53c4db9f4e28b6b01465ec9ab52061c7c221ce77671daab5206ab90673763278

Analysis

max time kernel
178s
max time network
185s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
01-06-2024 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8be15230c11d67b8d2cc82e6f7741d3f_JaffaCakes118.apk
Size

4.3MB
MD5

8be15230c11d67b8d2cc82e6f7741d3f
SHA1

824a27cf1f7105c17f57145275be5e3af6db3b88
SHA256

53c4db9f4e28b6b01465ec9ab52061c7c221ce77671daab5206ab90673763278
SHA512

90af29c00a8378bf2d8995d6a6342100457962f57283b637e83c67dcd0b5eeeaec618832517aac8c20d5842d6cf1599de0d1c0f6e36a357f8e7dd81f218abec3
SSDEEP

98304:mQvsTDSI9S3a/tE/oo3yxyaf80zGijojJXwnqMV8L3/Bbc19/nMV8L3/Bbc19/tG:mXDSI9S3a1eR3yka00zGhFL3p29/BL3t

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	io.dcloud.H5D7DD228

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	io.dcloud.H5D7DD228

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	io.dcloud.H5D7DD228

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	io.dcloud.H5D7DD228

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	io.dcloud.H5D7DD228

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	io.dcloud.H5D7DD228
Framework service call	android.app.IActivityManager.registerReceiver	io.dcloud.H5D7DD228:pushservice

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.dcloud.H5D7DD228:pushservice
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.dcloud.H5D7DD228

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
26	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	io.dcloud.H5D7DD228:pushservice

io.dcloud.H5D7DD228
1⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4315

io.dcloud.H5D7DD228:pushservice
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4412

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/io.dcloud.H5D7DD228/databases/cc/cc.db

Filesize
36KB

MD5
ce6135aa1b1fe4f2c2db2a546d2a5558

SHA1
79b59582154017aadab783dc266fcb158c252940

SHA256
7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c

SHA512
2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

Download Submit
/data/data/io.dcloud.H5D7DD228/databases/cc/cc.db

Filesize
36KB

MD5
fd348517c53cc0123970ce8e62ef4e7c

SHA1
8bc6f0795a1760379c4798f7ba42dc205e5d7268

SHA256
228f6e9064a054413346021406992e4b7986c0ba194e0d8e05952073de5b811d

SHA512
424dbb895a064bec378dcbc99227166721c51cf416ac2d5edc522725d281895977af66b530fbf4e142f41ec30422748c5a239ebd859dba34143447b6fc67a94a

Download Submit
/data/data/io.dcloud.H5D7DD228/databases/cc/cc.db-journal

Filesize
512B

MD5
bee55ec342226ea9dd96a26aa70ad9d9

SHA1
d6aa8087bdedd49cd3945418d93d940d32755f5b

SHA256
5c4df08798edb575aeebbe9b2bbe0d1278a10877a5f2edb16d2d9659375d2c7c

SHA512
1187f1faee30057723474b49883b581dfa9fa0bd2fd9165ca25c1f32ef117ad3bd4c45d440b573041ef699043776fcb227e3adb2492b59a0c16beca95ac372e7

Download Submit
/data/data/io.dcloud.H5D7DD228/databases/cc/cc.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/io.dcloud.H5D7DD228/databases/cc/cc.db-wal

Filesize
16KB

MD5
e2aa3d1847fd44a04ead6441926187c8

SHA1
b7f48d46fec1e18d4aa3726f7dcda969bc006817

SHA256
b65ef01c6a6f587e39039164089964f7ae160379e3ece4f9f7c7bbd8032fc6c7

SHA512
18562cbe86b1c30cb00788cb09396c7567952a515e396c0a95ee143c37f5faabc8d8970a9302243a768e839ba3d24fb7718ebc7958b5ac9b40fc0fecb89b25da

Download Submit
/data/data/io.dcloud.H5D7DD228/databases/cc/cc.db-wal

Filesize
189KB

MD5
86977e9bc5c0f0fb2d13fafbb92d4825

SHA1
5e3c996df37da3cbb26b25b8da97c09885af3a80

SHA256
c68ab49b2e2cd278eb52d1e71b01992014f1a47c1b726ff243908d638aaa8e02

SHA512
74fea39f4b740654d5fdfde54c4ce22ce988a0183ab26f0a11bc3e0e15759a72eb27ede4dd1e92ed292a24a3f398c747fd6caf3f27ac1cc5d34b6f3d7aac0415

Download Submit
/data/data/io.dcloud.H5D7DD228/files/.um/um_cache_1717278207777.env

Filesize
1KB

MD5
3adad3f43253bee4003a68ea6d3ab728

SHA1
22f647b251e1c565da0aa34609e8a235ae79a6a1

SHA256
3780e93c1d323b8e8eee1570b3dd2b644919fcda21342d83bafd6a54a132889f

SHA512
5e3c0dc10c7b4d9149f07850680a1b599a729134c987159f5f66aec60110d4abd99a996608d78cf42bf6fa5c1791cd53819651970d904446d3dde9ca15ae6c4b

Download Submit
/data/data/io.dcloud.H5D7DD228/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
49ae4ccdb3a1a2f8892c722cb7f30fa4

SHA1
0e10999e523a751f682751b54f50ca7b3932a4fb

SHA256
a754fa1c0955054004246f6f7e74ba6b0ac72ced1d531d59463bf41fd3f240ac

SHA512
d6941768fd808a7810eb3f4dbdd262234e6783e138955d3bd4481b5c60b785d353004b5bed8c1c528e9a2a887a43128efd2eb048b2dd8cd03ba081a06f4585bd

Download Submit
/data/data/io.dcloud.H5D7DD228/files/init_c1.pid

Filesize
14B

MD5
f8543449bdce27a9f91991f0dcf7bacd

SHA1
3f7cd391964e38aec8a777c8a6c68a8ee607266b

SHA256
bf7ec6b686ee1d7dad74912601022903f051de1edae8d636ee72056470dcecc6

SHA512
32fac6e6fea44d913d999a6c5777741a5610487f8731f03cbbf247ffdc120e0c520e0708e8eba4b757b30a7420e7decd587f4398cdcb6612e36ff416d33a4dd8

Download Submit
/data/data/io.dcloud.H5D7DD228/files/umeng_it.cache

Filesize
498B

MD5
e801d9dcd5307180b85cc261b10f64d2

SHA1
cbc19fa30c12126200a9b594d0747ac16bd17dd0

SHA256
fd0ad5b5812cd4af9a18bce0066fe87bc58c31cc5a8f740c3ea386fe4426edce

SHA512
aeef7f97fa5075b6b9fee9a23099b006059fa62f8e493f9ffcb899a126947ced83a80ac626b7996aaf0f18aed0b6243d44f3e37d4b8a1d516c984e1424dd9e6c

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
381B

MD5
15a90a7da1dce8d588a9316b26d69523

SHA1
81e20c365a157d454b92bcfc2c23233dc8bae445

SHA256
3c3e32675df81b26b5fa4f2e270b788e46d21d1a97f06fbd35b24647ff742308

SHA512
ec86f38ab7548c6521f12f4fdef81e08850d21e5a78e0a249abfb571d00aa2bd80496f3e7240475aff469f90928d137593741b3fb4b11461fd4942dca33f8289

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
111B

MD5
f3855a6cfca3258785871e722e72d426

SHA1
2bf9b36c1177030ad1e53a77e929aa0cf6b08166

SHA256
4cbea81e65d4e30ad509ba01ea72b0ab023ffcd7b2c6a20d51cd89cdfc0d9045

SHA512
d500453f19b9360cae069c3421f793c266bca23a86ea26b1f7891a250aeefb81e0906db6117888a65157972346c37375274454121337cbca00294193ccef6202

Download Submit
/storage/emulated/0/libs/io.dcloud.H5D7DD228.bin

Filesize
111B

MD5
a81264aa7c66c387f0a4443e694b3ace

SHA1
caf0d4ee585acd0ff90ae4b9b817eb4f7d65baf7

SHA256
3c203d61bdec982bbeb0bbf823530bf0feaddccebf857b54e35919589bd10fde

SHA512
a96a5b61643acf7994278108aaf1b6dfed862ab46f620e0388115659b23c287195b76f362d89ec082be64f3390fc3459ad0decb9225019cfaf1879e55a902178

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads