Overview

overview

8

Static

static

6

4b6a78e4a1...18.apk

android-9-x86

8

4b6a78e4a1...18.apk

android-10-x64

8

dump.apk

android-9-x86

1

dump.apk

android-10-x64

1

dump.apk

android-11-x64

1

Analysis

  • max time kernel
    129s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    16/10/2024, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4b6a78e4a1f19d9574305de4efb7fdc0_JaffaCakes118.apk
  • Size 6.8MB
  • Sample241016-e7ecqaxbmj
  • SHA256 f6b7a5bd7150c1515bda3807036c6d4ca7838e1ad58d71624b85c53ff1a3cb3b
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bankercollectiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    evasion
  • Checks known Qemu files. 1 TTPs 6 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

    evasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about active data network 1 TTPs 2 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
    impact
  • Checks CPU information 2 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.qihoo.appstore
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4973
  • com.qihoo.daemon
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:5011
  • com.qihoo.appstore:critical
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5212

Network

        MITRE ATT&CK Mobile v15

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1603

        Persistence

        Event Triggered Execution

        1
        T1624

        Broadcast Receivers

        1
        T1624.001

        Foreground Persistence

        1
        T1541

        Scheduled Task/Job

        1
        T1603

        Privilege Escalation

        Defense Evasion

        Download New Code at Runtime

        1
        T1407

        Execution Guardrails

        1
        T1627

        Geofencing

        1
        T1627.001

        Foreground Persistence

        1
        T1541

        Virtualization/Sandbox Evasion

        3
        T1633

        System Checks

        3
        T1633.001

        Credential Access

        Discovery

        Location Tracking

        1
        T1430

        Process Discovery

        1
        T1424

        Software Discovery

        1
        T1418

        Security Software Discovery

        1
        T1418.001

        System Information Discovery

        3
        T1426

        System Network Configuration Discovery

        2
        T1422

        System Network Connections Discovery

        3
        T1421

        Lateral Movement

        Collection

        Location Tracking

        1
        T1430

        Stored Application Data

        1
        T1409

        Command and Control

        Exfiltration

        Impact

        Data Encrypted for Impact

        1
        T1471

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        360appstoreInstallHistory.db
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db
        • Size 28KB
        • SHA256 c48a18c175de831a21353fb0bdf0d3e43b83ba7655982152df5cf0100b2bf37b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360appstoreInstallHistory.db
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db
        • Size 28KB
        • SHA256 442847f7a12c988f83a674323cd5da163d5ec79152b658abe27baafbf70935c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360appstoreInstallHistory.db-journal
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
        • Size 512B
        • SHA256 c068404c445c39fd5991c5fb1b91658a1051d4cfc0cb87f213fe4255571c20b8
        • MD5 SHA1 SHA512
        Submit Download

        360appstoreInstallHistory.db-journal
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
        • Size 8KB
        • SHA256 d9576f07b858427067862f9bcdbab3138f2087cf8bf1d2fe6e6c413ae22edc61
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360appstoreInstallHistory.db-journal
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
        • Size 8KB
        • SHA256 0e743f3d49a10632c0db69dcf3afe4495d85459d916b295221dbf1fc8d297f5a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        360appstoreInstallHistory.db-journal
        • Path /data/data/com.qihoo.appstore/databases/360appstoreInstallHistory.db-journal
        • Size 12KB
        • SHA256 69401a692034593492ee1bb5be9aaeb424e2ce22b7f8fc5bdfffb92972387136
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ire
        • Path /data/data/com.qihoo.appstore/databases/_ire
        • Size 12KB
        • SHA256 a9b2f6227429fd83edc4db9e62c5e3f8c45b55598f7b10c3132d6b339283c8d2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ire-journal
        • Path /data/data/com.qihoo.appstore/databases/_ire-journal
        • Size 512B
        • SHA256 26640b9307607f06541237fe9002996fb845f0c558b48de0a81671c64efbf441
        • MD5 SHA1 SHA512
        Submit Download

        _ire-journal
        • Path /data/data/com.qihoo.appstore/databases/_ire-journal
        • Size 8KB
        • SHA256 07524fb2a7e3aa6133667e2e74ff9c7dd6ff317e138291af8530c6d597953135
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ire-journal
        • Path /data/data/com.qihoo.appstore/databases/_ire-journal
        • Size 4KB
        • SHA256 6355e682ec7cd234ce630d6e6e75e35e4a98fcbf83e1a6b4bd1ea0a8fab29b0a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        account.db
        • Path /data/data/com.qihoo.appstore/databases/account.db
        • Size 28KB
        • SHA256 ae606221ff789289e1c69cd9f79ee035d1c587a96d556ad8ac6ee91fe6741041
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        account.db-journal
        • Path /data/data/com.qihoo.appstore/databases/account.db-journal
        • Size 512B
        • SHA256 922fc6b1d73c6776aab0b13ac002012720ab77094d31adac6372709fb6d35b68
        • MD5 SHA1 SHA512
        Submit Download

        account.db-journal
        • Path /data/data/com.qihoo.appstore/databases/account.db-journal
        • Size 8KB
        • SHA256 c39a135417a246f7a169d1eb39bcdc6ca4e65c449005ebf42d2c0fd82f0706ed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        account.db-journal
        • Path /data/data/com.qihoo.appstore/databases/account.db-journal
        • Size 8KB
        • SHA256 cbb040f47cfb6ea7cba30d2ce2962b6adbfbcb507808270d5fe6c3fbdf57d328
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        download5.db
        • Path /data/data/com.qihoo.appstore/databases/download5.db
        • Size 20KB
        • SHA256 d3ac468ba80900c4780701925d0a9b119be2317ba08a41b5c7084965195d56ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        download5.db-journal
        • Path /data/data/com.qihoo.appstore/databases/download5.db-journal
        • Size 512B
        • SHA256 d8a4342a419f27a669138677569f690a907f39bb0552f8fd0a9ffd2937304075
        • MD5 SHA1 SHA512
        Submit Download

        download5.db-journal
        • Path /data/data/com.qihoo.appstore/databases/download5.db-journal
        • Size 8KB
        • SHA256 84063a7173f5c4f9d47402c10d4335f4fe5f18167cce87d075230ee4d3d236ed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        download5.db-journal
        • Path /data/data/com.qihoo.appstore/databases/download5.db-journal
        • Size 8KB
        • SHA256 46b399c38c5ff8f9cfe37650a8d652cedd9962047231c318b44571b5c15fd2bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        filelist.db
        • Path /data/data/com.qihoo.appstore/databases/filelist.db
        • Size 20KB
        • SHA256 c06f78f9bebb11def742bbab2c0746fd24e863da44f888107e5c9104b5e54315
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        filelist.db-journal
        • Path /data/data/com.qihoo.appstore/databases/filelist.db-journal
        • Size 512B
        • SHA256 88d93659d755a7f55025bf133bf4bb5aae381a755cb835a27de27a2aa8b14e2c
        • MD5 SHA1 SHA512
        Submit Download

        filelist.db-journal
        • Path /data/data/com.qihoo.appstore/databases/filelist.db-journal
        • Size 8KB
        • SHA256 453834c126955675d7ecf767c0bb776fa64cb4ef532096347e7e9cd0fd225e00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        filelist.db-journal
        • Path /data/data/com.qihoo.appstore/databases/filelist.db-journal
        • Size 8KB
        • SHA256 db9069431db75ac89f1dae8c2692e14363c295852c02d590c232b91912d3d37d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
        • Size 12KB
        • SHA256 885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
        • Size 20KB
        • SHA256 ec21c5db01d91ef738a7d990bcd11337bae4b475d9127eb5675657c68e881676
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db
        • Size 16KB
        • SHA256 c7f6ba4fe586c85516bbefb4e5702ce81e8b5b573f413fc5304f38f2dab69c3f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db-journal
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
        • Size 512B
        • SHA256 2b73d15f341da270588db62a93c9a49b812c089c7606d503218f4ce95e5b9787
        • MD5 SHA1 SHA512
        Submit Download

        ignoreupdate_appinfo.db-journal
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
        • Size 8KB
        • SHA256 e505f378c44815deee627160437c370c07f80a6f8371bf3238a2d5dc8c815098
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db-journal
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
        • Size 8KB
        • SHA256 d7bd55913d85750e8c92e3843ef32816ad7c30e3aeabf5f954f2aee800005a67
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db-journal
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
        • Size 4KB
        • SHA256 43d9fcb6ffbc379043767214a414ed982575868c7012da3b0f1e936945734ebf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ignoreupdate_appinfo.db-journal
        • Path /data/data/com.qihoo.appstore/databases/ignoreupdate_appinfo.db-journal
        • Size 8KB
        • SHA256 915525c7870583177bfff641c7968bd2c1e5094aa30b000e7acfe210a5fb3144
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        new_downloads.db-journal
        • Path /data/data/com.qihoo.appstore/databases/new_downloads.db-journal
        • Size 512B
        • SHA256 52f81bcbd4887f2062afc0071eb267c2dd0b902e43dd8bf45a29e61e19a1d0c2
        • MD5 SHA1 SHA512
        Submit Download

        new_downloads.db-journal
        • Path /data/data/com.qihoo.appstore/databases/new_downloads.db-journal
        • Size 8KB
        • SHA256 5321e6302e47b6d6f2376dba0789acbe258dd313bec16703de4bb48911021a8f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        update_history.db
        • Path /data/data/com.qihoo.appstore/databases/update_history.db
        • Size 20KB
        • SHA256 fc8213a10a4907987570701d47828767ffd9517ac55111519fb6c909b015ec7f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        update_history.db-journal
        • Path /data/data/com.qihoo.appstore/databases/update_history.db-journal
        • Size 512B
        • SHA256 032b1043c0b956b80c1ef5629e91b240d0cc755a2b83b00296e76dba398fd25c
        • MD5 SHA1 SHA512
        Submit Download

        update_history.db-journal
        • Path /data/data/com.qihoo.appstore/databases/update_history.db-journal
        • Size 8KB
        • SHA256 cd2ce4fa8cbf149dc469d7d9b7b6f32987aeb44863710538d80fd0e329aac89e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        update_history.db-journal
        • Path /data/data/com.qihoo.appstore/databases/update_history.db-journal
        • Size 8KB
        • SHA256 78ac8f03fec7a9a2aa5e284e6300974c447fb51f6f6888b20048b424bf845651
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 512B
        • SHA256 75c4e978e386c4539e04f0f418a6bc409e5271f4f8befcb445220536c7125ab7
        • MD5 SHA1 SHA512
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 520B
        • SHA256 af4b150f2eb38492e0b4d715488b0b2e3aaec18446b09adf25df051d67766863
        • MD5 SHA1 SHA512
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 540B
        • SHA256 60ce8102a4b1171f75cbcca02404c263ba49758b989290cc51fb3c02835b6453
        • MD5 SHA1 SHA512
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 1005B
        • SHA256 3e00d8b7cb9dd90647d2007924d9bb371cd9ff1fcc812954c7b641a3ed4795bc
        • MD5 SHA1 SHA512
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 1KB
        • SHA256 c110773560c99663a7cf8e4501f16adcf1d49c52f97174f2a1a11a322d54b005
        • MD5 SHA1 SHA512
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 1KB
        • SHA256 4baee0130e06b7c5be3176094656a2e01556cbb87616b76c185a366b403b8ff5
        • MD5 SHA1 SHA512
        Submit Download

        Y29tLnFpaG9vLmFwcHN0b3Jl
        • Path /data/data/com.qihoo.appstore/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
        • Size 1KB
        • SHA256 88669ed3bb7c1b01efcc0698aa976d15f2bacd48abab46fb64b5b532b6ec1dd6
        • MD5 SHA1 SHA512
        Submit Download

        log1729053295192
        • Path /data/data/com.qihoo.appstore/files/sllak/logcache/log1729053295192
        • Size 2KB
        • SHA256 4c8f6c5e85e61f7f8aef0301b5a7dd8da2f9fb4cae228039bf656f7b0fa147eb
        • MD5 SHA1 SHA512
        Submit Download

        log1729053295263
        • Path /data/data/com.qihoo.appstore/files/sllak/logcache/log1729053295263
        • Size 596B
        • SHA256 7d980897c9132e245336c5b2c57ec699514b6c8f669ee432fdaf6fe0ce985531
        • MD5 SHA1 SHA512
        Submit Download

        finalcore.jar
        • Path /data/data/com.qihoo.appstore/files/sllak/opt/4973/finalcore.jar
        • Size 77KB
        • SHA256 4e988b4d9bae530786b4ae34bce5d43453fa172da0cb71594b9faf1f8c82640e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        finalcore.jar.tmp
        • Path /data/data/com.qihoo.appstore/files/sllak/opt/4973/finalcore.jar.tmp
        • Size 77KB
        • SHA256 7d7ada76ea057847b5c47ed0f16a6d0e52cdbebbbdb08c1a9519acf70a1a4107
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        finalcore.jar.cur.prof
        • Path /data/data/com.qihoo.appstore/files/sllak/opt/4973/oat/finalcore.jar.cur.prof
        • Size 537B
        • SHA256 3c9a025a7ab7f81730b1dc6c2923d43a684d690c24d34de9995c72cf4e3a5b3d
        • MD5 SHA1 SHA512
        Submit Download

        localApkInfo.json
        • Path /data/data/com.qihoo.appstore/localApkInfo.json
        • Size 94KB
        • SHA256 e5107811134a610349539ed641ecd1d73dc51282bc4c642bf18acbc24874b952
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        finalcore.jar
        • Path /data/user/0/com.qihoo.appstore/files/sllak/opt/4973/finalcore.jar
        • Size 176KB
        • SHA256 536678202267f95d80480f15065e784d7ec609922a0963d935e9c5a4b0f62bef
        • MD5 SHA1 SHA512 SSDEEP
        Download

        .sfp
        • Path /storage/emulated/0/.sfp/.sfp
        • Size 83B
        • SHA256 587a27818cacfc69a103def6ca24d64ca016fd7c8a6960dd78a4ac2898071fc0
        • MD5 SHA1 SHA512
        Submit Download