49f11bd41c035f01e8a730b8c7fc0a575e03e894622e7ff669f855bf6177e4de

Analysis

max time kernel
47s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
20/10/2024, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
600744419dd1bbead983683e4be13d97_JaffaCakes118.apk
Size 2.2MB
Sample241020-dft4esxapl
SHA256 49f11bd41c035f01e8a730b8c7fc0a575e03e894622e7ff669f855bf6177e4de
MD5 600744419dd1bbead983683e4be13d97
SHA1 61e4c8ab612e32b425b632e208219a6216a5e88d
SHA512 5ada05dd16af8cef7053188e85e86f7214259169920cb1a2b1d4457cf62c3871ccc598e49ce6dbabf333c24d2a869bcc73965647698879ea2c6e068a0ad06144
SSDEEP 49152:I8k+4d+ejlmqXHrO/R6rWTGr+OBQD8ZetiwdRh+3/:I3Djlb7a6rlFQAIUyI3/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion persistence

Malware Config

Signatures

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	lqh.china.ppl2

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	lqh.china.ppl2

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	lqh.china.ppl2

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	lqh.china.ppl2

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	lqh.china.ppl2

lqh.china.ppl2
1⤵
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4217
- ip addr show dummy0
  2⤵
  PID:4309
- ip addr show ifb0
  2⤵
  PID:4335
- ip addr show rmnet0
  2⤵
  PID:4357
- ip addr show usb0
  2⤵
  PID:4380
- ip addr show dummy0
  2⤵
  PID:4425
- ip addr show ifb0
  2⤵
  PID:4444
- ip addr show rmnet0
  2⤵
  PID:4463
- ip addr show usb0
  2⤵
  PID:4483

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lbs_temp

Path /data/data/lqh.china.ppl2/files/lbs_temp
Size 401B
SHA256 36b1ede8c4e165e561455bc1b22bafa41315884fcd8f80b6f6220d39289b3ee6
MD5 9abfdd94b3c4228a6d0cbd9ace9fccab
SHA1 d829597a27ea0468c002b8759764bb7117334e66
SHA512 c8f4536b0d96366f3520b8513861571cd2dedbb697a89d76a9fdbd28b826338abe2f5993dece2e3734f1cc91d1f6ff9161c28745ca64933696679068a683fd9a
MD5 SHA1 SHA512

Submit Download

lbs_temp

Path /data/data/lqh.china.ppl2/files/lbs_temp
Size 401B
SHA256 614a2e9928cc9e57bd9e3ee680bf6ee972b0603996e13393fd84f757121aff12
MD5 e931e45fabd490a6b6c279ee040ef015
SHA1 ea50cd2991b5947e18778fe111c4396c96e7c2f9
SHA512 f7611bd1dd96d9f4c7ed02657e42397a8ba6a0da0397b6fd4267b0b1fc212b86b5a66fa0a2dfd07271c9c64295f8924a5a6b3506e40beb1be9fca542e6f67130
MD5 SHA1 SHA512

Submit Download

mobwin_location

Path /storage/emulated/0/Tencent/MobWIN/mobwin_location
Size 116B
SHA256 327d2c01e9591fcfa0516cdb3afb491472b6e5fd19905bbd7d5a0420a939d403
MD5 2b106d376c61d643f61f37d7ff09324a
SHA1 6c56b5fd2ea2b46c23957ac167f76099d7ebae8d
SHA512 c65a6aa3b6ba1ec040aa49d8bad02afd4cf7173f17f0db5fbe24c4fc1f539f9480fa71a364df7a0d558e107ce4d4fcc390785a10fc8fd2bb2500f720fc32301f
MD5 SHA1 SHA512

Submit Download

mobwin_location

Path /storage/emulated/0/Tencent/MobWIN/mobwin_location
Size 157B
SHA256 aa4d4aa05f8a2a2b9d84339a33b1150cc371ebcdda6772d3e8188e1974f68a0f
MD5 350ae2af11afcf993b865bbcb91b1558
SHA1 75c52508cc487aec1e8ceb9fdf064c4bd578990a
SHA512 ff1e1a21624c7cbb3a973b019cf82fab8e590ba4df28263cc8807d013ca3b8bed9b828ce45396bcf8687d4a87d07c88709c7766c0599486d352793713353db67
MD5 SHA1 SHA512

Submit Download

mobwin_location

Path /storage/emulated/0/Tencent/MobWIN/mobwin_location
Size 157B
SHA256 b4dbef3f52f1ef39d553f28ae8e2a899215ae876221bee8c60d1dee81a359db5
MD5 eba726c2ee7cdc88bdb23867abb44da3
SHA1 df2cf8f87c3281d7b80e30270067d53bb9e8d6a7
SHA512 a9c3e653d7b3a9ddb6f164251542531d6bdb7703460eeaa5b6ee54dafd327e513c041708043aa604a50f43547c021ef032ba27b3331d4a9d46c48c10a3e303e1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads