Analysis
-
max time kernel
171s -
max time network
188s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
24-05-2024 08:53
Static task
static1
Behavioral task
behavioral1
Sample
6df3810ea9deffad9a44bd182b10aa3d_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
dynamic1111.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral3
Sample
dynamic1111.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral4
Sample
dynamic1111.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
6df3810ea9deffad9a44bd182b10aa3d_JaffaCakes118.apk
-
Size
25.6MB
-
MD5
6df3810ea9deffad9a44bd182b10aa3d
-
SHA1
d3fffcf9f67832337ed45f5995063d3e7554803b
-
SHA256
7d50ec7aa69d2e85ac7c963c14adeca97fb8be548788f9f8ddd6a0175780f5bc
-
SHA512
100fb05851fd903f108384965a92b41bb848c66e3962e1ecd41b563478ab2d3a687e9d72edcea8d07b037ee8b5e0149138637a63ccb0bae1963c211f6b3f4b38
-
SSDEEP
393216:ZXeo4CYT7IwG81UpSimXEVD/yWKJypOd5Jk4SCFX/KwkMROxYyOkvpjCX+FVAENg:ZXzo7pGT/mUVFaPWMPKxMI3A62EN4x
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
Processes:
com.pplive.androidphoneioc process /system/app/Superuser.apk com.pplive.androidphone /system/bin/su com.pplive.androidphone /system/xbin/su com.pplive.androidphone -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Requests cell location 2 TTPs 2 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.pplive.androidphonedescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.pplive.androidphone Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.pplive.androidphone -
Checks Android system properties for emulator presence. 1 TTPs 2 IoCs
Processes:
com.pplive.androidphonecom.pplive.androidphone:remotedescription ioc process Accessed system property key: ro.product.model com.pplive.androidphone Accessed system property key: ro.product.model com.pplive.androidphone:remote -
Checks CPU information 2 TTPs 2 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.pplive.androidphonecom.pplive.androidphone:remotedescription ioc process File opened for read /proc/cpuinfo com.pplive.androidphone File opened for read /proc/cpuinfo com.pplive.androidphone:remote -
Checks memory information 2 TTPs 2 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.pplive.androidphonecom.pplive.androidphone:remotedescription ioc process File opened for read /proc/meminfo com.pplive.androidphone File opened for read /proc/meminfo com.pplive.androidphone:remote -
Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.pplive.androidphone:remotecom.pplive.androidphonedescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.pplive.androidphone:remote Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.pplive.androidphone -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
com.pplive.androidphonedescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults com.pplive.androidphone -
Queries the mobile country code (MCC) 1 TTPs 2 IoCs
Processes:
com.pplive.androidphonecom.pplive.androidphone:remotedescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.pplive.androidphone Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.pplive.androidphone:remote -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
Processes:
com.pplive.androidphonecom.pplive.androidphone:remotedescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.pplive.androidphone Framework service call android.app.IActivityManager.registerReceiver com.pplive.androidphone:remote -
Acquires the wake lock 2 IoCs
Processes:
com.pplive.androidphonecom.pplive.androidphone:remotedescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.pplive.androidphone Framework service call android.os.IPowerManager.acquireWakeLock com.pplive.androidphone:remote -
Checks if the internet connection is available 1 TTPs 2 IoCs
Processes:
com.pplive.androidphonecom.pplive.androidphone:remotedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.pplive.androidphone Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.pplive.androidphone:remote -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
Processes:
flow ioc 31 alog.umeng.com -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
Processes:
com.pplive.androidphonecom.pplive.androidphone:remotedescription ioc process Framework API call javax.crypto.Cipher.doFinal com.pplive.androidphone Framework API call javax.crypto.Cipher.doFinal com.pplive.androidphone:remote
Processes
-
com.pplive.androidphone1⤵
- Checks if the Android device is rooted.
- Requests cell location
- Checks Android system properties for emulator presence.
- Checks CPU information
- Checks memory information
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4309 -
cat /sys/class/net/wlan0/address2⤵PID:4515
-
-
com.pplive.androidphone:remote1⤵
- Checks Android system properties for emulator presence.
- Checks CPU information
- Checks memory information
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4753
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
3System Checks
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5f7bdfe2278bc9ff37288d6fe9451d4c7
SHA13f171bd786db4ae7d298979b827f84bae889e00d
SHA25646858d287a8db0ff2113dc3647e8b24cf184a9926958923a71a58307fd4260fe
SHA5124fcf882a87d6e87e3bdcc54885133fed4041c842271fa386b879a6cdddb874f31f7e4c74ff7a41247fa263971759ebc5d00e61d5c3ec9318ba1ad902cecdf516
-
Filesize
3KB
MD589642a7546ae84dfa082dc7b6ba039d4
SHA1c7d4caf2849132a819127c85614dd21326543fde
SHA256209b9ab09f3467075b2b82d5ef0a95bfe19af4c49cf95206cc299d14e5d03f64
SHA512585d198ac55563e58818b7ef3edda50f8f556a3045f6e923ce4291783fb6d1203bccb5a4273ac46cb1f5df8af4d251d7aad873369da1ce342c51314a599cd004
-
Filesize
443B
MD5b51e93309b233c5417395f3b181f14a6
SHA14a51391186e0d662f32a79bf3856c4d6eb91e935
SHA256ed13e4d87ef6b87b92b356a979232c240614b6a7e375393d30f13e9cd0f3a74b
SHA5121fe89a61e0f05d4c7875fa26390bbe07a41e2a3aae8194d5f9679711fa6f4aee0ecf46623a461780762d73363e27138a9acad617e723e2b1664813efb2c6490e
-
Filesize
4KB
MD586b0935ec9a078a1c953527fc6caad9c
SHA19015509e7d2135216ce70febe3f59ad04a3399d7
SHA2565b66dc53fa92249a564059f69b20d9e1e9e1f46c2045bedc338e8f248e8d1b1c
SHA512fb66a7e0e90859f993029e3cbc0a687004a5cf0923951a4d0ac2db2084175a5a7e0ca22251fb189f89a61051b339168b34e1d9c337589e3f25ecd68c7f36dbae
-
Filesize
185B
MD58063fd77fa14610fc4db725bab9f3f06
SHA1e0a3f9e9a95262383b6c76462b670663711b9a11
SHA2560f2a3c531486537b5ac0a69151640276c64bc57ad370063296237aa896fa8fbb
SHA5121a469c238a872f5d6244395ba0ad6fb4f98f99ceec0aacc97ac0b847c893b66caea3a88ef64e3018ffc67b8258061344c7bd6e28dc6f57ad4278112b65361c59
-
Filesize
6KB
MD5393680eca6e0d678b8e14daae438e61e
SHA16d97a7317ef56604c627b230fd2aa920be35ed32
SHA2567773bec038bd13264ee6836065556095eb75dfd2f51f0dc71d3e70e317599f29
SHA51221a8ca69e80a7a0b52f471d98bd52b2b11b274fb60848cacf1e1fe09dac6914c26e020363ce25567303ac14e2895475d48f36a5c1fde00b8e95e3e815146b4da
-
Filesize
12KB
MD53fe30614d7e0d11db870b4624f6c50e0
SHA1053ff0fc621ab40f2afeddb3e7b4a73ee41ec533
SHA25667c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d
SHA512c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae
-
Filesize
512B
MD5ba6ec61127c8a669f7fec237cd76686f
SHA11e0130ca75f7736cdaafbdff802b31144b11fb6d
SHA2568d32aafd0e7c732e199ded30e511e7dd7d912b53a1974aeeaefd3456262777cc
SHA512849f98e70d40a3eefdfc6a3329b84ba8f69950a923c66089c8787a7c5c2d344e842e166adcfa835d87b640680c0471c7cafe5e5e127a67eefdb72129827bf059
-
Filesize
16KB
MD51fd08fd84942b3592dad96ea6cfee6ac
SHA1b9e7f5904c118ff9bdc5577e6fae6c5498317fc1
SHA2560bdcac16afbe90ebe616ed7578690a6c4d1f651990b0c069bba6933eae89f7fc
SHA512d9d8ca3c26a510b5b94915da26af6b136db64f709bcc6d6c939ee3f91128d781d3375eb7e491e5ae12baef7c0a47afa1c78916043b3e75a86e556cff127b67d2
-
Filesize
36KB
MD5a7b5debf648af8527d38065f285c6754
SHA1ad8513c878ca1483a2472c7f8dfc8a416418517e
SHA2560d8f1987d41b042ee7aa1ae97d1950a40884ff4ed620fd02371017160e50eaf5
SHA512c879b912d723e9c382e547f605dea4d77830d9300c3cdb1a14c2758cf4e895000c7ba2afe37584ed2fb94a9893e8ff47bdfda4dfbf2dc47aca75efc5d28984e4
-
Filesize
20KB
MD5ddd941b86921617e632ffded3c551f52
SHA1e9f3fde85f279a8f6ea0ca02192d1e433cfaec4d
SHA2565643b763de05df0615b433546a3c4d2da206d7589d7bd895f69a06df0e73b7ce
SHA51279fbda1287d1fc7271feed958700dc7ce43a660e5ed6a0dc710e5c108807cc20c9ccd52690b7a6682aa4dcda36a5bf7fcbe6e04572cc12bc13639167f70f4709
-
Filesize
36KB
MD560e918a66670488ae5e111bdcbcfa95d
SHA1ee81e2f5ad9a7301adfce5999095370e532a43d9
SHA2560126f776c2c01bb621001c4d80787b706902fa8fdd89fd1f062d063ec74d5313
SHA5121abb9311fce204649d299a19efab820981c427a8f3778a9848fdfe99aac19fbb3d62bdc4f5fc93bad66c090d198e9db33c23066041207272f2942272167796d2
-
Filesize
512B
MD57dda7647b5f291851bcbeedc59d0902e
SHA1c62a40b29d1461463031eb5bc4e949582f69bf15
SHA25617b5485a4f22fa69633175c6aa0122df8731fc5afad307c7a02baee8b8020e6b
SHA5127304de029e325fcb4c257d6de1d2022eaba10f0b3443044187df2d18f275bb9386b76e36df32d91417b7b720ef7d71ed30666f200c41189dfad00f5f9038e10a
-
Filesize
48KB
MD554d5e18587f9d74810aaf95851776c5d
SHA14bf0a813317b45bc0ece96da63f36136d663f530
SHA256bd210bee01523b5ee5ca9dfbe18aaafc11aeb4c76f2e9fd38acfbae305aba22c
SHA512fd3b23cf81ff4fa1a17e9cae93f4b2ada789bd9ce069b36e611fe3eb4507e02b31998ba779439ea48da188357f0703b19bb0f85da36c8e34722d3ffec0ce16ce
-
Filesize
8KB
MD57767bb37b6d7ef13868ed6c34c4b4e07
SHA16d38b7a74c06f54bfbce4de245e8f8deab08c847
SHA256d012b8ca339699286c89b033eee3a9a8d57a50bdfb1eeef8038dfeeb192e8b45
SHA512211393a3ddd7fae24d84beae3fb4a57ae5e67198fc8425f4376513a588b6c2bcb5200b93fbdb38b8f5f47de908f45f21c00b0ad8da975ee267a6a7d3a175ac72
-
Filesize
8KB
MD52d19227802b2baea74f87c95336c16d0
SHA1950798ba0aa25f88429ceb3217cb137be58f8b11
SHA25606a0a155ad1700811e9ba760da19dfe8b88aac401f796f1c12d047f7f73e8bec
SHA51278c06ba7bea06a9d11b9af2874c8e7e3f06a36f52eae1ac0dd2af5e6dd5eb331568361de552ef7bb5b378e8a92aa078caefe44fb9ab1a6385dc1824ad51c2169
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5351557198483c1e131bccf882730709c
SHA170b0651f0ac35483eea30dc52a395fc73f39a3ec
SHA256b76b7b1d33ed4e95bc4c1476acbad7b39569f0839329781d57ad1f384533845b
SHA512e114f3522ef081a5f1ea2a162a1d002378c6f3414047c257f64228cbefa225f93db6421c98233db898bf98b5bd87340a9194f4d171b1013fba47ebcc340aa982
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
261KB
MD598895421cc598ca850b02b0ee2af46a4
SHA112184a14760fc61f8e5838aab95059eda19313b0
SHA2563a8758bc7367e5a19bfac6e333e885d52b0d737785e10cd1222a2d29802913df
SHA51283b3e7f5bf679205bf9465f52f59f1cbcf76ffd95f0f251eadd835cc6829db625f82fe7eccb44e73b987a35277e6a140d1ebddc04618d4b909e7359dbc9a4087
-
Filesize
512B
MD5283b723f0846aa6f20fed64e7697677d
SHA1a6e5aa7ce346c0f2eaf3d840fc3857c17d30fae8
SHA2568000407df2ee114fd8469a0b677fb4c36f7e5ec552ac8dc4e4a3c1be3e07d775
SHA5125a080b434dbe4a765c78bdd87d54b8ff872dff7fa4b6977da290baa855d3ceda30328dfdfb886f8de5ec548a55021d325d71fec1f612666b5cf70497ea6df0c0
-
Filesize
80KB
MD5b7cad6b7d52e8f82b6d707653261a5ee
SHA13e61f84312bd83b10986102b6b81fc13fc78c063
SHA2567bfca97d10f9f6f1d174f96ca75fc1d981581c963066212a837fef2c0f7d91f2
SHA51278872de5c56582303bb578650b62c9648005153480364ce00ff5bbfd52bc323b5d8507fcf55df1d3a4ed693384fc704ac90407ced0014d6d80eee349947f0159
-
Filesize
2KB
MD519175ed4326df869f1886cf524e171fa
SHA1951048cce3237619ff126c8cfcf87ab405b7ed0f
SHA256dbd655cf06d7da7918d233975c67f6cad9f102dbb912ea290642241ad64e8f2f
SHA512f2a8076df5f411d079b366753d6ea1344ddbd4bc9e331ce6aa0671e6d172a3f3b5fd015be188207440ed05b843291608b0d09240dce370c67e83e834cf622540
-
Filesize
697B
MD576be8bf70ec747a665b77f1a9d44cdc2
SHA11f9d5831eb404b566baad1d0ba86bc37320e334f
SHA256ad4a1e46efe82d6ff1e497aa3ec33bbcb0d9786928099f2617969164be28e96e
SHA512e7b2b6e066302adb0e430eda4efcfa875af1d9e723407c3c2577ae3c818ebc46fddd62effac77633a692e1fd8807b0ca4bbc2c710e1d65bac15b00c52c6c3a40
-
Filesize
211B
MD5f381468e25cbf1eec1cb33c5c41064ad
SHA1195921d776e775c538e158bad7a82cfb2fdc9fdf
SHA2567648390299c61782c41015dea100e2768d0c9e4610f63724af5917ddb0bd2fa5
SHA512269d4e21e1ce93099d11da335c2911de678eb34c6b239748c67b5fc6718bfd46d59f31a2ebbefdb3b1636c4d484a5f1db8b063c91a2b1bb188af1f3f62b99cab
-
Filesize
24KB
MD56999293712000d597b4cf4f0d42316fa
SHA1ce64c005f5f516ec4c491eabd907423b0fbe2a1f
SHA2563cd4e50816e59adfdddc5d5ea2bff7068bf6fe711302b4820f6a79f132f0fedb
SHA5128638503a6e9c40c8025722ce266ca4314804c7d74546938464253a136f230921ecc990343541f481d317c6823ae519a5a33d279b363a1457bb105a6de49656e2
-
Filesize
24KB
MD5a22d9b53bda0f7778f3d24257fcf4441
SHA171a3202820a5d72b61c6a9185a225ad483faf94a
SHA256888492242c42413ad12546ef19324233a05469b6c6883c49dde8415d06ef5982
SHA5125e3cef7d79e1a41c55cb92b79cfd5273207df202feb742653462e98a600c0b2c6df0e63be1fc84201a08de83301c2b1a999973e37c3ab25fb0e8f32f94e15d08
-
Filesize
512B
MD524e2c09646d8bfc2a8a0ff24bf1e0552
SHA10ad8b880fed80fe9e610f19aa50396fdcdd60829
SHA256e118c3b2120f3090265a65d726869b49f13552fed6e16ef13103f886e175f365
SHA512083f990442e5838d8e665833516e1278da85e66e3af006862179c187d79a964e4b94bd6b9d535cad63fbfe0beb41679a13fc196288d9d1cf81501fc7783a5417
-
Filesize
36KB
MD527972f75b2fa64a5efa248cb0a2334da
SHA15fa92499a82f9bc9841bab2c4836e8c511a74dc7
SHA2563c5bbb806c845ffb3a735c84fbf9402377be61a498351c1d039a86b83e1e4fcb
SHA51210d91ad6585db9aa7f096e076c34a3481aa831dbad188cbc7b01546ecfdf765edfe6210a2e50b6b658020b9b702a8153aa1bc8057cf2ad7f7955ac98abad940e
-
Filesize
8KB
MD5e00d1c5543baa230e2aed87e5fd6ea5d
SHA190d1c2731720a9094244183238455170dd334edb
SHA2569a344fdb166ea37405310e42011ac1b2499088c747af2304b290afd3e07f3422
SHA512b776749d2f3b04633fcce6226a1c2ca26a0d1cf9ebab83cdff5234cb9c694c81f2495293f326727e97329b1896416b386abe6f649e4b8294f79c5860c5aef754