302db1cc104ea99662ec45dff2034ee8828d1ba898a526a7b50823bc8a50c2c9

Analysis

max time kernel
139s
max time network
155s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
10-10-2024 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3140851d042fbeb0e08633f5f38c1338_JaffaCakes118.apk
Size

9.3MB
MD5

3140851d042fbeb0e08633f5f38c1338
SHA1

7c824d88a5f78791af7b7f3a4cbeb0a0e58cd6b5
SHA256

302db1cc104ea99662ec45dff2034ee8828d1ba898a526a7b50823bc8a50c2c9
SHA512

3290a9145a5c019f8324e6a06e4b34c1c017d3283af5995a94511bc2568d1409e4cec67f4de50e1fa0170a7d52f0316a6dc50cad7d64bf4e6de27bc88a246407
SSDEEP

196608:SvYoQ/PipF9DW0bwc3xBAT7LJWlwAYBiEdgxDOo0GzlhsL8tW:Sv2SF1WbFWlwAYEYqDV0G/tW

Score

7^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.xianggou.qydjk

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.xianggou.qydjk

Requests cell location 1 TTPs 2 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.xianggou.qydjk
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.xianggou.qydjk

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xianggou.qydjk

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xianggou.qydjk

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xianggou.qydjk

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xianggou.qydjk

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xianggou.qydjk

com.xianggou.qydjk
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4507

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.xianggou.qydjk/databases/hmdb

Filesize
12KB

MD5
171aedf968e17a2744d2585715606cb9

SHA1
bbeddeb3b89fcf809619c35b4a318a80e7d5b029

SHA256
d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e

SHA512
78a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b

Download Submit
/data/user/0/com.xianggou.qydjk/databases/hmdb-journal

Filesize
512B

MD5
14c16aea7a9e484b3925fdde93ea51d7

SHA1
7b184f650343c9d9511650540ebce58bac4de164

SHA256
9c4d1ef088d4045780d7803ed099d3c3b7b9ed7f3685902195a1f134aec69d75

SHA512
11837a05a0b87b1d3880e654fe00ac46f392756cb1e7f90efea76671321a938a6f940ba1e24b874f2814d8909c59411781ae90a9ba999794a1f7c8eb76a25a6e

Download Submit
/data/user/0/com.xianggou.qydjk/databases/hmdb-journal

Filesize
8KB

MD5
417c828419d225efc92078fb235c4ba3

SHA1
c0d70e4f44d210a00c6a52ea0ab52127fff8a72e

SHA256
21ac0f491bde373bd0d85b8216dcc9c8a6fbcefc83857b5d1dc8699fc54c6f82

SHA512
bf95e27bd51b0f02743acd90415ee4ed881a3b524d79a6bdca9f3b329f3ff96a1aadb2c7f29418fbd9fb132116c78e6b61ee95e3a97defd560032d9a6f7c4fa5

Download Submit
/data/user/0/com.xianggou.qydjk/databases/logdb.db

Filesize
36KB

MD5
a925951bbef27a9ea507f847a6ceaad7

SHA1
34b73ba1b11a2423198826f820fe87a1b8cc13b6

SHA256
1dd2d23b7c64bde28175205a16f99abac0aa5938d31812c095234defbd1f917b

SHA512
4ce18802068f8549fae1d3c594423476753deb776c57acf8ddbacb47360db50c922452db037b3c2d852f28147781c6532a141e9cfae51772b96958825e7ce5cf

Download Submit
/data/user/0/com.xianggou.qydjk/databases/logdb.db

Filesize
20KB

MD5
92ca04821e9fec0c7962d7eac91153a8

SHA1
cd8bf572ed05f21c68980ab7d3415a8770bf15e6

SHA256
35daed0cf9988f286003aa0d9f9660358271909898f69b56910d90b4e44bd9ec

SHA512
e4443d64520b05c64a980a5238872ecaa9dd13e13bfa85ce3b886d4c1802c204a9a60512a4b8778cc1c6f766ec918c96c3665166a0565a296c71ce070b0b046f

Download Submit
/data/user/0/com.xianggou.qydjk/databases/logdb.db

Filesize
36KB

MD5
3565a47c51d36161e23e969e572aaab0

SHA1
623cf5ba89b15c26c5e8430aae05164a4f1153d6

SHA256
9289b32ad16aad8e7e8a255cd4033ea6d0e64c09ef8c0a808038ba7b1f51c0e8

SHA512
e13e2a6a91aca8edeeda5bc319ee210c44f0c74277894b54c0627b19284fc37b6299817d2ff126cd1443b5bf6c300773adcc659b7943b14461b9ec3de93a0447

Download Submit
/data/user/0/com.xianggou.qydjk/databases/logdb.db-journal

Filesize
512B

MD5
985437271bf4e239a21a990e0d1843c4

SHA1
51376ab0cdbec5e8d5c436f0ccc682d131d57cb3

SHA256
ff7692c0dd807a9d4cfd44a3794e46b7106a567a26d7e75962881e7f53327639

SHA512
672448b41ee369ff6fe4bc673b341511f0b952a0aa4b285831b675c4d823ed0ad09a6b32d786998a45cc5fed6b4b12c293b1b88daaeed7695d99669ae6012245

Download Submit
/data/user/0/com.xianggou.qydjk/databases/logdb.db-journal

Filesize
8KB

MD5
388d0ae89ed7337fdd7464d3ebea1cb0

SHA1
83df5829c28554b7d06b5adc5ba40fd6e5ebc164

SHA256
e8212bb69de009e28b61a3726d0e027f88a1e40905bd792d44a9e38bb8360152

SHA512
77ae7d177977a55289e66b8b7ecb32358e2b3635632738e8796f804c390fc7d3f05caeb1c95af2060919bf381baae78075a86d19ae92f828a5bccd44486bddee

Download Submit
/data/user/0/com.xianggou.qydjk/databases/logdb.db-journal

Filesize
8KB

MD5
53501e1aa0148dfa58fb79a91c90bf69

SHA1
65168467b26b2d88bcb67b5f81e559f67848d1c6

SHA256
77b31fb01e7e9263aefac299e70eac3e557c1151d6097a8c1302f8250056ff2b

SHA512
25e9262880c12c255ad8356910cddad11b940afd4caa51dde98a2f5bdee5b24caf9927fb4ca6eeb4df5509d78835a4ab9391b4b94ca15bcea8563f5136f11f17

Download Submit
/data/user/0/com.xianggou.qydjk/databases/logdb.db-journal

Filesize
12KB

MD5
6d483a951f7a887002d62aaf7bc14001

SHA1
7a5a01d2f6bbe3f3abfc878ac82887f783bc1202

SHA256
1835bcaa904830b549b740da9b1504b3ab299f3952362c0b39265343a5a97b85

SHA512
04b0463e4112ecd2328d628b38a90392d3daad963ac276712121d122dd539c5903c4778d692c45927e472df9c8836201cb5193c3f4795667aee9649bb2f9f07d

Download Submit
/data/user/0/com.xianggou.qydjk/databases/logdb.db-journal

Filesize
12KB

MD5
c4b71bda1355b73148ea73942934f379

SHA1
53d8adbff93fb5b52184e33453e9aa9a8ec73217

SHA256
c6aec8858cb4123a18647d8a9ed67aeead5194f5ddf95d350d7ccc10bff8f1c7

SHA512
ed114e2cdaec0dae6aac8f37a7797ecd1cda88169e61b62336b909e7b4f46bbcb4b2d6fba9a65e0ce66c61a774d4e6da0f55f5519d2ba53f02d8ece980f7d2a4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads