2e1b8114df213891ce40976074a1eb9b27ec5ec0238b0da260665d61c27bee21

Analysis

max time kernel
139s
max time network
155s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
31/10/2024, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8274468d22e1ef4b5923635a2f627f0c_JaffaCakes118.apk
Size

9.0MB
MD5

8274468d22e1ef4b5923635a2f627f0c
SHA1

9a32426f57847ca149ec4d1370f5617d924f81c3
SHA256

2e1b8114df213891ce40976074a1eb9b27ec5ec0238b0da260665d61c27bee21
SHA512

31972867b73a0026fa1722336ebb3cd48465510ac436f4cf2c415bf13846f1b8653712087c5f7ef7d3619bb78cac327a3c866aaa87fb8d1aeaaf43b619962730
SSDEEP

196608:TcDnJfzHVvafvZ7Q/N7dkmnuKp1D7L/REgUcCMsiYYUPEIVQ:YDJDVSfvZU/ddvusDvRKcCMW3PEIVQ

Score

7^/10

discovery impact persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.funshion.video.mobile
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.funshion.video.mobile:funshionnotification
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.funshion.video.mobile:funshionnotification

Queries information about active data network 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.funshion.video.mobile
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.funshion.video.mobile:funshionnotification
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.funshion.video.mobile:funshionnotification

Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.funshion.video.mobile
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.funshion.video.mobile:funshionnotification
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.funshion.video.mobile:funshionnotification

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.funshion.video.mobile

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.funshion.video.mobile

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.funshion.video.mobile

com.funshion.video.mobile
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4246

com.funshion.video.mobile:funshionnotification
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4323

com.funshion.video.mobile:funshionnotification
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4396

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.funshion.video.mobile/databases/_ire-journal

Filesize
512B

MD5
7c284f9a7204a1f752c0c8c7e96283ad

SHA1
a16812929c4fc394d1c675ba9a9394a05f4d3963

SHA256
a2bcdc8a8d56f3e4f696dfdabb6b0c1cde9cc4a063c4df8e5a59ebbef43cc475

SHA512
98327517c24115b729b2778797c3dda24ae7e68067c5642aa89e76a062301db1c2ebbd130a955310d44a9e547322b7a39435911def1dda5c6a01ed8fcbfd58af

Download Submit
/data/data/com.funshion.video.mobile/databases/_ire-wal

Filesize
20KB

MD5
ec23d1e270c1b5c0a8ad3af8f9a7e434

SHA1
d0afe8b880189fa0b9763022d48b8ed189f90eef

SHA256
59e430aad5304086491d1918cdcb4a05e465a37b3829f0aed38e8461e3894c38

SHA512
8d4d0f4513b519c4cb80c0a6c4f6882d5fde41b52c144cc82c51ae974cd6994902658d90033306b4048bf0525d47b678fb463a1ae03b39cb796a6d9ab81cbba1

Download Submit
/data/data/com.funshion.video.mobile/databases/funshion.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.funshion.video.mobile/databases/funshion.db-journal

Filesize
512B

MD5
bdaa84b7fb343452f1dcc0020fca195a

SHA1
de184e6fd618dee6f97e05201fd5ac6d7aa7eecd

SHA256
4fe2e9a1127c6a995b53abe9bb7c7b66d108ee1cbe95a4805aa1477a4dd4f1f1

SHA512
dae66543346ef2783f156807360a7ad818c525db5fffe42637c22ca75b57282c9f54df06d344952dc2fb8ef1ad0aa4a583832bd620a1e765f65a077b0f381d8f

Download Submit
/data/data/com.funshion.video.mobile/databases/funshion.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.funshion.video.mobile/databases/funshion.db-wal

Filesize
72KB

MD5
ee8a2b7c1e628a7e259b7a6b67af18e7

SHA1
0fc4da0945946fadddfd08f76d681953e6cb5b32

SHA256
02646ddc764f6396ed63f07a48f93055747efd45e45738ea068d3af8d470230c

SHA512
48ca668a3475fa771c6c091bd46b9a931a516d313d5e50d8de8eb5a4986335d67a7c1ab723052db308587bfd591db6ee130ca67d57db058c80411e2328c170cd

Download Submit
/storage/emulated/0/.fudid

Filesize
127B

MD5
50996e8983d6a1a05a7d348a1fe4a44e

SHA1
187071ed59929463292340e620dc80547a65c761

SHA256
afe95bd5f62445342f7c6d1a7117f54646e0d34b1fdd8094e6ac6f85f91c8b31

SHA512
cf0122e80c059fc276761b467aad54c6f1bd49fae1eb7d9454b5d772bb5dfd86b0ae93499a8bac07a21171e13d80ce98b8745df262cbff29d5ce0b7f89217fb9

Download Submit
/storage/emulated/0/funshion/cache/img/aimg/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/storage/emulated/0/funshion/config/funshion.ini

Filesize
211B

MD5
26f6f16ef1442c406a624687474ae97a

SHA1
5a0d35df4d9c17605417bd743dc776324797fd2a

SHA256
bdd6cfbfd6ea77b04550a599fdcd25671690a997ae13f83db9f04ceb3a01a238

SHA512
c044f569c64ba852d2aaed650e422c888f945d68e75891c126d4e1539a6f45a40a8a69dc0ca74a061821781e3e590b3449e67fc0d95a520c42a27df0bd4c4c51

Download Submit
/storage/emulated/0/funshion/log/funshion_aphone_2.2.5.3_020000000000_20241031.log

Filesize
293B

MD5
c3324d2ba6fa2b676f9aacd038674962

SHA1
a8faa214b59252acc0f19bf250ee8a206802f118

SHA256
e8163e577e94ebf6ca7b23c74fcd03c4c9af9eaececdd70ee8e04b07bfca75b0

SHA512
5e7efa79e5ca0907276fa34b2e6b241f93e08e4a6ddb5a0250ebb910d78ca2685b2a30b863bb04e86bfc4622f46cfc7a9f484d677b281731add2941b690c4b47

Download Submit
/storage/emulated/0/funshion/log/funshion_aphone_2.2.5.3_020000000000_20241031.log

Filesize
3KB

MD5
1a65e1abb2fa8596be22282a68ab8005

SHA1
d076f5938350af68c96fbeb23c25d00c0fdbe4f1

SHA256
50dee08ac183beaeb97911df65f2c5b9bba00a1d341f3b6499eae753e0401479

SHA512
ab1e5e1db978f3304a928fd284f8cad8ac054a12ce6cd42891b00e424a34c31a89d3813d24998b93d3e7a741b74f4973b7f6e6d22d1c9904c4f51af08aeecea5

Download Submit
/storage/emulated/0/funshion/log/funshion_aphone_2.2.5.3_020000000000_20241031.log

Filesize
3KB

MD5
f9aa8120d682e8013d5e505d76b7fc99

SHA1
8fc54e2c38e9270eb8b57a310357ebc6298e3c62

SHA256
c8e951015b3e45dda226be0fd7667dd03feaf0f72d568048d6d7fb1fbb0533a5

SHA512
54b6a7cf9aba2787e7b27c732930297bbbe9938c566bf231f1499d54fda4e084f2c50efcf7994db508ce42cf1466622c74b812d9364c4c46af71b5d9a24dbb69

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads