e719ec213ba9e467a0adaefb31e12f95278b7c918540acd85a7fa87d6471410e

Analysis

max time kernel
47s
max time network
162s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
04/04/2024, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8c38dc92719aa9f4c6cb96fa9d6f278_JaffaCakes118.apk
Size

10.2MB
MD5

b8c38dc92719aa9f4c6cb96fa9d6f278
SHA1

8c5a65b080716cbfd791e8f5696e6c0185ec8031
SHA256

e719ec213ba9e467a0adaefb31e12f95278b7c918540acd85a7fa87d6471410e
SHA512

2e159faa3b02c03953a0a6d2ac18477128ccc63bb0613cf570b7d76057d3598c4a5ec4079436454c05ae7e532d98073889ece386c2fcb30f6ce40bb5ad504464
SSDEEP

196608:NFUsWLI4pJ+JTNP3K67jT00wRdYw2HPelNevZNy8p/uxCPDMdLG:bUsuI4OZNP3b7v0tuelsZNVtuxUDMdS

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xexostudio.sqpomofindyou/files/audience_network.dex	5044	com.xexostudio.sqpomofindyou
/data/user/0/com.xexostudio.sqpomofindyou/files/audience_network.dex	5044	com.xexostudio.sqpomofindyou

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.xexostudio.sqpomofindyou

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.xexostudio.sqpomofindyou

com.xexostudio.sqpomofindyou
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5044

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xexostudio.sqpomofindyou/databases/OneSignal.db

Filesize
52KB

MD5
5715efdd2d828d4d57c1376120ba2806

SHA1
06f279c976087695aaaf885df323d996a2560cc1

SHA256
f8ebc23104952761ccaf8dcf7ea9e5341bb0f3da744550a518f8dbc8b3404904

SHA512
dbc9dcea4f947dc61663054585dcc175b79ce7d69aaa8335754d1fe6d02881dadd75d3846190178e677e80efd63a1e364a31d51620d51e8e6254b8864651bb30

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/OneSignal.db-journal

Filesize
8KB

MD5
471b92a658bebb9d19a3ef55ff56e7cd

SHA1
a4dcb74284b10d81c884ae1cf180550f6b28ea65

SHA256
e6511868cfa9e971b4ff5f24b0bbf5fee0d5997b10efc993849514b2b79834be

SHA512
d3f881673ac51ace201b601112851183041d2b8e668caf244e1673cdac3f16fe2cfae635c88ff45a012880a2aba3dad24666438f5e3401cb320ff5f219433172

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/OneSignal.db-journal

Filesize
512B

MD5
4c9524483e5dc0f4e395416f44642ffd

SHA1
71a0cda9f7b88435a97edbf13b3da0b52f55c40d

SHA256
ccc294060d0cf46fd33e962277e54a4475eb84f3c9fb95bca2d60a0ba64986fe

SHA512
85d40cf53b54090996a1ce3657a331d2adf51e7364ea52e9c471b1618b3e8b7b8c22fbd306103883478a5d421f21845b69d16cbc2c0e8cb9ca9af89d76021cf8

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/OneSignal.db-journal

Filesize
8KB

MD5
9ecf1904f1e71944a56bf7fd3f891af2

SHA1
3c2633755ec4842ba0febc67b7e5db9b2a9417a9

SHA256
9cfafcb8d8edddcc7033ef196bddf9a213daef302cee9efae74b43c26c8cb764

SHA512
f1149653e5431ec9eecb63d055f7a8631aef2e4b03e9381d3a8c7200ff74b65603b532a38b5b86351259864f78a04f3fe0cb6afd0fa8e1a4264c1556b6c7b99f

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/androidx.work.workdb-journal

Filesize
512B

MD5
240939f0237c001a4472fd8843f120ec

SHA1
80642a522ed4878f9c06af624e6d0da52b2279c5

SHA256
5b01b69606e678f04bc198cbc839d3b256b5175a2053b8521a08d01937a2ef21

SHA512
02b62a02ece704b012c2400751f9f0bf9671cc473fbc60067972ac8e54ddb79579ae28980aef65f28699df5d2b862c53fb00f96661ea4a224f832de36d18c0e0

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/androidx.work.workdb-wal

Filesize
16KB

MD5
7f107b36f6aadcdbc87f10012394839c

SHA1
4be3c5c429e80f33db6757555761cac8d0109d28

SHA256
57d38ddf854ae600a36653adcdb7a87031ca3907454c520058b87884ddd15186

SHA512
505fb357d7046b5da9cf4826f641d8c03266563ed40af946492457468ff47502067bfd4a0976f225749afd5dfb735828b490015920c32f659554ca44388d2438

Download Submit
/data/data/com.xexostudio.sqpomofindyou/databases/androidx.work.workdb-wal

Filesize
88KB

MD5
92569fe5e3588d49ef8d61cbd85c0c22

SHA1
2d13dbf490f682865d80e8a69ba3537356feaa8a

SHA256
8b2bfdd0ac5c24f3352460feaee9acb8ca24cc95edd849713abc93526f007638

SHA512
554df09059ad5484bdd4aad250e39f8e6427dbc970ac37d481c540b1741472dc68c43ad9d8d56582e6696fb212008d885f7c3818f7dec79a5bd379e8d968e2ea

Download Submit
/data/data/com.xexostudio.sqpomofindyou/files/audience_network.dex

Filesize
3.1MB

MD5
af02dbf436efc92b63dad16a71acba33

SHA1
93fd330f83c76ed7967f320e6f6cd2bbb937efc9

SHA256
38c5c0584805386dfce413656c636c4e73a968ade86cabd7a4ecac4f034a842b

SHA512
a3c77f369abe214b27aba3b8e98def476e20790803db49e2d357cffd9c0ea063b246942f2556ad125aa2e6406a3edee4c7846893befa9d50e08dae849a4e95a3

Download Submit
/data/data/com.xexostudio.sqpomofindyou/no_backup/com.google.InstanceId.properties

Filesize
2KB

MD5
7885b7a92ac3379c79009b5bfb3b5b3b

SHA1
ea05b22d4d46af1a823e23d131e17c38b6cb4ce8

SHA256
dd3b5107e65d49855f60433f6208aba7d0a8ba9d5f24b2d9759fbced55c01100

SHA512
5dcb884d3334885843bd7fa20564a62dce87c0ac1eb6c53c3ef7e958c576cd80186dc6b4bce488acc0a097a79224788a22a2000bb4f5d32adf95fc4df8c59e21

Download Submit