6bbc21ce72f5765bdda74e66cda0eb2be946455c86a1a54b9ddf43a6d469465a

Analysis

max time kernel
149s
max time network
142s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
20/10/2024, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6063f57e280ab06d1987a9132b60489a_JaffaCakes118.apk
Size 3.8MB
Sample241020-e8kk5azara
SHA256 6bbc21ce72f5765bdda74e66cda0eb2be946455c86a1a54b9ddf43a6d469465a
MD5 6063f57e280ab06d1987a9132b60489a
SHA1 5c8d4b0847639ef089bdb9a745ed39f1a3ddb32e
SHA512 77d1b0e9eeaed9be5a45d51671aed8cb0738b78f47ae80c47f3d823a6f70f7506ecccd012e368a36fd311e86b3e24e4901f9ec0f725a93ba26b6170f058de6da
SSDEEP 98304:p3qqU7KZHdycV+XgrS2nuwVIwhNizX6TnGI:YtQHdp7lIwh476TGI
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.felink.foregroundpaper.yaolian

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.felink.foregroundpaper.yaolian

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.felink.foregroundpaper.yaolian

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.felink.foregroundpaper.yaolian

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.felink.foregroundpaper.yaolian

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.felink.foregroundpaper.yaolian

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.felink.foregroundpaper.yaolian

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.felink.foregroundpaper.yaolian

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.felink.foregroundpaper.yaolian

com.felink.foregroundpaper.yaolian
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4630

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

91analytics_v4.db

Path /data/user/0/com.felink.foregroundpaper.yaolian/databases/91analytics_v4.db
Size 36KB
SHA256 28bce7851c630721ab666d2cdbeedf8b27aed5f6d70f3eb33a33c58704fea801
MD5 d2df40c28cfc7d2a318982ecb38a2d23
SHA1 f046a9141c57ee0642a04c7f2a4b8d2fa0cf2d9f
SHA512 fad1f7a040915ac65cbd8d201796f1e97ea64c7e6b283384bf89c6b446bc272c72839ee6da8d50adb5fbcc5eb718b4b5d1a0769406af648541a18bf0df8896c1
SSDEEP 24:TLsD9h3IW1HV1iy1ueKBcWsSejesKxpXBvclBnhVGSP/1:TID9hYW71iIXS6ctMBneSP/1
MD5 SHA1 SHA512 SSDEEP

Submit Download

91analytics_v4.db

Path /data/user/0/com.felink.foregroundpaper.yaolian/databases/91analytics_v4.db
Size 40KB
SHA256 f116b7d7971124fc4aebd4be5bc533169f12abb2491804201fe7c8cf4684c613
MD5 29f909caad59c8ca003d67b4087b2d6e
SHA1 706457650854189cc7cbeaf0f759959d5fb742d9
SHA512 49ce1ffcf604042caca081f2bcfb4be1dca328e28d35ec1cfed76402e79e1e3a9346d6f7bfbc91416f7930e930b0c7aa7a84467278219391b94ac87f3980d59e
SSDEEP 24:TLcD9h3IW1HV1iy1ueKBcWsSejesKxpXBvclBnhVGSvGQQQQQ:T4D9hYW71iIXS6ctMBneS
MD5 SHA1 SHA512 SSDEEP

Submit Download

91analytics_v4.db-journal

Path /data/user/0/com.felink.foregroundpaper.yaolian/databases/91analytics_v4.db-journal
Size 12KB
SHA256 be5e1d5f3441eec42171e763895115cbb70a760ac757cfb6b989de5f2b5c5a69
MD5 a824d52c6ff013a88f5aa1db515fa610
SHA1 5dd24a123ca49f8889bfae99922ed5027d998f8f
SHA512 ff83164d1a48c3367ba00c87f9fc61769552f059bf0fd6bde471b33ea99b55e529faed490dcf5e32c5bb6277bb999b730efea0aae43ba24b62e37b87993c4975
SSDEEP 24:7+tOZvqLcD9h3IW1HV1iy1ueKBcWsSejesKxpXBvclBnhVGSqcn:7MO5q4D9hYW71iIXS6ctMBneSqc
MD5 SHA1 SHA512 SSDEEP

Submit Download

91analytics_v4.db-journal

Path /data/user/0/com.felink.foregroundpaper.yaolian/databases/91analytics_v4.db-journal
Size 512B
SHA256 7b05f2ce29709a19cb9dd5d77c013f62fd3d5c76810106a1e2b2e079ce2fdbde
MD5 77edb96d6260dcf7a53f1046a09a8e35
SHA1 60ce6cffbcb93c10ff2fac069e1bc3bf14d71537
SHA512 89ff382e1686f9ca9231b725db59cd87eed346fa1db1ff9320a17108d1db0af8f3b6640d961a4f19e20d6c5f1c7f11a163dff0bf631120ea71e3bcca9b4364b5
MD5 SHA1 SHA512

Submit Download

91analytics_v4.db-journal

Path /data/user/0/com.felink.foregroundpaper.yaolian/databases/91analytics_v4.db-journal
Size 8KB
SHA256 32ecd6256045267acb86d7a53ea68b518dc9a835fbe1d31a76e746b164b5d711
MD5 f262329bc3467eb52193e3e25397e518
SHA1 aa2b8289888836d1b7db3e1f64e19fdf01a828cc
SHA512 c6d736ff605c94ceab0b43c38715808b91c2534efcd5174cc05e1ed14cf72dedd916435a10b7a62b0aa92b71440c725ac375b51f471a73a68ef5bf0a87d8c1cd
SSDEEP 6:7+/l9txn1Eg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK2i:7+tkqLiuWdYRmBEyPbHi
MD5 SHA1 SHA512 SSDEEP

Submit Download

91analytics_v4.db-journal

Path /data/user/0/com.felink.foregroundpaper.yaolian/databases/91analytics_v4.db-journal
Size 8KB
SHA256 c9dd1a5c106882614818fed8225d1f95143c2fdb98fed637f42129746874d795
MD5 e1eb30b50aa3a824a8e174a9bd052e5b
SHA1 4ec56cda73725d1a9a43288eb9eb714963244f5f
SHA512 36b9bedc6bd786c7a5912eb8c76f78d7782ec0733ee3363d6a6122e8a572fee710a00d08e164e10eb3946800945fba8b270983da5680084b510301da87b8c3aa
SSDEEP 6:7+/l9rXPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKwUK//on:7+tJ/qLJdeWRmBEyPbPXo
MD5 SHA1 SHA512 SSDEEP

Submit Download

channel.ini

Path /data/user/0/com.felink.foregroundpaper.yaolian/files/channel.ini
Size 32B
SHA256 0d480abf4e3538ec8b4f3ce757a118abfcc29ef62592bf3cfe13d21c8efefb5a
MD5 75967c957802d72a85235c4e877c8aa7
SHA1 904bf955001f2bad221bbc7872d83bbafec6eaff
SHA512 9071e0d171e6d4bf326c0e210cbceb1be156c2cf92b025dc5495507ccbbe152f196c33afb7f42284dc7cae21d76fd7d9f9143c7e96e07e9a4e59ea257e9ee4e8
MD5 SHA1 SHA512

Submit Download

version_meta

Path /data/user/0/com.felink.foregroundpaper.yaolian/files/storage/version_meta
Size 128B
SHA256 a17a81dedd66f1c1634077474b5eec95dc4e20343abbc851c75b9c7b1ad02f34
MD5 b5ff571c4e75467b43bec2cd2a33c481
SHA1 e5e2b9c611c939a878b76027e0456e7b46047dee
SHA512 7101be3805db8b81feb5698dde939f1b1ae3c52ec2e3596650fc7a8979e02a2c8fee304ca4c1928884b04d7d47b33ecb2cd35d3fa6f4cc0b9d1913f40f67235c
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /storage/emulated/0/Felink_Foregroundpaper/com.felink.foregroundpaper.yaolian/Cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

1.jpg

Path /storage/emulated/0/Felink_Foregroundpaper/com.felink.foregroundpaper.yaolian/Default/1.jpg
Size 128KB
SHA256 01ae1cde9a3fe71f4c69c6a49577764535c1adc8c6d0eb7c6919abe839c93a23
MD5 049af215d0527750509e5dd284240868
SHA1 08b701e0c4bea0440eafffb9cc653ce3871d250a
SHA512 28535ed24baa4b5d7c7b9d9ea91446f934e4320b0998cb79d6630965a78b5a7554c459ddf3bc4a131e65ec49671960991acfb469b779e08c9d4507f2f4c89e49
SSDEEP 3072:+q8LDMu5F/2FQn0H4/tbQoGuxx8N7IqNIxXbn8t:+qsDMS/2zH41bFGu6IaIBn8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

1_thumb.jpg

Path /storage/emulated/0/Felink_Foregroundpaper/com.felink.foregroundpaper.yaolian/Default/1_thumb.jpg
Size 56KB
SHA256 b77e103144fbf2d6c74cce483f3b3c95998f1d893655833293be5485e779c8ca
MD5 99f085046bb57a213b7401e613b0ede3
SHA1 d6984edab521c26cdb5693ad8a0037e8586f1845
SHA512 066ebcfa500a913d9d6479edc507df601135a1abda0f61043deba0e05950947d8feedd4c04a8646dd930c63b7a34de8afcf11744c6209834057912990ce7bcdd
SSDEEP 768:/yKjBwgR56B0Z8fpLQsqR+AxaXqzzP3si2wNPb0GReQfSAxG08mw1pCJKWImbG7Y:/y4BBKGAXqzzPJL7RlDD+cBImbYKt7
MD5 SHA1 SHA512 SSDEEP

Submit Download

2.jpg

Path /storage/emulated/0/Felink_Foregroundpaper/com.felink.foregroundpaper.yaolian/Default/2.jpg
Size 163KB
SHA256 25b4ec0ee76513bf0dd2c51e9b3bb305effb0049380c5256df14015ad0691144
MD5 d4143a505c8e5acb3f069bbfc1662a71
SHA1 d6bf82c8430f51711902f9287154b4095cb0337b
SHA512 7f6e6f913298537f0bda3261ad737985e128c8b94365b4fc9bfa6b497ed2d333af47bda88051512e65eaedecc1c33884a3b6475e05d5537895d405887b49101a
SSDEEP 3072:xv3Gh1/7ZEE4HBjiK68bQCUm0jZ6WYWarYcrEvtqQp4TCbUIi:xv3Gh16E4HkKzbQCjLWYNrrrUtqk4jn
MD5 SHA1 SHA512 SSDEEP

Submit Download

2_thumb.jpg

Path /storage/emulated/0/Felink_Foregroundpaper/com.felink.foregroundpaper.yaolian/Default/2_thumb.jpg
Size 70KB
SHA256 8653cc2c2746bacad2fba5962a2179e715e33b4421eb3b98d0dcf05cd9cb98d9
MD5 b805eb5f8ba1e7f8f3855a3d05ef0d23
SHA1 5ce33643bb4a971759fecb9ac41612f8d4f17b97
SHA512 2c671ba8c6771992354154ce55679afe83f927cc9a9dfac09fa017522c127bcb98b3105926783aaa41da231958d11d5dd1f9f6b4d67da0d93d6d6dfd6255879a
SSDEEP 1536:1xbmxGXDJYCo7hO5WBV+R+dKxIJlm0R+u8k11kekps1:zbmxGXD2JEYBAgdKcR+nU+e71
MD5 SHA1 SHA512 SSDEEP

Submit Download

3.jpg

Path /storage/emulated/0/Felink_Foregroundpaper/com.felink.foregroundpaper.yaolian/Default/3.jpg
Size 160KB
SHA256 7a67a7100889f848904d7ec7d25a43d0a407d107357f61aa37185f3ad4f0acd6
MD5 da218360561c63a6c31b6165eb0f46c1
SHA1 dd730f9964897c031311174f7584f24c85e1070a
SHA512 2ee05d7d51060991491ca8266b5b44d444870b4cdab17b99c22f9e1d42006cf064fe56b39d716a23628bcde5f1ea9ba90e3718e1aee8b1dc51cf0e0bd49dae41
SSDEEP 3072:4nlYEM87/lxXvTPmktGs/R3L3TciVgg+mFTorz0RaZaMVAqrkvg:4nlYEMy/T/TeivomFTo8ELVd5
MD5 SHA1 SHA512 SSDEEP

Submit Download

3_thumb.jpg

Path /storage/emulated/0/Felink_Foregroundpaper/com.felink.foregroundpaper.yaolian/Default/3_thumb.jpg
Size 68KB
SHA256 38de8b417e8ce61e693427515d66cc5c0e7dd8020c2eaa8726fd8cc5789f42cd
MD5 f066cb3a8a913e3d7d96f90172eb6c7e
SHA1 3e945b83693538d2cb2197d29a78d3e645de647e
SHA512 06c7c9cda7b1c5b872570f2ad07bd21d14723bd94a9ba04b8a0f2ff891e085eca88f84b8d3455ed8fda99afa086e8f3c720a159548ab659b4049cdbf94d666a7
SSDEEP 1536:HX2XmuLJsiynWYYM6sGVLvlAMp8hDQ8aCsVpE2g11U:32xPcWHhvGm2Ql9fgA
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path /storage/emulated/0/Felink_Foregroundpaper/com.felink.foregroundpaper.yaolian/com.felink.foregraound.paper/LOG
Size 53B
SHA256 a04b4c29e4230368a3ff1c2a0d7ae8a9ebc8e8879d3bb772048b2643440db9ff
MD5 9dc6d60e3a8a23716769ff74a32c6a86
SHA1 0162057ef14b010df5799c821e02e0510e0a4196
SHA512 91bd033c88505e6a19c2a9b9827ea5ac6663e1d8246bf6ec739c69ab921091a05b456f1c6eb11bd07dbc3d1333232d6c70c4a0e83b4e073f3870807fe2b3a48a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads