73ce90aba4131d00cf775924f813b008cb82ddbe65f5af6d1f95d470b7e11631

Analysis

max time kernel
35s
max time network
128s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
30/05/2024, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84524e61dcc6f6a7cbb094feead6f684_JaffaCakes118.apk
Size

28.8MB
MD5

84524e61dcc6f6a7cbb094feead6f684
SHA1

b4b7929f508760e7ec1e7908213e03658bf8ef9b
SHA256

73ce90aba4131d00cf775924f813b008cb82ddbe65f5af6d1f95d470b7e11631
SHA512

dca435fea1ae1dd59c6339f28aa03e21b8dbc61d540b325ee8cf6112a0324bb3c4419c59ae13930106392f86cda2ff7cc2a613600573022054c77e4fb1954a8b
SSDEEP

786432:Z+D9vZ+oT0yGW81hsho5yrzn55+bUPM75XkQK1vZZZx:Z+hvZRY73A55+bUUV0Q8

Score

6^/10

discovery impact

Malware Config

Signatures

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gaishiqunying

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
7	f.appjiagu.com

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gaishiqunying

com.gaishiqunying
1⤵
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5151

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact