Analysis

  • max time kernel
    127s
  • max time network
    135s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    15/10/2024, 19:53

General

  • Target

    49b6a9d41ad910ac3ac75bb575a2524a_JaffaCakes118.apk

  • Size

    16.8MB

  • MD5

    49b6a9d41ad910ac3ac75bb575a2524a

  • SHA1

    b55bca9c73f8c227659614451860d166b3959c80

  • SHA256

    f790883eb84f8b1f2b6fa833fd210f3ad3ed849833f1537368b284e99f262228

  • SHA512

    69fade94a8753036fb075f869870486feea7bff6305e3541f54708ca4f234a23f7d2b509e0caddbff3f338db5f08849e95b2bfc68df4c0837975cdda48176909

  • SSDEEP

    393216:XOQx/2lO+TGjkb3uy2yu9j6trqxfzSisfapRwqPu5C:XOq/2lB+NlUrSaaRu5C

Malware Config

Signatures

Processes

  • com.yuzhua.jjtf
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4248
    • /system/bin/sh -c getprop
      2⤵
        PID:4284
      • getprop
        2⤵
          PID:4284

      Network

            MITRE ATT&CK Mobile v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /data/data/com.yuzhua.jjtf/app_crashrecord/1002

              Filesize

              225B

              MD5

              1fa9e98018e16104be73aa9d342164c3

              SHA1

              5a9ab4bd62ffec714a414829e0774a88f97e4a6f

              SHA256

              e9773394ca2f3395bc1a7e489021f59362c1bac4623188ff74fd253f42f14377

              SHA512

              4f034adb3dcda2f1616ead524921edc6c2a2327f260a0be8215f6a6d59c6cb968e4ed4ed4a84fc5d0b3ff36a1cbd4091f4a98c9089029ff89811cf5c06dbcde4

            • /data/data/com.yuzhua.jjtf/app_crashrecord/1004

              Filesize

              225B

              MD5

              66d535316c7cc9b28b60d8a934fc6b9c

              SHA1

              bf0e6d52c03d8ae49219ad160487ee8f0c128e9e

              SHA256

              9c126f0c0d667ee0ad7d3eb479e40f0ff41d1a188a4da4ed2eda564a5a70b0be

              SHA512

              36dc4b7ff9331e27a7a9fe1f2509cf5d53cb86e3a896cafa37899a57b734670c54169590b045580d62dd1313010e89f341f96d42e22770a0bf8f7ce3a0e5f76a

            • /data/data/com.yuzhua.jjtf/app_crashrecord/1004

              Filesize

              58B

              MD5

              0d210bfb2a0e1f1b4c082a6a0f79de07

              SHA1

              bb8ed9e364db79d1d9f2fcde3f15091893222faa

              SHA256

              988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

              SHA512

              536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

            • /data/data/com.yuzhua.jjtf/databases/bugly_db_

              Filesize

              4KB

              MD5

              f2b4b0190b9f384ca885f0c8c9b14700

              SHA1

              934ff2646757b5b6e7f20f6a0aa76c7f995d9361

              SHA256

              0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

              SHA512

              ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

            • /data/data/com.yuzhua.jjtf/databases/bugly_db_-journal

              Filesize

              512B

              MD5

              466df2db1711c163dc0e7c231847a883

              SHA1

              4436f338d2d5741b1c4f8df71aa84e41a7805a78

              SHA256

              1a359c1c55fdacbfb6f0699afe1d0f1f5e1640a2b9b55055fb5a55045f6a6765

              SHA512

              17f00e61101e5972ad0837ffe9ee99a2b5176f01f6ba5366666d105a0b4ea08b4cc725bdf49adb56b6e273a2200c5d3ffeaf055451c57022f39477a7e5143e57

            • /data/data/com.yuzhua.jjtf/databases/bugly_db_-shm

              Filesize

              32KB

              MD5

              bb7df04e1b0a2570657527a7e108ae23

              SHA1

              5188431849b4613152fd7bdba6a3ff0a4fd6424b

              SHA256

              c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

              SHA512

              768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

            • /data/data/com.yuzhua.jjtf/databases/bugly_db_-wal

              Filesize

              72KB

              MD5

              65aeb19ed367359065a887eb8edd73be

              SHA1

              37813bb79d663c1bc203b4c1cc3175639f05c90d

              SHA256

              ebfdffb0cf5b729ce26543f65702a86a015bda77489d7c75860d16349a9967cb

              SHA512

              27c90a8c34fab8c6a1247e6ee7def8ecf8c86d2fb7996220e7db60bd183085970cd769a209fab7e2e0ac7acbe661fc5638a4af01e25eae926cb7cf8ab7874492

            • /data/data/com.yuzhua.jjtf/databases/cc/cc.db

              Filesize

              36KB

              MD5

              5d7ea1a23af19b4340cc8d90f28297d5

              SHA1

              4cfe95b23a9e98378d69c4290af81b51fbe76aea

              SHA256

              474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da

              SHA512

              33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

            • /data/data/com.yuzhua.jjtf/databases/cc/cc.db

              Filesize

              36KB

              MD5

              ce6135aa1b1fe4f2c2db2a546d2a5558

              SHA1

              79b59582154017aadab783dc266fcb158c252940

              SHA256

              7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c

              SHA512

              2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

            • /data/data/com.yuzhua.jjtf/databases/cc/cc.db-journal

              Filesize

              512B

              MD5

              ab447e4e371fdfdb5712fa39b0d4896c

              SHA1

              52101604be6d6e28c83e77a3f470d3a5d3b1491e

              SHA256

              67745370c45ac2140912e3e112190a5ea9eb9385183df65932a68df5bf07dbac

              SHA512

              0fb0c2c8dd9ee0ed8a7f228991a63715f1599907184e83539e70015ac214db4d16abe32a2349909495210567f05bfa4efba9855b92a50516a0d9a1d5f195d17b

            • /data/data/com.yuzhua.jjtf/databases/cc/cc.db-wal

              Filesize

              48KB

              MD5

              5b2560a04d0f0cd26ed97aa3e28f2ddf

              SHA1

              7b44cb1e00573024b542f3ce35a1d3b68b0088c6

              SHA256

              521135b17b83aced5205a646036a6c56d4368ebbf487a948865aa8270dc4d969

              SHA512

              08bb63b2ae4e8c3e01afcb63b39dd5eb64c2c715548ed7157c1131f1f6933a4a6ec8a7669ee7fc955e261df1d685582a9f2d05f2b654eda9ba366f6743965a39

            • /data/data/com.yuzhua.jjtf/databases/cc/cc.db-wal

              Filesize

              16KB

              MD5

              9b649d891803b765faa12cf6ccb9f839

              SHA1

              20ebc1b4477470dc5f739096743aecdb94f07c88

              SHA256

              f87f002330bc7541292f78f7dd946145d8ff401e1c32a981b44b5422fd17f733

              SHA512

              38e672b04fd83245b58a35e468c83b7dc663a9beeaee7729f0daefa053cdc3d35f183c6c54691dfd00f1d5ad99f3dc5b22f18e404d70fe50874db5447ab54395

            • /data/data/com.yuzhua.jjtf/databases/okgo_server.db

              Filesize

              24KB

              MD5

              2e60a8ab0b7ef4889e09af34ff80e134

              SHA1

              d601ff5601bfd256a5b2a53d53019c58fe7b6726

              SHA256

              e0a6df61ec00a2986bc500aaae290fb9af4b77213ff10537ddb61e86b9a63a0e

              SHA512

              269ff57285515972b97c40d71899876f6fb6a46959ac7d17baa01ec83ee246c2cb44a87409d0c32ed829f69336a8757700f24335709d2ced7332c0bfc0f23397

            • /data/data/com.yuzhua.jjtf/databases/okgo_server.db-journal

              Filesize

              512B

              MD5

              df80ec5edc549045b07cc8dad2098807

              SHA1

              96ccb02210925f4eda742bc617d9449703031a19

              SHA256

              bcd0d0ad6b105f249426a879092bbd8c98dcadb0d96070cab9f54b7d55259ac8

              SHA512

              7ce1cde8e12023199238df0b43c206b660b17675674b2dd75c949a6b081e8ba86d1d95379fde5c98eb6cf1f905fe4397659248b0c9e72fbc8fea7da8472ef1a4

            • /data/data/com.yuzhua.jjtf/databases/okgo_server.db-wal

              Filesize

              36KB

              MD5

              8b35ad946120d42343314410284738b5

              SHA1

              a7e99b0083017f7583cc3d46bfdf437844f43b83

              SHA256

              c1f6ccfb437bc646c96df139fe84454beb34c75780f2b7d9547b2b2d33c53294

              SHA512

              aad91cae255ae37a173af139698a327000594327144d10e53c8250ec9ad3cbb20383ff4badbb89336f973ad08a70a64e556c23331f536ada1588d7b157f6919c

            • /data/data/com.yuzhua.jjtf/databases/ua.db

              Filesize

              32KB

              MD5

              fa8c100e9755807fb5aff651c68a6850

              SHA1

              7433db0eda300deb5b545b3a8c27bb26882874ed

              SHA256

              a7c4b57025cae106072bb0a8ee5ee3c818c9a3c19f055a0df34aa85b2c6fd821

              SHA512

              c1917cf9da10bb0a9e3647ac5ae92e3f0d97ab0ec216bdd3475a11c4b36a50d12219c0a8e72037fe41bd429c40d0b2c8d5e45285128bb14cc4bf10f33fa88a7b

            • /data/data/com.yuzhua.jjtf/databases/ua.db

              Filesize

              32KB

              MD5

              d604a3bf1f8d992cc320ea5b1f7609bd

              SHA1

              247f88df0b55c7d523ea5398637711a0e4a483a4

              SHA256

              329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17

              SHA512

              67e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab

            • /data/data/com.yuzhua.jjtf/databases/ua.db-journal

              Filesize

              512B

              MD5

              3ef49499bbd2b8444c85cf12990b9e7a

              SHA1

              a72a34f18822b0a6f2b3f387b1f0c3b91e8ae921

              SHA256

              e0177e7b95ad69f54faa323e8e069e644b7b8c9f6aeaf460f66e4189fd231704

              SHA512

              ae2230b45962a577fa3a298dca5fddb4f8da00cfd41dfdda58d09fce4c5712ea5c15e443a9cec663e222aa0839b2fb808b2b8de4bd8c9be1bd3affcc808600bd

            • /data/data/com.yuzhua.jjtf/databases/ua.db-wal

              Filesize

              56KB

              MD5

              0f8a95dce95a613095179b0841af1a06

              SHA1

              87b480b3af190092b50d5b410752cd4183cd1152

              SHA256

              9d78a46247db67ea0876c44cceaecfa6d82f7982fc372cc11a02c81505f66d53

              SHA512

              67f29ec8dc5bdfdacf61f306c4b4f3ba36199e0eba0e860fffdde771dbc1a1837b03de86023fd68e4de533daf346035ff88fe73ae45bbb8e353573e2d067b92b

            • /data/data/com.yuzhua.jjtf/databases/ua.db-wal

              Filesize

              8KB

              MD5

              25d89d06ea8c3357fccc9409de8c9973

              SHA1

              dd41d588e6db494403674ba94c21650de98ca266

              SHA256

              40b6193fb4521fd929736ffdf4422511183476e7dcc5d02b34cb54b72ff70d0f

              SHA512

              e2e29642edaab2c9871cb373fe231863aa597f01b3f634ad6029a18e9ee11ff348b6d3563ed1720e7a4397b6704dd05d01aab9bc6fb3c540123d632dc27b4983

            • /data/data/com.yuzhua.jjtf/files/.um/um_cache_1729022154873.env

              Filesize

              1KB

              MD5

              326bfd939aeba8d8a1e692703ec22daa

              SHA1

              0b626f5aa3ccfa1d4ecd1cf844f72e7743f62eea

              SHA256

              344f96ed62e5fde7a7cd87a50d5c6d9ea26df06718c0888fbd2bdedcffc84ae5

              SHA512

              9762baf37a86041eafe572d9f2278e762d7f363b76cbc9e752cf50b1447af7b2020d36bb29399d8a894fdba4e528f32320ec38bbce40ff1d142cf05ffa7d0f3b

            • /data/data/com.yuzhua.jjtf/files/.umeng/exchangeIdentity.json

              Filesize

              162B

              MD5

              768cd6e12b86e8f7d093bc03b97d67fe

              SHA1

              d787c991c065b9e983fa9fc59146bdb43724359c

              SHA256

              f3733e3a4b198fffb054840a97aa2d58db9ee7c6a77198920d5798b5f08158b7

              SHA512

              30ed3e39eab17ad902911588852796aea1ee19a4b04452cf4bd6996d8c67f1a68ad928760fc72637297e1fe082238bcf32d237330ad6d0af71a6028cc0678520

            • /data/data/com.yuzhua.jjtf/files/com.tencent.open.config.json.1107734485

              Filesize

              1KB

              MD5

              f526172de1566b34fdcea744710d9559

              SHA1

              000cb54d9a008a807a1c5a3fd2b2e7cb41e7939d

              SHA256

              8572be02b59f4d514000939ec04a9b4e2380c55265256b724a617d8d0f4c6940

              SHA512

              dc81f0fe345b18c96b1638c67b9ef4c5e60059dfc4a02f3c30a23645d4847abeef46cf467d044c42597115c48052ce0e8ea24328382114a544c5dfd039a95e7d

            • /data/data/com.yuzhua.jjtf/files/exid.dat

              Filesize

              67B

              MD5

              afc9f338760d25d591b748f65ddc4cf5

              SHA1

              38d349bc6feb4fe62d21321d9935f19aa09d4491

              SHA256

              3dd12d8d824505fced0b6374dc6b13d9768ed6e5aed11718e6c1d6af5e27089c

              SHA512

              5bee2a02f5ebc587fcd3024c334c8e65539ba3dc9a0f9f822ee3892ac42368680c75fe03decd87ddf13ce945321a6a8273787ed0666df5608a4c1b5bda7d8851

            • /data/data/com.yuzhua.jjtf/files/umeng_it.cache

              Filesize

              496B

              MD5

              f7d868a8b639a5c165f98846c626295b

              SHA1

              0e2735409d8d8d8ccb877c7794430a73cfc240fd

              SHA256

              b80cc6087757da6065c1b77c39ecf5a4d673ddf9ad43e30d1631bf3a5c68d87a

              SHA512

              21e66dabb093902f981f5022e789ab5f8ed18492c7784aeb8ad7d4de5fa1f856345c046475531bf75f48bd4d6149d8e3b6f8f5a42a3bcec4630b9e90acf7ae77

            • /storage/emulated/0/.DataStorage/ContextData.xml

              Filesize

              111B

              MD5

              2a2694ea303837bb40b90c7d7b0f710e

              SHA1

              a48684def863d6d2f4748f49daf24efa1c550cfa

              SHA256

              689e83a9cc59109fb536c619fc808a4dd66f7db907ba69bf1ad8e7548a1ea446

              SHA512

              a11bcc6acec14882710e00162031e9ee105ec924b143d1d9a2e8ac2b64f7e884c9583f7ab399bc9e4d549f356868a9b47588586d53a5115f5d78a8b59ea9a033

            • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

              Filesize

              65B

              MD5

              9781ca003f10f8d0c9c1945b63fdca7f

              SHA1

              4156cf5dc8d71dbab734d25e5e1598b37a5456f4

              SHA256

              3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

              SHA512

              25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

            • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

              Filesize

              111B

              MD5

              67255f49f76ea52177f0c773f0add684

              SHA1

              22c1d90b2d2140e8c969b305988ac43fa12c957a

              SHA256

              20961ee3f63d1ac88373fed43fe4ad58713b62063da6da39512d5fe831e8e249

              SHA512

              447dd19c6a62a56d46497848fd590d8529f7f3aa4a5548cc2bb8070da388b90e01613221e28bc607fc126657564576efebd173150a05115502af37062dc9a204

            • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

              Filesize

              381B

              MD5

              dba6d7c19d24fa04ab508555432b60b4

              SHA1

              61720a26745a30dccceb73dccf9f83a4d9d6d845

              SHA256

              8fe4ef3235632a708d5397177053dce640035b37cb41c2699998dab9f65acf1b

              SHA512

              f477c3ddbdf5bd46c21b5896cc877bc450d3d4a50fb0cb74c71eebe9d9c3fda33475b3a34e3758fa82f7088e5f6f56b4249b7a6befb9554099f3420a45187af1

            • /storage/emulated/0/Android/data/com.yuzhua.jjtf/files/tbslog/tbslog.txt

              Filesize

              1KB

              MD5

              9273ea1de18c6e961222457452751392

              SHA1

              9b182666b5b926fd952b219dcb7ff04cfa89f3fd

              SHA256

              385a05d69ab3c6a2f6dd48b00b7efc8770dcdeec94ec90e15600d25ed4ecbae9

              SHA512

              c3dccac9029673358cf15e414062c0c7fcac09802db6cfd42878c88f82a3ec74c0613c03e9df6336f9e784715fca0f88ff2c6f345a90b0dcbf0bfc38095f19d8