Analysis

  • max time kernel
    148s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    25/09/2024, 17:49

General

  • Target

    f68ab0e6c417e1070c25679e952e07f0_JaffaCakes118.apk

  • Size

    4.6MB

  • MD5

    f68ab0e6c417e1070c25679e952e07f0

  • SHA1

    5bcda7e90cd830155a44e578de6a571800400465

  • SHA256

    9343a1edeacb51cbf022b910c030d2028e8dd59782da023525bcb7d6dfdf3483

  • SHA512

    919a7c91361b0e7eb66a324b3f78ac8f19eb6e54c7ac752a0f09ba53021e1a0fddc18e08822571563533ba740d3ab2dd3c0a1d77c22ef8ada32ff596db9de27c

  • SSDEEP

    98304:oHpksN4psVkD/k5YI6tUqIPIhmp7T6bAy4kh9xqoxnwLl7Kh9CJaF6sPq6:oJzcsQk2I6uqIwhQ7AxXJdh9hlPq6

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 4 IoCs
  • Checks known Qemu files. 1 TTPs 1 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

  • Checks known Qemu pipes. 1 TTPs 1 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 2 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks CPU information 2 TTPs 2 IoCs
  • Checks memory information 2 TTPs 2 IoCs

Processes

  • com.mobile.indiapp
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4315
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mobile.indiapp/app_SGLib/app_1727286583/libsgmain_1557315458000.zip --output-vdex-fd=76 --oat-fd=77 --oat-location=/data/user/0/com.mobile.indiapp/app_SGLib/app_1727286583/oat/x86/libsgmain_1557315458000.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4399
  • com.mobile.indiapp:worker
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4359

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.mobile.indiapp/app_SGLib/app_1727286583/libsgmainso-5.3.7011.so.tmp

    Filesize

    407KB

    MD5

    888d7c773e4fdd9be8b00b6db94142e7

    SHA1

    8894ee6113982921c1b7749c33323bacc5e86e2c

    SHA256

    f35448ddfa62b57bda52ef805cd5e5a79871ae3c27a8e775133a6a69335cf7d0

    SHA512

    c317d7e3f3bc8d88667b4f1d88f43c29fbc39d9eee5b71baa24511ae8d2932fa86164bda75f54b6554fb1240eb90a2670b99bd43e4b7cadf78e7986f3b985ddf

  • /data/data/com.mobile.indiapp/cache/httpCache/journal.tmp

    Filesize

    3KB

    MD5

    47d26228610ce4ce3f3c935ce849d81d

    SHA1

    ba74856c1eb9fb03c286f9746302b8ae3ed8d9e2

    SHA256

    d0e9ef1c5d219befdc3688f82ba8a714a030ddcd2dc00900a2c4d596d11d21ad

    SHA512

    6aa453449848250741dc277eaa6b5e73296011c84a823b0e810ee489194b23cc80e9002b5d4757e9e8eaf51859d5942c3c541e3dcb37a3f233547ad9d1819f47

  • /data/data/com.mobile.indiapp/crashsdk/tags/unique

    Filesize

    36B

    MD5

    7dfb2906b8da26ae1d1a0a22c6900f0b

    SHA1

    fff619ba3648656040cb9c40b0ce5365a4c91977

    SHA256

    388198f9155c826468cfccda7bc643d8965fc169eee3c3b90f6c70e8fc72b9ed

    SHA512

    3aeb554fe753b12f13e597318374a0c0dc15b1e853017432d3bc641682cfed139fa5207910a06d07e905b8d5e52c390fb30b3256fac74af48b48a37e4e7d013a

  • /data/data/com.mobile.indiapp/databases/WaSession.db-journal

    Filesize

    512B

    MD5

    3e8f4652b2def0d8c66b3e351cc067f8

    SHA1

    792dd7a3c94d42aeac93c707bd29e67e6d5cfe74

    SHA256

    39765067de814be4a6700303d4b45e1f0a8415a898212ad20a8db588e1ae63d3

    SHA512

    be8698e790103e73d5b11257c77ca7bdc30f968ef594a66d8971919359f0448e95b644291b95c0230cab87ff5ce683e76dd02ed82a2195ec662b001963a72010

  • /data/data/com.mobile.indiapp/databases/WaSession.db-wal

    Filesize

    36KB

    MD5

    96320ca84149900461e90808e7a9e4bf

    SHA1

    b49efe4deaee7af3ba4dba9b5935f634fe46094e

    SHA256

    004b490ec5c72ad952c50bbcc39e919e68a84ee396318ba44116014fcd2296e9

    SHA512

    4e80c422c318f6e821c902e7af89a356177a27823e4ad9d4df33cae86ee11c19f3a9582bd44cff5ba1f312177c4c3db58f6976c96434e2a1f0549d350d38a757

  • /data/data/com.mobile.indiapp/databases/common_db

    Filesize

    249KB

    MD5

    40f15f4d0fe071d0652fd1e4e4d03d5b

    SHA1

    6b5fd02be0e736ca160406afbe3c790abd53f198

    SHA256

    d5f192d7f4c3b8ebd19206979d3ab50c5adc2821fd291fc58691cbfb8f344ab8

    SHA512

    9739ac9938524038a80e572354d901816c82f6f39a2d6f1c638a2db90b2ebfd10d8d11e26f9729adfaee00607d363acb5149d031d515ef8785bde86a3eafb83c

  • /data/data/com.mobile.indiapp/databases/common_db-journal

    Filesize

    512B

    MD5

    1c1b2c8b45cb1fd0fb87e29172638cb2

    SHA1

    05e8d16ac7835903402e769c795184f4e2fa2a8b

    SHA256

    de45a60b60f26e756965df4250df4244878b4998b418b21f140fc6080d354584

    SHA512

    d7829c54ea35993b9250929dd48331cdc4e990eae3b4947215fbb1b4a4438556cf8ce89846673012f80bd02b43157fd6a99ccbdb68d836c124c49abed0d8d77f

  • /data/data/com.mobile.indiapp/databases/common_db-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.mobile.indiapp/databases/common_db-wal

    Filesize

    40KB

    MD5

    97d59e3110e158bfec135d53de881e2a

    SHA1

    408f0f6223fa486057f4fe8af01a9dc33938409a

    SHA256

    9931e3ce44c1327757929f1bdefe1261e217257bf0a95a0ff1c6c6ee3196313f

    SHA512

    4e7b1c8a70f1a4f2e786928ad8496d60c942e6a7c83dd5eb102a3975bb91444e49880c74f5a99f4a5d8ccc88215662a5d4bfcc293dab5281e114dbefbd08dfc4

  • /data/data/com.mobile.indiapp/databases/downloader-journal

    Filesize

    512B

    MD5

    3c4ad6acb565a5537e12656759b852a6

    SHA1

    20aa1bd85ff460ac394e88e35058af216f44303a

    SHA256

    593eb8a44a9450726551679a798c43a1f264d371f1905a734647dd36ecaded13

    SHA512

    5a2bf4e3db74c4b4b27f179470870deed03fea788587ac09ee7f4fd3fc03d4c30330e1db8f747cff07c07e7db6b9902ced0fb35c27e3e1750539db47af88afb1

  • /data/data/com.mobile.indiapp/databases/downloader-shm

    Filesize

    28KB

    MD5

    cf845a781c107ec1346e849c9dd1b7e8

    SHA1

    b44ccc7f7d519352422e59ee8b0bdbac881768a7

    SHA256

    18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

    SHA512

    4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

  • /data/data/com.mobile.indiapp/databases/downloader-wal

    Filesize

    36KB

    MD5

    a1cb28fe773efad34343a9d561ae4229

    SHA1

    aa02f8adac46d87c4566f86e79bfa6b38e818423

    SHA256

    23b8d6990e9a205c38580c0397cc816be9de2fae52cf5db0aaad70dcb51fc53a

    SHA512

    4278471083231b5a06632b80a49d554b52a9e46a2874208d7c6c554708c9ffacd37e718c564220197150b7fb4e093b42877f06b94f688ed16714604885703e9b

  • /data/data/com.mobile.indiapp/databases/message

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.mobile.indiapp/files/SGMANAGER_DATA2.tmp

    Filesize

    72B

    MD5

    f58f13d0fc991322df1eec4c68481464

    SHA1

    fac54fd6dfb4fa6e0b0f548eb024573dca8cd259

    SHA256

    1d3ba112a38305e67ffb1aa4a0e0e70b3a22809904675efecec0c949d0b76396

    SHA512

    e1ef5bbe84095b5ed02d1d9b23bc7e034b67715b3535473553a2d797b86ddbb81028e0cd5ccc457be1828893413eb368e04f29b7c3a2878f933a025153cca535

  • /data/data/com.mobile.indiapp/files/SGMANAGER_DATA2.tmp

    Filesize

    143B

    MD5

    e226bf9446849dc009baa24a537ac74c

    SHA1

    b6b4de6d0febe5a29c94656ddbf85823f20d6204

    SHA256

    f4748057d8d507d1ff277a03fdef8184f0e215e4be2de5315b48c647fb0d8a19

    SHA512

    0acf633e9b926ee1c43ba5f11357a9f31524a62e7487fe95b70feee27740197a4cf725c3a0aaeadb2fdc441ce4af69e0800ae23bb7a64c7525e7044ed49c6541

  • /data/data/com.mobile.indiapp/files/SGMANAGER_DATA2.tmp

    Filesize

    216B

    MD5

    b54fd28d048208709a578c7275e036db

    SHA1

    2ec3bb1eff10ab7830320a82843d5606d77cfe7d

    SHA256

    5c3d162ebedebe7cab9b28375c53b898b2ce4aae0ea7d6304ed81667cfab8ed4

    SHA512

    dd64d465e6d9a3789cf1e60de406dc67bc05d84915fea2ed0fc36b9d8cdddd0a0aab286f56b2605e0f55c7d4017a85bf64a9466c81ac6785c59372d826346f81

  • /data/data/com.mobile.indiapp/files/SGMANAGER_DATA2.tmp

    Filesize

    288B

    MD5

    c7ea4b26bb185d2d1cabea6c64b50cb6

    SHA1

    453d8b6c12f614ba9819036fd01b5f573b940d65

    SHA256

    61205729a8a10f814364c9952f179738a3d06f0c2839abce7ee9f1a9a2a4414f

    SHA512

    a5c16485898deedfb9463b4b5e4406e9324eace33d2e6eae1b5be56277d4ce8d87000812519327bc78a2baf1fafe5d05563994b22607ee1c8f8d0b10d50f8167

  • /data/data/com.mobile.indiapp/files/dc0a8a56c418c8e695

    Filesize

    5KB

    MD5

    a86dfd7a465778b86aa21d5d5a26c7af

    SHA1

    60db617b6ed9313cc23f4b41aaed121b65a72107

    SHA256

    7256f1fb64cf5130f0e0810c8f5be73d46f881f38de5bc6405c92d6d21ce1276

    SHA512

    dd31946acd018c2e9b5e54c486ff5f3bd134c4bd1f2c2b3b957f4dfc82cf2115287b6e2ed8b3723ad86c0ce679a88467d2db8bcc0e5071563f6d96cf36907a10

  • /data/data/com.mobile.indiapp/tiny_wa/1727286618055.wa

    Filesize

    88B

    MD5

    739811c1525803a8dbae6288ec332b88

    SHA1

    401dcb7e9fa185c19dd754adc721c6f6ccb76919

    SHA256

    fa65fe9293975183ec4aae13728911d9751b927546a1d6220a508498928fcd21

    SHA512

    46ac377addb01a6060c8fe45564b28681bd3dca81714b0514a7342604060d99580555ca26e5255bd28d07639c9ecea4ba558c456e1eca7fef2d5162f53c4fe63

  • /data/user/0/com.mobile.indiapp/app_SGLib/app_1727286583/libsgmain_1557315458000.zip

    Filesize

    42KB

    MD5

    8f388f06caca62732f1de59df8454b9a

    SHA1

    55c04257d8734090960d179f5912b03cbe624eb2

    SHA256

    d2a4094f53a9bab584ae7160072499c0eddd968d14f56221d0ebe698174312b5

    SHA512

    c186e0146cd9848f7798545c680673521bf04958e38bf9cb6f37c284e2fcca854e893d0751b65151a2279c16ce879b59fb4262429e14f3b804c54e6d30ece68e

  • /data/user/0/com.mobile.indiapp/app_SGLib/app_1727286583/libsgmain_1557315458000.zip

    Filesize

    42KB

    MD5

    b9fff83be0423460003164d3f885b71f

    SHA1

    a25c7545f0a83ec66dbe5550a2c906d38d7244e1

    SHA256

    6343f3d34569d3a38b2571ecaf0e754d9c49360296e4ebe23c6813b6bdbbd4b1

    SHA512

    57abf9d30424991bcecc6d09837fb85461a8725556efb7bfc4374c34bd3e372c1bb3f0c9003ded7e97a52d4e78907424e19edcfe146a2539b3b96d01d2b9f954

  • /storage/emulated/0/.DataStorage/ContextData.xml

    Filesize

    213B

    MD5

    0b1a44733410f1829eeaf9fc158233de

    SHA1

    52457c95a2e4469fea015d8b2955f17016444bf4

    SHA256

    57c82995603b5efce643ef811e0c9721542e9bfe6fbdd5858ce0ba8fec51b4ef

    SHA512

    d509fdbe8d220f23b19e5d98d852a848408c45c043753fe698bfd39014393069ec2cebd7e4ca3136ae8005b0d92e06da44c225b99327eef95ffd274ba16c2df2

  • /storage/emulated/0/.DataStorage/ContextData.xml

    Filesize

    32KB

    MD5

    b15b00bf90b7c93b3665eda88fbc4808

    SHA1

    5d90cbaee0798753afcad7e6555a92d2567dd02a

    SHA256

    92882182a7ffae56437ee1b2b3a68ddc0594b28c1e3a4254920023015cb4b429

    SHA512

    cbea5c61e2043c01bbf5b0ba79e45106bf011e29447317a4bc66560afb52177f2268f5fd95d84868152b25b1aa4368256392d24eed3f4fb9a56cb2eaa1b27059

  • /storage/emulated/0/.DataStorage/ContextData.xml

    Filesize

    167B

    MD5

    f715a27d2efa5a97b020ba4d69257d4b

    SHA1

    144a39f859e72cf98818b208bb6d6e197e022d82

    SHA256

    fbe9cb05e288377b7fe30eed98a262d7c0c2bb9edbdcb5ec6d2304f7305bc766

    SHA512

    bd934b37902df189d4ae860f7b0c0ff8f77e2deb395a115d6512163858ce381233776e9c195c62d60606cfa7d6d59dacb22a06115ae30d47f7afd87d47ca3a62

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

    Filesize

    512B

    MD5

    8d37d9c9ce44a4bc5d57179aa6074202

    SHA1

    4487d4bbd32399b9c5338997355da5dfb1e10b4c

    SHA256

    fccffedd22c0b558ea8f03e6818b47d472d15bb3c2ea12203cc4ee6597fff3df

    SHA512

    6c1587e60666af7e59d83b7f7be8be112dce24d9337b8096f293d9b40306e44ad09cfd8581fab0a11c21253947eab2ffae712eaf106abb1b5559126e6397f19a

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

    Filesize

    28KB

    MD5

    8371426e4333c67933c02ec9422d747c

    SHA1

    df0f128671a48f349b5d3e57a5433b4a39c4f058

    SHA256

    57c05bd54ffb0af6fadb2843548bf27c97bbab29301e22f188c16435e6ab762d

    SHA512

    053c9e047afa9532af3db4b75eca64ea260607086bb7fcdcdfa3aa72a7ec9cdf3740f2c9cf1f9979524221042b9cfd1f1021117d7e4fbaf6cc62af10f7daec6a

  • /storage/emulated/0/.com.taobao.dp/dd7893586a493dc3

    Filesize

    576B

    MD5

    03e6b7b2e8a0406089fcdb34bbd1effa

    SHA1

    a32ffdff8f923c921b0ee82c3740887c0d77a8ab

    SHA256

    372ffbeb6e6d885815990ce759e5d63104d68e1e834d1161fb3727c2576fd183

    SHA512

    6038474cbcb51f05103d998be8e2d80588eb2fd14f06f397ea4496ac5bf2f740b4a24ffc83c4e07e1fdb7fa4bd0667fdededb02807ec055c8fa06dd599e0e946