829004d7d70cb16bfb92bdfbab78f651bf2b90973c01c53773c0b354ff500a81

Analysis

max time kernel
156s
max time network
161s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
24-05-2024 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fa299074016487e3feeb2804121ec3e_JaffaCakes118.apk
Size

4.9MB
MD5

6fa299074016487e3feeb2804121ec3e
SHA1

50b70e9da8b972a2a5a7dc1cdae0c668213cc79f
SHA256

829004d7d70cb16bfb92bdfbab78f651bf2b90973c01c53773c0b354ff500a81
SHA512

6b1dab8a1eb8dffaac3473ad7241dea60028786a9471e32c5b6fa95ca3b362c62c408616df66a2cb8503657bd42555cc171bf8329e77ab80c3d542d1596681df
SSDEEP

98304:p0TzuBB7HJNBYWBRgVzsNWMLeMgLTycAVDTMDepDP9wK1OerDnWQwOkKlg8pJ/:p0TzurBYWBRqz1lMiMkKeK1triQwylbf

Score

8^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.fengcheqb.fcqb

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.fengcheqb.fcqb

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.fengcheqb.fcqb

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.fengcheqb.fcqb

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.fengcheqb.fcqb

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.fengcheqb.fcqb

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.fengcheqb.fcqb

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.fengcheqb.fcqb

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
10	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.fengcheqb.fcqb

com.fengcheqb.fcqb
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5091

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.fengcheqb.fcqb/databases/ThrowalbeLog.db

Filesize
48KB

MD5
6894ad8317698669af02674cb6d21281

SHA1
048cab395440dc624113c5221e369e0509d11525

SHA256
9a265e93829151f008ab780517c592099f2ce780206a6fa0134281f6ffe99b20

SHA512
3e0d7da79acbf7a5a3ec93ae3ee8bb8fdf4687c2b97ea4bec0e2f63ba72a415ab5249e96956d0dac86ffa7717db4aa8c620c4b46cdf86cc4faca451c2477a5a6

Download Submit
/data/data/com.fengcheqb.fcqb/databases/ThrowalbeLog.db-journal

Filesize
16KB

MD5
f9e4dae9743fdfb69e857f02deda3131

SHA1
68ee210ba95e4a5688583f6f6c79a903b87d3932

SHA256
3bc0271e40f666a37836b11d24c565ffe2be59dea3fd792ba8c488262a342bb6

SHA512
814e04c0f5bc7164753299ce83ea31a5118e0754741c87dbc0002bfa4d213c7548233deca3d0e2cc9ff9b41f0523ee43a1ad877f685894894053ae19a7a6b4f7

Download Submit
/data/data/com.fengcheqb.fcqb/databases/ThrowalbeLog.db-journal

Filesize
16KB

MD5
6606417d0c0f4367d72bc6c25094ac01

SHA1
4b0d5d76fda28009a95b8b024efa98b90ca29877

SHA256
4e014a8462b90e2d4402e4bad6948e0a9da4d2eb83a49fd58590bb76b2126bfd

SHA512
ce34aaa341dc6fb271b778cc53c08a3447a1e976718dae5c88746ca7c669d7742a23d3e71ad29315834f56358e9e9a6813a3c57a0956f680254c9e360081a200

Download Submit
/data/data/com.fengcheqb.fcqb/databases/ThrowalbeLog.db-journal

Filesize
512B

MD5
fd6a676d1a306c8acae1a490f80fa303

SHA1
1b3a4b3cba0bd81c93f0094bd49d4e547bcaa3e5

SHA256
1675a5f431b7f70934fa3c49b8191e2d8b71a16351826b825d875c4b494c9117

SHA512
b1eaac34bf13db0ee92bdbc0a8251d20435f923f18d5699560f30b96982b0e993dde87276afcde1fa7609453639399f34be5bb832500a892f33e062e16c573ac

Download Submit
/data/data/com.fengcheqb.fcqb/databases/ThrowalbeLog.db-journal

Filesize
8KB

MD5
4ad7bd534ed6d8d20e37d33e534c2f40

SHA1
25f7be4df407e0968547b415bfa440afebdad809

SHA256
1b01252960e0892ff54f64e362ced2519b150cc4787867d1d9af6bc0f8c4ab14

SHA512
cef6dd3bc6e9849bf9582a88db4fc0a1713c9ff3b29e9089e14f66c98aab0f60e93e3f201366c3dc7bf82b4d1a9d3d73c94c7ad146bf4f8132fd826851a009e8

Download Submit
/data/data/com.fengcheqb.fcqb/databases/ThrowalbeLog.db-journal

Filesize
8KB

MD5
cc1ca5f22697407207ead100d9ef3244

SHA1
9e8f65b65ee0018cc95525f8fd5ae2b4bd92f1ff

SHA256
ceada9a9a53bd0c573e44345f289d78bd7eccf4e801e5198000fac95db519857

SHA512
0b42e43a8acfb3a2467da16aee00e4bb9692d0c3925e07a4eff32cfe28bd0a60ea8c35e8dda03a35f7f7dba5e13509e6b8b4287f8a3b9be8d0cd5ba146d5db1e

Download Submit
/data/data/com.fengcheqb.fcqb/databases/ThrowalbeLog.db-journal

Filesize
12KB

MD5
1861de96f4a914b33f645fd33b0da642

SHA1
8d1d0372049d4d78bf16a41ca96ab138d75de503

SHA256
ee57a61b7195bb6a65249c0662f738387cca47cb445dfd9204b1e4873e0698b9

SHA512
9581091e50132f424b5d0c1043b750888503b655e3059756b0c0f5ee18fe0bf18da95fb97e3ca71a69382c2819fd5ab11cc185281d9efe1364026f10dd5834f5

Download Submit
/data/data/com.fengcheqb.fcqb/databases/sharesdk.db

Filesize
20KB

MD5
c8641d1bece79d230ca81bf73f6a5710

SHA1
d28640aa528f3db6cb3817694acfa8e44b7010dd

SHA256
01bf85559a2c046235e6e4cf81cfaba6a6084f276a6df4d4e02e214828157dcc

SHA512
471e494f3e133e759b8dc08301725b971277cc361935819224560a429802d1b625d5882a8f5c33a75d2a6f65a4f853855019e7e91233f8c10e4716db6d041390

Download Submit
/data/data/com.fengcheqb.fcqb/databases/sharesdk.db-journal

Filesize
512B

MD5
2c0783110ae2138a8241f81364b62dd4

SHA1
16259ee6da98e38bbc69260db55930d99a0d2a73

SHA256
0d3b3067a7eed1e43b272fea4068711c6081efd8c9a9f175fc7ac4042c7c6c3d

SHA512
6672ca24cc4ae53edff17980f453f1cbea2468ee92a8c5e509e163695d1727f35ae6082735c887d84619d364a6860460d5eaad896698d26c6841de1661167dad

Download Submit
/data/data/com.fengcheqb.fcqb/databases/sharesdk.db-journal

Filesize
8KB

MD5
e77113b7c1de424580bd005fd61704cc

SHA1
842c52bd3e245037f17b60491ea96e050ccf675f

SHA256
6de43726b3dbb844a101914cb8270bfac652a4e1a5d53103563583503033f396

SHA512
30f28b650551e5730e46e58a91efc786d74641e8ed7480f33440e8076e7a7b8e6c4dce7aaddfc9701f738a62f53cfc705b3cc590c549aa562d918668789c3eb7

Download Submit
/data/data/com.fengcheqb.fcqb/databases/sharesdk.db-journal

Filesize
8KB

MD5
2d8ebc08408d7b845227016e3cf4ead7

SHA1
0a3a1474e3469ee1a64b11e5493f9c6fdaa5e842

SHA256
85ee1ca4d835995055bf6999390cb587f344979fa2ecd4540384b3caf671fec0

SHA512
e1bd92c1f79a7d3c755b5ed4b0f62b52a67e40daf9052aa5f2daefef2bf623957f7945a397bab27e79e1dcdccece0a648cb43e8c2f1ca00c59bb5dcd30f33c7f

Download Submit
/data/data/com.fengcheqb.fcqb/files/.um/um_cache_1716579949074.env

Filesize
550B

MD5
442bea9fede229a6639b42ed941d06b0

SHA1
d4352cfff2f97414dd32400c36d2ad55e7904215

SHA256
5826ca0dc26d5258943a78eb351a2f1032a0afba7720358eeca66ee48b7738c8

SHA512
35f904e0669cb349315c0810d19a36511022a70cbe22055f354f51cb37f27d159bc67a54e844729061134f01b823a8a61da3b7a831ccf0965cb4f54f63e23d66

Download Submit
/data/data/com.fengcheqb.fcqb/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
aa94f32783abb6f0021d75917a56443a

SHA1
09860d9f2d0288329d51e6e5ed62ad45bfcb9053

SHA256
2a82216ed7c379b393e9658b6a1a26a820c3c008a9f51d1468f516f01489c494

SHA512
c777fe9cb5f78caa2c88787d9df87495778c6d1fdc313bd212d4b54e03443fcf4d54c8fa147fa87361310ea74eae59b3f4561c5a57a593bc8bc3e937958dfe2f

Download Submit
/data/data/com.fengcheqb.fcqb/files/umeng_it.cache

Filesize
245B

MD5
086e021048fe4e94444d361fd1ca4694

SHA1
ce47702ae3bd60d12a5e5ddc5017d183f4447120

SHA256
393f549f098601b6580c89458e0526d74fe186a5bd337d8cbca29e37ff1433c6

SHA512
6edeacf5bf2392f2c06c254806fe73fff87f8ace049169b2a38e8febc51f24ad05cb8859df6f05b558a95febaae2e885bbed3e3127abe63612fce75b9687d984

Download Submit
/storage/emulated/0/ShareSDK/.ba

Filesize
369B

MD5
5039d0316d9f626bbfe29e403a8dc324

SHA1
cb035c8aad0e9ea15b34590f6182c5031b4a0221

SHA256
cf28faffa8ecb88f33c419abf8620f9c701b3f71ccdc439335eed53fd182b13d

SHA512
1b48e4c2dd8945842b6b2488183ff3a468f90af79950e9c478ea6c85074bde5d71dccd3b6dd409989ace12e793c25bc3896206a5baacab3d058b49ef10596b5f

Download Submit
/storage/emulated/0/ShareSDK/.ba

Filesize
468B

MD5
7e6a5d7fc305ff95c2c443d2902cdec9

SHA1
674a68d91c98cf8927c59fd944ad44826547163c

SHA256
3e5ca551e7ccc8e59def03d3714c8785846ab093912bf9e49f2f023ec24fd035

SHA512
b4c8c369590d999ef2938cf623047214ceacfe3fb0bc65e7cacca53ca4e27418c0bd361ffe7eda85fa7e25eb6bec8141bcdda02514d68927891e8b85b0a23a2f

Download Submit
/storage/emulated/0/ShareSDK/.dk

Filesize
107B

MD5
893bb9930a6efdd3211826f4114b5a29

SHA1
57b8895adcc3bbfec87268d5f004cdaa6caee8cd

SHA256
45e6cf5549bc12c1150b2a10f20de32ec5b86fe23221536eca2cb2a43b1e2d21

SHA512
78f094bf00c6b440a57dc5b8edc10c3abf4fac63176dd64a54b2e7b03d9973485504d619ae80312fed1bc72db9f1617a990f37edc7bfdfa032ae47b054939010

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads