9d7df0bf7aa91a401d0530bdc66030607d523ab317b74576dee8563a14459031

General

Target

fee0dd9c92cc9d33088cc7b2fa441e44_JaffaCakes118.apk
Size

19.5MB
MD5

fee0dd9c92cc9d33088cc7b2fa441e44
SHA1

8adacb38b493c1ae83e08aca7525b5124c4442e9
SHA256

9d7df0bf7aa91a401d0530bdc66030607d523ab317b74576dee8563a14459031
SHA512

5c0529c3acc682b2a32fc09d1f7b73bf9c35a0d5277f015c1d19728872566da45f50c02a91a6fc3296dc16bfd2fe99e6fbec9a97a5c7e081490993c424abefe0
SSDEEP

393216:Uq0AYjM4mCaAOTevzsshyRAti+w8XeSnL5+jVw8X1Q3XnL5+jmHmP:YfjxmfFgQshyRsVw8XeSnL5+jVw8X18s

Score

7^/10

discovery impact persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.cntv

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cn.cntv

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cn.cntv

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cn.cntv

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	cn.cntv

cn.cntv
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4249

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Process Discovery

1

T1424

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.cntv/databases/UmengLocalNotificationStore.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cn.cntv/databases/UmengLocalNotificationStore.db-journal

Filesize
512B

MD5
c54640f8c35f07dcf6048d1c366de7a0

SHA1
427c2277b578977109746cc073a26b0b9380b7d8

SHA256
e2d8f1509e96f3ef1793b4a84671ccf167eab5c497cf05ec6960ad445e700340

SHA512
0c238e8b7147329e7ec15cc3bf372e93afc32df14fb12b04a34a85b37de81e04f741717f244c08ea7c3aad226f3c255e8a5204d956e0d4b9c5fb2d42d9a24922

Download Submit
/data/data/cn.cntv/databases/UmengLocalNotificationStore.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/cn.cntv/databases/UmengLocalNotificationStore.db-wal

Filesize
40KB

MD5
2044feb0066e3010b21d689b32e84b5b

SHA1
c4c17b1c089c814f6131ab809eaa436441d8e972

SHA256
fcfb44b1e68d7fa78c955f37ba403b66641b63bedda6221d2027e1b88df798f3

SHA512
1862228925cc8040e9f3f3acb344a4186b55a92cfa1aa898e67841e29c55635c1f3b9378e6def24a52b1366c53ae64b4af820d745725a7a82ff6eab25179e617

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
111B

MD5
48a76d2d709c50627b83c9e1f051d78a

SHA1
661d0311cedbff5ffca13f79713321093a5f0a22

SHA256
a321737c31ef9776a7721cb950b5bf863e7c84d93cf9d67e9bd8274976bce723

SHA512
ba1dd4e5cdcde487deeb2d86f54349a8706e92296b252525df518b36617f748e4b3c5458ddaedf897ab4196957291732b209003c3817aad3b0edc353d7f3ac42

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
111B

MD5
6a005a8126e719ff8e08438d65e8f72f

SHA1
d660b3b9e4135a42418d0d3a369ffd4da71b2f54

SHA256
d027982e282bdf657f9fdb7374bd5514c536176b54a13cbf7cfe56d086b6a485

SHA512
7877d6d096110b1d43e46119f6300b9095c0e5f0834146d2f8fc5be3e3e2ff9c23f4bf568d29f0e9eb4972712fdccf6d558cf928546574c61d54c5bddf7ce39b

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
381B

MD5
fb61519a858b2d1a67c3b81607ef497e

SHA1
10224b34432ae400c9a552226e59c6e8380d0b8e

SHA256
a048548d495b940013a5d60cffff258bce7434dfb195c4e77876610ea28ddc6a

SHA512
28d63d14e76028c0729221f4860693b09ae41931a3ca9ad3882926e9f4220a38850343500927f2dd0e5051b87e54edb2825255f444ab31c9e964c4e9abc008c9

Download Submit

Analysis

Sharing