0b952b02824c47701066187433878ebfed9f7cbb1e931115676618d9eb7d2bfa

Analysis

max time kernel
160s
max time network
154s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
30/05/2024, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83d5c4b2a023403d1f4708fff0533eaa_JaffaCakes118.apk
Size

13.6MB
MD5

83d5c4b2a023403d1f4708fff0533eaa
SHA1

2f7aac1addf79d6e7f46e02ed1e20c707faa0950
SHA256

0b952b02824c47701066187433878ebfed9f7cbb1e931115676618d9eb7d2bfa
SHA512

33e0d113c4e61d00666b3dede4d47258247159a17eaee28d223f28647f66169fe39622c154dc60515f6fdaa7bec60bd8c548d0dd6608cd47aef1937cb962c674
SSDEEP

393216:1jyNj0cGzvsZG80rGzho36eVQkSRF3isSF2x+Ig8abE:1jyynk5hoxsyTgcnbE

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.iyuba.cet6

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.iyuba.cet6

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.iyuba.cet6

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.iyuba.cet6

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.iyuba.cet6

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.iyuba.cet6

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.iyuba.cet6

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.iyuba.cet6

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.iyuba.cet6

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
24	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.iyuba.cet6

com.iyuba.cet6
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5129

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.iyuba.cet6/cet6_13.sqlite

Filesize
1.4MB

MD5
01154722725ab3d8e8153ac16ba0c867

SHA1
5c512a6cad0c52a268e552b42e4519061926d0d7

SHA256
f2ee8ba7ed7e079e4d3ea13f6a51b189cf76d3e1b8e00665f32055ee370f1603

SHA512
d32cd6fdfaadb5d3513d446e7546ca89aa4dc8ae652ffc9f962816bf2f352457ba9c06c642726ff1b15b3cbb1cd6c6466445a1cb0428826007113d3043422079

Download Submit
/data/data/com.iyuba.cet6/databases/lib_database.sqlite

Filesize
7.3MB

MD5
0626e960b4b6fbd72b9e142ea763fa16

SHA1
b113ae2eced67bd7b7747b22194778a03439f311

SHA256
c4c5403ca4469154ab2ea6b2a6472841c77148269cd64bc8e47a735e85dc425a

SHA512
7306b131f9c02a9e40325f701f56ddd439d13e1a160720d74d0f4596c9429d3763fc91a33e22bd9e7a450b1df017380635c2e4716276d55981511ceb3d0c2c81

Download Submit
/data/data/com.iyuba.cet6/files/.imprint

Filesize
781B

MD5
d227a6952c5b57ee4f393f53e155fe9b

SHA1
5b73b51dce529bac5eae81b67f968b0cccd29766

SHA256
31819e78ac332c023128f8e167cb568e7e1a938180619628697e14de8950e451

SHA512
5b6ce9ab6c7dd226fe9810789c0113b16ff2344d0dbad8dc711191a9b7b611d0cdb3a142e21c061ae7f1858e80ecc7f4e78fcf83e79f98b2abba8f14020297da

Download Submit
/data/data/com.iyuba.cet6/files/umeng_it.cache

Filesize
148B

MD5
64ec0bd30e29d71eee8a8dc8147b7133

SHA1
8faff08b6492b43c18657182271c318da576a94d

SHA256
1085dc18accbee0ddc12327804728d6757fdf66246ec2d60687e202f1cdc50bd

SHA512
942f762104748af87f15e59b39a75517be3736edcd3aceaf08ab54ff95c351bf3729dc6a45c0a12f4709901d3a3bff82225100548ba3fc193276831f4a2f9b55

Download Submit
/data/data/com.iyuba.cet6/files/umeng_it.cache

Filesize
76B

MD5
2eb5c619e4fc6e504b06686500743e57

SHA1
6da11f3439515f1b79cf4eb17a7492d15a8ee8fb

SHA256
bd081cc9d194032aa0f8a7f7b595ce198148e0a1670149360c89cbbf7945312a

SHA512
b0b42798c65435ee82812cc2bc82a2acf081d83768956e64c6c9a7fee1494a42fac9616c4b5da06e67a8654ef5012659d11ae975f538d4d8de6fda11fba29694

Download Submit
/data/data/com.iyuba.cet6/sayings.sqlite

Filesize
25KB

MD5
714157b88c7bf8cfefa384790c21be12

SHA1
9e9d731296da5c85010e3fd44f455cd1d0ac3bf7

SHA256
f3f2cec1e69443128e5bfaeca6c4a29223c1e8aa710f8af77fa3b38ce12b25ab

SHA512
3a85a539cec724596216031f568d7d995cff5cb68ea9b3402a5047aeef82e4a02cfccd00f93d66d7c1efeaf6f3839fae6c6e0dbc394e6c234d82857f943e58e2

Download Submit
/data/data/com.iyuba.cet6/sayings.sqlite

Filesize
26KB

MD5
a9f2489ea44cce947ff909cecee0fec1

SHA1
8b3fa4407b0b15ada57198b39d55fae89cd2bab7

SHA256
49e96b9d8fab48d7f4e41fb6dd9ea7b64e7b13d6fb8a3628124a55f7407ab90d

SHA512
5e8cc38c18bfe18793e1e0333aafc8dd2e32804cec210e84bb4c1fc465bfa8bf5754830af0fcca97ab067be98c0ecba1b77e7b169eb2c417dbe3ee9f23fc9de9

Download Submit
/data/data/com.iyuba.cet6/sayings.sqlite-journal

Filesize
1KB

MD5
714ee5390eede3fb130121d1d798bf04

SHA1
cc10306120e1fa8ef4b39e8145640ab3518efb05

SHA256
509616f4787de448f1d9335d66b84fdc1b7aaa83bdc77d35bb2b88a7d8ee47b7

SHA512
5af6d2ec99f56df470ffa6c2650be0e13ca5a17791b60030818eb2906e242f1ee3fee5ac29cb1e70f5aaa1a182836527654ab5106333b365f5936bee8d565741

Download Submit
/data/data/com.iyuba.cet6/sayings.sqlite-journal

Filesize
2KB

MD5
94f03d394637c1565beadfaf640a941e

SHA1
439f3733ba8ebe53c9a3b6b5475584b206b475b8

SHA256
a3743c15b6e3853c3f65e5def0e63c4070268f001801cc7982752b80de9e510c

SHA512
a96cb36846d7571a7a73f0daee403ac69d6640eda6ebfa324a8da78aa12ff46395f628b55f5a436cb8126dcde1d2bb0d45a4e324daf86265611d1b8fd6069136

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads