore/files/sllak/opt/4220/finalcore.jar

Filesize
77KB

MD5
afa9f41de62d432b52c2299b21728e89

SHA1
11a18c5a5258fab222b651b754702f71b884138f

SHA256
c4ea4fa733d44da71d42c515d46ecec79cfb56520ae5ac10de16fc25070bd094

SHA512
caf609ac41fafdc44f02f172f2441864af94635b7b8059883971fc0f6adfbdc39f2796f60084683bf368599b0d76c3738095cfee7d8ca88972c085aaf89596c1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads