Analysis
-
max time kernel
178s -
max time network
182s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
-
submitted
28-05-2024 17:48
General
-
Target
7dd5181629ee77cf45b6af55bd2ebb1f_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
7dd5181629ee77cf45b6af55bd2ebb1f
-
SHA1
ae9752ab25d7da22df0668650749d0ca167cd9cd
-
SHA256
822ac55a505bd34b021246da52e5009faa43a4925fe127a5f5fe35ced9d23562
-
SHA512
680eb3dda3b67d9f13a2c333b237be0026f967d9ec034a812e063b0877c899a163ee37236383858c4dcc15790a9a442740295d9197190476dea9782af4c90182
-
SSDEEP
24576:poL0otaYtXMhes8X3lUKfcfIkuovSp0Cjjo+9UjtUDq/13tdHbZKm51Ob83C:iQ7YtRX1wvTvSp1jvSjtUDq/1XHNKmje
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.xdzp.dpbp.batd1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
-
com.xdzp.dpbp.batd:daemon1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
Filesize
723B
MD527e823f3f6838c3e257440da107fff42
SHA1f56a2741b7ff9a027f064f82695ff8c160d2f6c6
SHA25625791cd0817129d64ccebccaefa3832c478c1aced8107de6d0642f655229851b
SHA5129bfb77030f5b7508c81550675793b4a77f4d3c15731d31a0ecf0adef4f9df1b5bc490a553639ab81a9ca2397706c064ff72be9593c8af8d7dc1aa8986cc81e1a
-
Filesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
Filesize
28KB
MD5dae68dcffc3d522a79f98ebbc3b6d457
SHA16df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA25656cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA51223b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
-
Filesize
8KB
MD5c3a60d1cc19f059c5814d5b6381f3696
SHA19781dde6a50c9a37f6133711a95fbb8684771fb1
SHA2566a8bdbc12cd1304fcbc5e5ec2c7f087918d5a6cfdcc573e2b0a3e21104f985d4
SHA512edcf1a6812bbc0d47279fe4c42b4d28581635855dc22b3db0abd0927a997c4779d30eea43369c35daf868a74e7e413a37220a0ee5ee146b3bc7eaea1150625f1
-
Filesize
512B
MD530a4017ab9dbf38c5973cdca11214407
SHA1f9fb3cdacaea0bdaccf5ece62ea58694dde51c5f
SHA256eb00404d8bff10f56f381499e0a3f9adb7cc79883235acc09b3240ec4fc2fc24
SHA512d7de71c86924e9491183c09ebbd5e0dccc0ae913d2aef378ac6fd94dddb35ce4204a2df7313f38d99a97f525a0693ae43834a4859f38648ddf61ebb833a6e167
-
Filesize
8KB
MD57c584dce6a8b68f02abcf4c3f806ebe8
SHA1b593ee79027a7b0cc3e10b9274c81558690ea53a
SHA256c653167b4e74495850fb60d5bdc3ef1be3237fec58c8113d52ca57fe4ae27d69
SHA5121809c1a76d7573831b0a0ad952113858e271b16916d87a51919f3b1b6852d9fe99b1d3c23a49e621043c493eddb7bbe01896653af6e3b095ff1a2f97c776edaf
-
Filesize
4KB
MD5b89e73731e598c79179558fd50bbc694
SHA11b09e0d556886eb76a757291cf021ad615a26b18
SHA25667be071701c80d26b2f09bcda52adc7793363abf2cea7dc525b378d6f8e3231a
SHA512f5d5c4f76c0fafc443a62a6cfd91eb0b9d53327beed8f7bc446bcb2e583b5568401dbe231889dabb78c1f2a37cd10513bf36e764e4184b7e114cab9fe13d1ebb
-
Filesize
8KB
MD530130a578e9cb468e0a4faaa9906d176
SHA132528e150fba33ca7affc3d06756077d0911108f
SHA256e1b2b9ecb05f47829db8966d6749b5acd1d1f6f7f0a8affb70735b289772faa8
SHA51214256113e66a9830a908eb1d975d6a6e6cf0cb6ab951c144449a3e8608bab76fe5497e37a6ff1e17d0c505cad5afd87947a6bd5f1f229fa7219ca043b270d621
-
Filesize
8KB
MD59626af7a14ba4532af198bc0e9245df1
SHA1d170807dd1d8feb2f6c143c65d0457b11252bca9
SHA2568f277237616eaaaca36c742e179439ab06dc7071f9df07b8bf45abd04b4eafef
SHA5122b2aa046a4e48e5fdd6715d4e963354d499c6da0de89aea98117ad5a56b8d6e7033bba5adee58867358330bea286b05943fcbc25ba9369c31c73bd302e5eca0a
-
Filesize
943B
MD5ac5f0beb04a3330e6f1afcc940c7a149
SHA182602922a0ac95a61236dce0944328f87ab6ff88
SHA25686d86ac5e38736fdaae44f101bafc42a867d69065b5b1f502d3b373e83afa983
SHA5124b25b9c4441d887dd572a02adb93cdb0a08f65503deb559945707a467c56df282bc652239469ecf022f0547c969a08b1acebfcf44dbb187b02efc3cc83e1dc91
-
Filesize
1KB
MD5acd976164a3e142407752a566d8c06de
SHA15cd27c4af352b4816b79e579a46e2915a81568b3
SHA256836ddf1046dcf1395e513eb9646d4db9bc2256886b4fd7930b0fa7788eafdb37
SHA512b71758e9da0d468eafae0891e401f3347e0bcf81bcd71589d6436c2d097a3c97196d0b5e165f8849f64a77e1b0aa29ac46b75a514ece9879dba3b29cb4bb17b5
-
Filesize
162B
MD504fd1caca5ec29a577ccbfcd519ea154
SHA185eb836262ff289fe5ede574c36456e50d56bf66
SHA25697c7394d0380f0209a212279bf7f940a0bdb7a2c2bd8ebf34df5ed49e587829b
SHA5121fbfdd45ffc623537152ef5cd41dfad623402f70a9700a99640c89178379e96ae4734d7dfa9b208a49a2982eb8d1d3778c2cafd833f0f5da2b60eca82d0169b1
-
Filesize
202B
MD57547ae022c774e9b6be68c9b2251d076
SHA174a5550b3265b20793c2083c36f2c366fc9754b1
SHA256221574193e93aec452717549da1943f1b68fdd900b09b3c9c53a7d9013eaae90
SHA5123be86e7bc9d08b115f6f0ef7cc68dbfbcefbe2c8cd395c344867eaeb28961f417bdf09c8920a06c19baef6f789128cd0d5b30a533642ef3a5cf467e0695bb320
-
Filesize
348B
MD528b0c12f202827ec05aae1eaa523ae5e
SHA19a735b289740ed6a1f86e6980e736884eea14416
SHA2569991e1993b5d738681768bb8968064f9590691a7545f4f107de60a187fc152ac
SHA5121bdf22cb7317af379943d64f58eb166e0914342f84957c90c6cc46e7ed14fc9d1cb714a982659ec0ec3f930e9909eebbf42802925b07ca5530eb2b892c18c415
-
Filesize
177B
MD57148fd6c04db9fdee0b3facd0ce04d35
SHA134976fa2d9d0fc3989d8fca059494e1089c1ec55
SHA25683b4ecc10771157a65970b1cf157c676edc7224b957d2c8503e7552a67c2a696
SHA51203ea2402304e7dfdf4f1d8aed82552e8cc89e3b50844997d53b9e265e3621139590e21127069196ac0147bdce1b8d59b106e43efaa854ed5f196da4b439d7c58
-
Filesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc