9deaaf8a55a10f6ed0244f514fb8964d766fc102f4fd585ce6ac8343e96ae792

Analysis

max time kernel
116s
max time network
132s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
17/10/2024, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52b2bc237664e2803a4614819426db6a_JaffaCakes118.apk
Size 23.8MB
Sample241017-vb3nfaycnp
SHA256 9deaaf8a55a10f6ed0244f514fb8964d766fc102f4fd585ce6ac8343e96ae792
MD5 52b2bc237664e2803a4614819426db6a
SHA1 3a08fc2354454617bb9e52dbb987778c6b235620
SHA512 9e8de3946ae483137c413b3ae8c6a85ceb452e45e3ed0c169b820f83048e683ea1a331f04523a6508a28923380ed736f50c34e83c39607600d6474be0aec004d
SSDEEP 393216:FMp7Em4HDBbDP2yl8vdIbPBnF1HcIR4v4Os1rgnpHh+FJhlsxbjCTASe+oqNhZjf:S+zHlbDPIlIb5bc84SUR8PGxRF+oyz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dzqc.onlinecar/[email protected]	4936	com.dzqc.onlinecar

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.dzqc.onlinecar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dzqc.onlinecar

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dzqc.onlinecar

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dzqc.onlinecar

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.dzqc.onlinecar

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dzqc.onlinecar

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dzqc.onlinecar

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.dzqc.onlinecar

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.dzqc.onlinecar

com.dzqc.onlinecar
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4936

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

A3AEECD8.dex

Path /data/data/com.dzqc.onlinecar/.00000000000/A3AEECD8.dex
Size 63KB
SHA256 f0ead1ad60e0cc310c1a40685c28fc7a69aa346604552816c51dd3c1718a1e76
MD5 ed73a80eb949bacc52428b8d5a087fa5
SHA1 07e973549a2cee61ffeeb6439abc419cd8a489a9
SHA512 4bc26c18ca3a2edfe38ca1e14ad1e1415268b4a69cdff3c0f8e2b8fa910c67c2e4bc4f32c21274e586e8e139122ea3dbde7ec507c4722b4a9a778ee2598090b8
SSDEEP 768:2UJAegWguWxVIwIkH9nn3ETgu3kltfit3EnJF/+A2BCOjVDDHcLoqrTARuIZkMRy:geuNS+3EU8klt03EndkRDDHEMTQi1Gt
MD5 SHA1 SHA512 SSDEEP

Submit Download

A3AEECD8.dex

Path /data/data/com.dzqc.onlinecar/.00000000000/A3AEECD8.dex
Size 63KB
SHA256 3aa6caecfcd101531539147e01382bc530b4fdc61e98937d63cc4648793c6a45
MD5 5061e4948844f7d366972ac8005e9f13
SHA1 a2b79a1c79afb095ddebf0f16a1f9db64482bcaf
SHA512 223d18ce248912df18cdea3c8e864ea5e6ec058ca42cc5fde738188c54abcd260d7f24ac53d4987d3e32f4ae3e1e40e01354054d035bb100eef51b2d695f5299
SSDEEP 768:X3L4QVlsw4IC4KXosXYm7QjtLtDcHIQncDxfuAQuJ+jVuphag/yJ6Y3cIsPLb5zs:X77VX4gyYvJKbcDAFomW5z6GbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

029084aacbcf302b56b82bfaec05e040e516b8360581f16a5c117f17b8c4faf1.0.tmp

Path /data/data/com.dzqc.onlinecar/cache/image_manager_disk_cache/029084aacbcf302b56b82bfaec05e040e516b8360581f16a5c117f17b8c4faf1.0.tmp
Size 738B
SHA256 87df697e4be581653370f3edbce9e9e1683626757d8a92fa238efc53f83aeb53
MD5 e60bac8899c295c5949ef8a099912e5a
SHA1 9bbc9653775f7c6b022d971ca075572fb4d457de
SHA512 ae199d985a4e3ab3b52dd9708e747f7f5282adef41b669bbec35f7b8b91cb0f84722c9828b78697a29c977f8e5812eeb4e80828865ac160352dd05a5a7907b84
MD5 SHA1 SHA512

Submit Download

2ba2786b54693ec62ee87f79af8d26085204d7c5a188c458a91477b72c15ba74.0.tmp

Path /data/data/com.dzqc.onlinecar/cache/image_manager_disk_cache/2ba2786b54693ec62ee87f79af8d26085204d7c5a188c458a91477b72c15ba74.0.tmp
Size 929B
SHA256 7d2113f9b79149f9638051bce90073ddd40241be319d63ae46a3111d11ad5b3e
MD5 9ad200520574c2b2684f915ff65996ea
SHA1 d8a7bba16b4b4270cbe9b8e56c3964a5d6f85cd0
SHA512 8a331281ff69313e3fd9018f1a57d0493e678c90060ebf0460a2c869f4cf835675b78385142220c7ad24c426d0d57a9b79b85389513c4209d04d45e530c5f463
MD5 SHA1 SHA512

Submit Download

journal

Path /data/data/com.dzqc.onlinecar/cache/image_manager_disk_cache/journal
Size 323B
SHA256 dc20792315d32372376b884d29a9ee8022d196f58b2cd47c77a0aeb7ee480693
MD5 7fe257446b879e2cb1e9dc786e084e5d
SHA1 1dd7d7fbf826aa3554390fb31fb4a7b3275eaded
SHA512 36e58dc8e9df8d1b924fb90cc2aa43361648eca05407f788294798fad9a13a2451712c9d111a751f4fcbc2014ebbc9a4beb28721bced85e740137584525b8f5d
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /data/data/com.dzqc.onlinecar/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

libweexjsb.so

Path /data/data/com.dzqc.onlinecar/cache/weex/libs/weexjsb/x86/libweexjsb.so
Size 6KB
SHA256 fb993dc086feddf19af9700c7428386e3e4a5c67f273711c371ff4460a830ae9
MD5 9bb067cd33b490d30f2c88054c732574
SHA1 d95a11e2be5c7a1fab9820e34cdd9e482523ea86
SHA512 0b721c51332313c50ae466fff1b4bdb48a71791bca67ee83d2882a19e8abb59dc1406ed15d6dabbcd3ba922167fbf68a3828fd82edf4b2270ff0191b8fed0dbc
SSDEEP 96:Pte7X6Avunj6lSjbJcFN24ob+w+VfN24C:Pk7X6AvunmEbJA9U
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCStorage

Path /data/data/com.dzqc.onlinecar/databases/DCStorage
Size 28KB
SHA256 092aff7173a098e003519a0e323a77504c3ad14e1e6f1e6f34a1f8b33b548dc7
MD5 5b51e9050d8635c16173d8336222b556
SHA1 650b7ffdf8fecf1f8851bf3e607229f720e7a21e
SHA512 569c7416f7cb0ab251d6e7da948ff3793829a7bfa818558698c8aa628833a1ca5c1535e52fd8f36004e0876a881382235e40c596934723b3650cd57ee9d06034
SSDEEP 24:TLqlxWNGWOEIEqGeH3wTtGSiAOEE5SXr7tkGK7giygvH2yoenG:TyxK5PIEq5XwTYSZTrBTKJF26nG
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCStorage-journal

Path /data/data/com.dzqc.onlinecar/databases/DCStorage-journal
Size 512B
SHA256 3347f8b4d1d07955f8262e3f0b90ae8b67436b5db82595b79cc2d44d42887684
MD5 b3ae88106e1b7d6d98fbbe7decf1f0c8
SHA1 9efa5f615e9bd9b89d09ae87272a76f2ab39dc40
SHA512 25634a60547761384c4b6eff3039bf37a40ed728d898fc398598f5f06899d18034a26b337beb1b58e03bddfb335c73fd1a833e5661e6e28d3f5c86bb186039d3
MD5 SHA1 SHA512

Submit Download

DCStorage-journal

Path /data/data/com.dzqc.onlinecar/databases/DCStorage-journal
Size 8KB
SHA256 f6fe955ab00a83bcd187874e73b253f217ede189c877301be6c3251eadb89814
MD5 c106932fdc96210b4e58f30d1ce4cf37
SHA1 d66e8132742909abedb6fd830d611f9908b65d5e
SHA512 8c6d1fdc0f7268e0c9fd711ab6a3c34da857bf5a7cc4813e37aaf29acaadfe015e7d576b2307f9704d8a6e1962c81f240a752d610e33572832ff182bb5f34214
SSDEEP 6:7+/l93n10fg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKWEn:7+twqLiuWdwRmBEyPbm
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCStorage-journal

Path /data/data/com.dzqc.onlinecar/databases/DCStorage-journal
Size 8KB
SHA256 23b305192ca300b456f02c647001b4408d1d5fa7725b10a600b214028b876d5f
MD5 12b7927c02544982e13f1b136f2a7336
SHA1 d57a93b3e607267ee79377873c91185031c332ec
SHA512 43ddb40d0e7d01d3d0a5ad5c39e7a2221c63b3542288e1b62d9678302424261a6257e51f48958700c4b0a8cbf42a0ff2a89a56f17cfae69ff77cc46eed6358b7
SSDEEP 6:7+/l9pSYHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKyF/2:7+tOYvqLJdTRmBEyPbDN2
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCStorage-journal

Path /data/data/com.dzqc.onlinecar/databases/DCStorage-journal
Size 8KB
SHA256 ffac1558125e3a1bbce702c40f2a37b66d90b7cece321bcd64a2553b7a1d964e
MD5 ac0ded513ea3b57d614ed46dd82cc3ad
SHA1 459861b6ff2454179509cadd694cd41021b8025e
SHA512 08dde79bdfec347bdb1e09eb4a02bd6b1ce501854d37dc19abf4bf2d2192a87155d9824d15d75d64376150d1c617d10947fbbde5ab21760cc5321d1f6425e93c
SSDEEP 12:7+td0EnqLm+eluuOBGANAzFDAR48OFmHH3A1TA5RmBEyPbvZ/8:7+tjqL2lzOEIEqGeH3wTtGSvZE
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCStorage-journal

Path /data/data/com.dzqc.onlinecar/databases/DCStorage-journal
Size 12KB
SHA256 de8de7e5331fbdd72cf6f2ad7acb04e84f3aa9fc20251a5f261b84fafc2b99b7
MD5 9c373a34214cbbafe5464b1653490baa
SHA1 cfe48f2db269ac116a60e9ae06faae98f4b9be25
SHA512 8ca011260bf1bfd8ad9f5a711c4fe1c3190f758baa003b89fa572a4dd0b94e1c2f9322a5c7c99561e6cdb4a047f4ed9b65f3e1cdb98e2c73d67cfd277faaf831
SSDEEP 12:7+tbM/X/pqLEVEqIxWO6ANVANfCCANR48OFmXNANZANutuOBGANAzFDAR48OFmHO:7+tboqLEWqWNGWOEIEqGeH3wTtGSXB
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCStorage-journal

Path /data/data/com.dzqc.onlinecar/databases/DCStorage-journal
Size 12KB
SHA256 348bf650aceed933ca8c01b532f47e48d11421e2744f23080d2350b33c3d7c73
MD5 7b6142261bbed4171ce0c89f31eecb65
SHA1 8fc2a65399783ab78db7b2fe7cd3434029c928d5
SHA512 807e9579b3df600b9c77ec0aad270c805fe12af564852730738438175e47ce5119bffd8e3d5374eefbea7dfe71aea9e621794ce2c20c30f470ba84e414eed0b5
SSDEEP 48:7MOTrBTKJF28q2tK5PIEq5XwTYS+qaK5PIEq5XwTYSb:73gJF28LtAIEcwTB+hAIEcwTBb
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imei.txt

Path /data/data/com.dzqc.onlinecar/files/.imei.txt
Size 32B
SHA256 ffa1e98e5915222a2cd937c42bc25a07a5ee851bdd8efe22381bb896cbaf3000
MD5 30ed1042952fc864e061edd9c315570d
SHA1 e1a17a8100f99f75f03b806fad4ea65f6bca5221
SHA512 32cf07240f84e391399722bb9a28dcd12fed40edacae654e7a7e426d70a1b3f631200f8bd9aa613edfd0cb4dd0331a20872763bcb2a95fab2b755427c1b55032
MD5 SHA1 SHA512

Submit Download

eje3cnc

Path /data/data/com.dzqc.onlinecar/files/cnc3ejE6/eje3cnc
Size 35B
SHA256 dc3f98a33c26c2796dc294b354831fd5ca9796295f4cb38479c80b145d4807db
MD5 762298b93820a5cd8b6d8ec469078f7f
SHA1 d5b02a2ff3b235cd2b61ceff53a1d88b8984477d
SHA512 70f864211ce16679d0538abf9b7071d27c2d22ae458e32409d20065032c762dd186307ef33ede90abd9ac794a4ced8b163404e9799c05f0c515337249684311e
MD5 SHA1 SHA512

Submit Download

dso_deps

Path /data/data/com.dzqc.onlinecar/lib-main/dso_deps
Size 288B
SHA256 461abed9d700797b53011b398dad0ae2e0b820367532605af2693f15080c57e2
MD5 8fb758a85d1ff2067d3cfb45af69085e
SHA1 13885d2784016e461503da42ec477edf9d24f840
SHA512 459075e3758ab987c282bf9a18f031219dbaca56857db0f8f3173d528c6a427cc4202bf1a58f7cd0198c54466fcf0cfd1c8a664074d1fc791d4cdb22b7c9490c
MD5 SHA1 SHA512

Submit Download

dso_manifest

Path /data/data/com.dzqc.onlinecar/lib-main/dso_manifest
Size 5B
SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
MD5 c06857e9ea338f3f3a24bb78f8fbdf6f
SHA1 c5a0a2529d2deb60fec041b4fbd722a2ebe31702
SHA512 29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1
MD5 SHA1 SHA512

Submit Download

dso_state

Path /data/data/com.dzqc.onlinecar/lib-main/dso_state
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

dso_state

Path /data/data/com.dzqc.onlinecar/lib-main/dso_state
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

test_app

Path /data/data/com.dzqc.onlinecar/shared_prefs_ext/test_app
Size 29B
SHA256 bc6793cd3a27e8eec087a7bc1103f2520bf8363ea35f65323b6c6f6aaae7cd63
MD5 25af73b05fe0be27a97884396b9a28ed
SHA1 1bcbef32db416c93cc76847bfae6c5629081db28
SHA512 a11e4406cc6364201d8de016a97cd8f7c9c5d36214924fb9fe6d397b4c0a97d8f20fe738157e8e406b1057f2f51fd3e3391e0a58b40d5af85aaf873819484ce3
MD5 SHA1 SHA512

Submit Download

1729183811759

Path /storage/emulated/0/Android/data/com.dzqc.onlinecar/apps/__UNI__1EA8A8A/temp/1729183811759
Size 276KB
SHA256 71d9751de72b3055780ad4f684213f0d2d1d8c2f0d7da9fe8be5c13d78798138
MD5 20421b49354c0219ae47ce4d7a553913
SHA1 a6a88fb84172458d57f0b15601531d006680fa19
SHA512 abb2b517aea1bc0a5dba132dfc25b5fbf82a892ae452cd678c7b0ba3096e34afd3c1554b5f147565a96ce20b020c845a2d2da3848ee2eb7dcd4a74b7241f5993
SSDEEP 3072:0bWT2vRJwOobpbRXwRhkySNjTnEpO2iI8RbcwOUdntHCGX:iE4R/S5nEpKmpgXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads