f0c86c5d28b4aab065fcd8aa873dba4835acf5aaadee21916e3f50c61bff22f4

Analysis

max time kernel
174s
max time network
185s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
24-05-2024 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e2ab37c4cf26d9e8ee7cf0696f63eb8_JaffaCakes118.apk
Size

10.0MB
MD5

6e2ab37c4cf26d9e8ee7cf0696f63eb8
SHA1

3ff3cb4ee1c40d3cd20e3eb025fdb238efb48107
SHA256

f0c86c5d28b4aab065fcd8aa873dba4835acf5aaadee21916e3f50c61bff22f4
SHA512

2a6fdfe42a3f0ac70a2950671562e86ef58b949859f427528dc72904fbdf2348df17fcf66e3f4abe04e2a1cd93eb5c939bfea8fb7875b1f7f6606c9751115b82
SSDEEP

196608:9KB3j3AXlXh3oT9LdkP3mXPkctewZ5Wi61+pR9DJXBypwMaKV0ixBWA:9a3j3gxepqPIxfzXe+v9D3uwPPA

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.rjfittime.app

description ioc process

File opened for read /proc/cpuinfo com.rjfittime.app
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.rjfittime.app

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.rjfittime.app
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.rjfittime.app

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.rjfittime.app

description	ioc	process
File opened for read	/proc/cpuinfo	com.rjfittime.app

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.rjfittime.app

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.rjfittime.app

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.rjfittime.app:pushservicecom.rjfittime.app

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.rjfittime.app:pushservice
Framework service call	android.app.IActivityManager.registerReceiver	com.rjfittime.app

Acquires the wake lock 1 IoCs

Processes:

com.rjfittime.app:pushservice

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.rjfittime.app:pushservice

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.rjfittime.app:pushservice

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

com.rjfittime.appcom.rjfittime.app:pushservice

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rjfittime.app
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rjfittime.app:pushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

Processes:

flow ioc

13 alog.umeng.com
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.rjfittime.app

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.rjfittime.app

flow	ioc
13	alog.umeng.com

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.rjfittime.app

com.rjfittime.app
1⤵
- Checks CPU information
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4316

com.rjfittime.app:pushservice
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4343

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.rjfittime.app/databases/_cookie
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.rjfittime.app/databases/_cookie-journal
Filesize
512B

MD5
258af1126f28699d0120f79be6db95c2

SHA1
477ca5a65254eda5ce266aba8fe4d6ed6ce8ebab

SHA256
732eb64e65b18d26a87de46132ed920bc872f315a6e36ebfb1715bc31421e24a

SHA512
2994e71d1830194309e90437df5e9b8a903c428c0fb6d703be5f20f4a6ff65dda74ba2d3d7940ee896a362ae515be38c14550a24c08fbb24bea5f374e7173dd4

Download Submit
/data/data/com.rjfittime.app/databases/_cookie-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.rjfittime.app/databases/_cookie-wal
Filesize
88KB

MD5
36f0cd684752fa8001e651c1c70d3a24

SHA1
b43bbdbebfadea4ca32088004e1892ad9bedf449

SHA256
0f0c854e120ad1dd1e987ef45d6f03559dc5d4bc0e8b8245a2e41fc22f167d6f

SHA512
2689b8533a2193d84e91ebe28da3cf7fe5001af57dedb758db0782b576fd50e7ba794fe16ed86aeab9aaaf1fc7d3651ac4ab9bb8cd495395d3fc66ebfa9ec33a

Download Submit
/data/data/com.rjfittime.app/databases/sharesdk.db-journal
Filesize
512B

MD5
88a2130f85fea28f1045a8a3bc52f58c

SHA1
cd78aa1cba49c7bbce594514999ee6a90f4ff003

SHA256
87060c9c2259a32c0121fd358216fb11843e7b685c2bd05b5e74aeba5217c22b

SHA512
20f43a043dd7080f36543e3b531ac3ab430c10f49525feb031795b17d99a81519e9a590f9db6b43abaa1fb59c1ba7d29a27aa4fbc69ec5ff0446486a4aa35969

Download Submit
/data/data/com.rjfittime.app/databases/sharesdk.db-wal
Filesize
32KB

MD5
75a4fac8502fd98d0dc59b29d0b7251f

SHA1
11873529fbe0c8e81a243ddfbadecd89bdf83a0d

SHA256
f67dac8d70031f93c46ed77f8b995cad5dbaab052b1a5a7510e203e87336a80a

SHA512
57da47fe894e5e774809f7c20e53cf0cf66a1647183c5c2d8036a65d08798ed4783da8c4c6dabd4e2f55491b2f05c806aadebc496443e77ee67345b585f1133f

Download Submit
/data/data/com.rjfittime.app/files/.um/um_cache_1716545783924.env
Filesize
585B

MD5
e5c793cb0ec960417b89860157fd4f24

SHA1
c809751cc17ea881797fad7221d60adf44585c45

SHA256
fe37b13a05b0027049b8f088c4767aef371b17102360417a4e028f32d09d1df7

SHA512
cc6c1ab8376d8be64bcaa32e2ebb470f644428460fab99a81990830628ed9a3ca1baae28b79c5175929771747ddedbde5858aa1e7bf59f407cc936e0aab61e65

Download Submit
/data/data/com.rjfittime.app/files/umeng_it.cache
Filesize
310B

MD5
4a698cbf6609746dc3e757eff7d38c09

SHA1
15eba78d8552c03f1b1f167a93f0b3cd0065e6e1

SHA256
ce9fd19e74e267b7f76fdb0a178d3302b4fd76c7c01d800d2bbba4c276c595ea

SHA512
5b90f119e7f793c0e209dd29e28c4a1a4adaa18667201345cf3a2238f8145663d7905596693f9980ad0e8b74ad6f7f61f2373a16c094c35c55102ab0240a34de

Download Submit
/storage/emulated/0/ShareSDK/.ba
Filesize
365B

MD5
ec8c44c60974c1cfce4db0f857012fc9

SHA1
46f7792b53cda1117044c4df94fd6bd148b2dfc3

SHA256
79433fee27f331a832efe2d382f0b8984203db0931b71f3608f411bdc949d7a6

SHA512
88c5d46770255b3883e2c5251513aa345aea2b28c7d164ed39a7fb2622bed9cf64b17414a6fe7f446439109d407e4e33d1d2250cd8bb48177fb677b3a4bcf115

Download Submit
/storage/emulated/0/ShareSDK/.ba
Filesize
464B

MD5
fa60f7c4d559ac5e017568425a711544

SHA1
fe1a2cae206e34cf958c432b510fb5085f6b96e4

SHA256
aa9a8393e656ab889b5ad93d20f36a8f13ed547d7bdd04851f8080165536956f

SHA512
4adaa6dbb8c6bbcb5a9266a5176f4407360df4315c51112516dcb40eb8a006d00cfff0781e9d65ca916f05eca77d2c04ec3989ba5278324ca4768f98fdcab2ff

Download Submit
/storage/emulated/0/ShareSDK/.dk
Filesize
107B

MD5
c9383021bd97affc44be4db7018c4d7b

SHA1
7e680409d1c86e35149bebc22f2cf8c484f0d23e

SHA256
b7b7e032170e3190a84359e5c37adede1d58b6bf4c455ef0c01f73335709bb65

SHA512
7303f068da97319891e2d25c1c737035f1cfdc365d75d954102b612000e54d7e2b5dfafe10bdf909563e2b46ec3ff9e546423bff6f0aa9496880eab1c1c36a81

Download Submit