e9b46aae633e8f847fcc107822d32fa8a4ff4a5a7b47e290bbd178c40fb46a63

Analysis

max time kernel
104s
max time network
179s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
31/05/2024, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86830f4d8ed87538420ddb43e63994cb_JaffaCakes118.apk
Size 21.2MB
Sample240531-lcavdadd2y
SHA256 e9b46aae633e8f847fcc107822d32fa8a4ff4a5a7b47e290bbd178c40fb46a63
MD5 86830f4d8ed87538420ddb43e63994cb
SHA1 027729b63d9e034c7fbfb1f6ba595a2c49c5c22a
SHA512 f52b8e1977ea3b4e02f6a1ef3843b71a79558754f85bf012fb4ac0759e381fdeab05f3e2280b308b1afebe62b5a3104be1a0400861f051284ebcc759b6626ced
SSDEEP 393216:71W9VlHvRaV6K9fvAHR8fGb/1b1OrnqGFHR8fGbAHR8fGbgdETp6XiHR8fGb4HRO:71WDlP0EwvyeM/1hOuG5eMyeMGETpmYD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 2 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.twocloo.com.cn
File opened for read	/proc/cpuinfo	com.snowfish.a.a.bg

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.twocloo.com.cn

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/storage/emulated/0/Sonnenblume/res.apk	4593	com.twocloo.com.cn
/storage/emulated/0/Sonnenblume/res.apk	4662	com.snowfish.a.a.bg

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.twocloo.com.cn

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	.abc
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.twocloo.com.cn
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.snowfish.a.a.bg

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.twocloo.com.cn

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.twocloo.com.cn
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.snowfish.a.a.bg

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
42	alog.umeng.com

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.twocloo.com.cn

com.twocloo.com.cn
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4593

com.snowfish.a.a.bg
1⤵
- Checks CPU information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Checks if the internet connection is available
PID:4662

.abc
1⤵
- Queries information about running processes on the device
PID:4696

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

2cloo.db

Path /data/user/0/com.twocloo.com.cn/databases/2cloo.db
Size 56KB
SHA256 af74bad911a0f76259879ad4b57629d0061eb8790936bc10bb03ed9a1190babb
MD5 d5b312036504784e2b4e4a69c8be86a1
SHA1 b1a474d7c1533c363d7c1999d4f2062a4b2ddd7f
SHA512 3f754b0cb7b12f37839953ba7fdf91e04b729a453677483dd5e85fb876a494530ee56884d420f81d27eb7d3c5aa98e2db2b8b74af696050d5baa52df05a70bb7
SSDEEP 48:6mzNx6y1oBPxhIHXoqp5Y1s2tOu2kj20xUy2+0rU8L2YFSNm9:6myK4qbsGcIYY
MD5 SHA1 SHA512 SSDEEP

Submit Download

2cloo.db-journal

Path /data/user/0/com.twocloo.com.cn/databases/2cloo.db-journal
Size 512B
SHA256 c2a7b0a5d65643b638a5fa8630f3f73a2971bdfd354a6bb0528e02c89db57a56
MD5 0f9f8fb27e331f16f8e5e6d453a71959
SHA1 8db09a55402844fac16df28d13d6894dafd48953
SHA512 4d0c176461a7b7a889c753cdc27cd8a9f38ffda63b072b83f420314996550bedb64bb22be5544c07c330ddd5e3b138b918a2f74dbca3468a4c4af06e54ff21ca
MD5 SHA1 SHA512

Submit Download

2cloo.db-journal

Path /data/user/0/com.twocloo.com.cn/databases/2cloo.db-journal
Size 8KB
SHA256 be13d114c2046e3bc1487ce37cdfacfdef2925cac14ba621c4587f3893ef97cb
MD5 965971de4a6757781b46958c6bba99c2
SHA1 698394955d6aa5a7e71c201d20b61bd42b06bcd3
SHA512 c0334811178e99cfe42c9850702974e3b217a9e1768eec31ca9754e228ce90c2f61c078cea389cf323c86a51be74381cd252c8631f654e1eb8aabf3628fb2fb9
SSDEEP 12:yTGLpewxKjLwIIC+HLiI+yxzBit5WYL0xJ8kGvl1HgpqLiuWdYRmBEyPbPT:6m/xiLwI4WRZWxJ8kGvAqLiuWpGSPT
MD5 SHA1 SHA512 SSDEEP

Submit Download

2cloo.db-journal

Path /data/user/0/com.twocloo.com.cn/databases/2cloo.db-journal
Size 8KB
SHA256 72aa282d38d02ed30cbc765752510d0af35a59ee173a0e938c6051ed76180333
MD5 b06c709bbba0c4d9b61c1e3104fe4e18
SHA1 9f25e6da74a1eaf5b9238753a7ff5c68da588b98
SHA512 719d8f671186bd0543b7d9b71b751221f4309db24cc05fa4deb366255f7485d0e97b2553661ea586f3f27bb8eaa45bf4058a5ef32e1a1f156aa58be473eb9ec0
SSDEEP 12:yTGLpewxKjLwIIC+HLiI+yxzBi/REWYL0xJ8kGvl1HLqLJdeWRmBEyPbFk5:6m/xiLwI4WRkWxJ8kGvzqLJKGS65
MD5 SHA1 SHA512 SSDEEP

Submit Download

2cloo.db-journal

Path /data/user/0/com.twocloo.com.cn/databases/2cloo.db-journal
Size 12KB
SHA256 29e38d370169b087886447eb5624320601130616d8ea6f375f5c95eefa750938
MD5 889c980c52ac8144e53331cc23c39ef9
SHA1 29b922e8bfb3ae2848d8152339c6f9728b5022e2
SHA512 ef8adacbc2c4e7f059bcb22ba14ae74b75cfb95232c93d41620be1285438be25de49e31b3388005cc814a92494b2a8719ebc29e7424ba0b10d95165b3a7d6817
SSDEEP 48:6mzMx6hqVY1oBPxhIHXoqp5Y1s2tOu2kj20xUy2+0rU8L2YFSn:6mJh+w4qbsGcIYn
MD5 SHA1 SHA512 SSDEEP

Submit Download

2cloo.db-journal

Path /data/user/0/com.twocloo.com.cn/databases/2cloo.db-journal
Size 12KB
SHA256 c04ef4e6c972ce51e81911104201c84d5346bb46794790f57a8c90ec1839c5b9
MD5 d56b86cb1d088babea235bd31c63c63c
SHA1 f3200c2bc39a9ada2655971e25be77b6f4edd5ed
SHA512 332843b611b5fae70849076e70f62bacb0e8367bc3331975e890deaea13802a168014797726508ae4b34e5ac6f04feeb9139430b6247ffeee3102bf656e5ac55
SSDEEP 48:6mzPBx620fqCr1oBPxhIHXoqp5Y1s2tOu2kj20xUy2+0rU8L2YFSP:6muRJv4qbsGcIYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

mobclick_agent_sealed_com.twocloo.com.cn

Path /data/user/0/com.twocloo.com.cn/files/mobclick_agent_sealed_com.twocloo.com.cn
Size 520B
SHA256 4c95f5f4f10edd56f4b8263eb010324f427a642178e27f5aa285d4ea987cad24
MD5 590bc02967747ac7b0896bbd0f7163b0
SHA1 459ec0821f72d5ae7bc33c5cd1d38ea44eaf2370
SHA512 5c40fd132bde4e6a91fe10d5449e6c2263d39bfe55f4aad8a5b0bb2a7c238361098c35e6782fc4099e5fa3d90b47efc27b5abb89a64eba54cffe86ce3ee28cd0
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.twocloo.com.cn/files/umeng_it.cache
Size 148B
SHA256 f8f88ff2d5cdd991c3a3a13f7013d44f709cca5bfd230fb9bd448fed8cd9b704
MD5 ba4ad4e77bdc8c8eeb8669bd01348e58
SHA1 7aaa6192f76d2fb61e1a60a8cd27dbb2a58318e9
SHA512 cf571026b156a8163add321589b4702650a81ae69eaeb592b10bf40eb7ab36da14b02c0affe5c1e83698be0266fdbc5d8aea46928460eb0332817de46fc3cb3f
MD5 SHA1 SHA512

Submit Download

2cloo_error.log

Path /storage/emulated/0/2cloo_error.log
Size 1KB
SHA256 a086013a78c01c23a88846283b9273ca1b8fcde3bf428c335f703f89f0779738
MD5 9e7b0d307cda7199cb618b877538235b
SHA1 f4612b685668f94309433f5eafb693761095eded
SHA512 6dfca0901b8dbf7d5898c6954e4b1bc53ae714676899fc45e1da8ac3918597b54ae92faadd2cf01ff5499ae1234d49f781c5355862a02e33107576f12a6fd0d9
MD5 SHA1 SHA512

Submit Download

2cloo_error.log

Path /storage/emulated/0/2cloo_error.log
Size 1KB
SHA256 3ce0394df7c45d90182ed7f1867c41a89f0992b110f80fb699c17246884df463
MD5 7304ebe918337ae73672fb5e2d6e4303
SHA1 026bcf214934552714a02a8a4e28e1fb0398d1de
SHA512 e91b76123881dcf2735e51764174a6bed8692ba837a926134cea6c5571214a84fa59e268ac66d5f4c97e5b90bfb90cd5c78ade1cb8486f478ac7e968f1bc87ac
MD5 SHA1 SHA512

Submit Download

2cloo_error.log

Path /storage/emulated/0/2cloo_error.log
Size 1KB
SHA256 7e863ae9871b198a2fdb8bbf40abe3563a6c2a30b0e6198e17dd6092424ac481
MD5 7d23572681cc615f686aa9248df302b4
SHA1 6224ce4e69a866046bd2b3b29eca369fb42f67c4
SHA512 b407c39fc25e0042bfe3741df43e3dc4738e596d42efc62780913ae31766872b624710924f19530cc518021678a9c0a29a09813434ef03899a1b9b1fbd20c989
MD5 SHA1 SHA512

Submit Download

2cloo_error.log

Path /storage/emulated/0/2cloo_error.log
Size 1KB
SHA256 68bc5a1a21ae2c048a455d06bb8e7e2a06516c2a6c97640a615e6286be47f81a
MD5 dd8ba41d0a4ceb796b80700e8ab860be
SHA1 99ec0bd020a656ae7234694576843f9e31177cf1
SHA512 757c191297aa60cbd8a025cd1e92097dc6e2ea629727a6937acefaa454ae4ba5c738e4c1c95f3c6b9ad0489f3762f2af57d5f50bde91cc6dbe721bed7d23ed24
MD5 SHA1 SHA512

Submit Download

2cloo_error.log

Path /storage/emulated/0/2cloo_error.log
Size 1KB
SHA256 bbeeba549a6fe57319376916f342bc74d50c6ce4945530576962dbf7f4bf0903
MD5 0d69e680bf9384f2b15186542fc5e850
SHA1 1ba52440c22ee2f86a4691ff093eb68e234e9452
SHA512 ead9032e2f6b911d9cee5f6528433bd3606934a54fd808191cda6982a43dec2ec0a1a29b10bdd172a233485ccb542592301e969f26a64e79cf58edad7bd46e7c
MD5 SHA1 SHA512

Submit Download

2cloo_error.log

Path /storage/emulated/0/2cloo_error.log
Size 1KB
SHA256 e40202d753e91397eb82f3115ef11e3ef2b71eeda170369053c8f3041f1b83ab
MD5 592836ee0dec2bc6b345e36bf5fb54fb
SHA1 7afdad12fd78f7a7f1d22c3eec8d5492604762b2
SHA512 43c94faad200b760173484cf10e8f39b41247fb7f3922889b87a5afa3019c210bf4aeb79f0bbe5545704e7ac22d34f6d65d4c55e091d3afb163b3c384135f5c4
MD5 SHA1 SHA512

Submit Download

apayment.db

Path /storage/emulated/0/Sonnenblume/apayment.db
Size 36KB
SHA256 ca6b4c4fa36d8cd62ff50fbf47a815bd9353fff8c656aaad671327568719c4aa
MD5 176c116881e5d7c58de496c8389639f1
SHA1 bd2a337c2b7eb3e7d6eb818b9463d795d77315aa
SHA512 df61b7f4df5c1d7a8d090d9e1912eff219235bece31b4a38f7aa8daaee58d4f12b4557072e1ff86778d7024c9b6101705fb5c2747082084bb1a12e2724418e73
SSDEEP 12:TLG59ni2FZZSVUTfgIGGu3lh7sXwSvBaBAGgBsCXc/Y3fMBXyBiRmBEyPb8FOwIe:TLGrFt2UoIe3TwXwGioGSgIe
MD5 SHA1 SHA512 SSDEEP

Submit Download

apayment.db-journal

Path /storage/emulated/0/Sonnenblume/apayment.db-journal
Size 8KB
SHA256 258be1dd72803971f6d2d046a1176546b8ddc821eb9b51bade3872834eff4eb1
MD5 c6a41b1560710fa535bf5e8dc138bbe1
SHA1 f14e31fa3d6cbc567afef84d4a04bf13c1ed9a8e
SHA512 86b137006e8b2fa8b7bf85d7360a180bce47a84c0d4cd944933f8bf7abcd07a86f31ac63a88ea295d5959408825095a22d1c89dbb9407d3109ecc1dd28e4d22e
SSDEEP 6:7+/l9U2lGn1cCpg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKA:7+t5l1CpqLiuWdYRmBEyPbL
MD5 SHA1 SHA512 SSDEEP

Submit Download

apayment.db-journal

Path /storage/emulated/0/Sonnenblume/apayment.db-journal
Size 8KB
SHA256 5bd6d0d9f013bcd22947e0cb4565c9e4f1db6f0e1ebb7b2358c43df26e645aa3
MD5 fba6e3caae349a076a5d3fba2cc86b2b
SHA1 1ad01e10dd77df102227d9775090178c21f62b46
SHA512 21a1e0f0ef1b1fa43ca0ba58bc9a67cb43970cebe781681c7d1f9e37a126ab91c501a663c7aec61b1551773be2035e9b6ce3687c87848422f06979b57ac7d25e
SSDEEP 6:7+/l9zCGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKDC/Ly:7+tdC6qLJdeWRmBEyPbNG
MD5 SHA1 SHA512 SSDEEP

Submit Download

apayment.db-journal

Path /storage/emulated/0/Sonnenblume/apayment.db-journal
Size 512B
SHA256 499f018d5c1d002d4d300a326c816fdc9065c2d7b33409eaa26cd1f90625527d
MD5 4fd2d42d9d4c7c090648f98bf190e2eb
SHA1 7f71a92dfdb69192c91ac5d14b496877764ead91
SHA512 fe8db0bf03c7de887d6b643567e2961aa0494e44d20b71b86e77084d8b0aa5d20ae7fd7379a1d3ca92581aa63c33a1653674eae90f422bac9c36622607dd61d6
MD5 SHA1 SHA512

Submit Download

res.apk

Path /storage/emulated/0/Sonnenblume/res.apk
Size 286KB
SHA256 9423b0d4e9f1b3d8ddcfa46744730e25ef5993f996bd6f1737cc0676db7b347c
MD5 0bda2a3c278343bb5417e5556baea517
SHA1 894b1794bafb9723a6839d49c8a76ce579e2857a
SHA512 f770a35375efef90f8ee7c1f182f733e57c6af43ed8ba6b9a9e791ed77763a0b95b478ea89bb65947fd09bca715d24e5b2416e2b16fdbcef806454162530d885
SSDEEP 6144:LdhlEO+dA8IF4/VPJPNgz2MAO7HsQ5nSmSsPG:LbsISTNEE
MD5 SHA1 SHA512 SSDEEP

Download

res.apk.u

Path /storage/emulated/0/Sonnenblume/res.apk.u
Size 129KB
SHA256 40b824c6a8cf40b1360581465e09bc761dd4b9f75815c45f40991be7c5d7a0cc
MD5 36a2b3b2b934bc688230e7fa647146c7
SHA1 b318a4149c1a31aea813b24328747e738a297ad1
SHA512 057fe00ecf3a6ef9bbe884271c66a66e39da0d7ec3d927c426fae7c4abe4daa6b3932311c165590f40062134981393920958808c35889aa283e2a8947bcb36f2
SSDEEP 3072:zxfQrGKuVqeI81ZfIH6tEx2t/7SKYUqcgvApEjtd9eKs8:NQr8qWLm6yx4/7S+Xg4pENer8
MD5 SHA1 SHA512 SSDEEP

Submit Download

sf_idle.ini

Path /storage/emulated/0/Sonnenblume/sf_idle.ini
Size 12B
SHA256 a0403e12c1f78e0612f29ee790f8ee4a1640764ccc625602440569c247c28903
MD5 0a996632e07b79c51fdcab41fc9e90a8
SHA1 a719ff169a3f75db5e0452648b3548947e029929
SHA512 d69a24b224c060c8a7ec12b6ca08365b8c430a09aa3190406dccc860ea33e1922d132492a69c719ac20dc61537b7f581286b77de948f556cb33b712311cae55d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads