4f32a98ae8727f66e649c243b938d4cbdabeb0789dd8ee505df8ee509aec1d89

Analysis

max time kernel
16s
max time network
150s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
01/06/2024, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8951daf652772f6953e067d7ca815116_JaffaCakes118.apk
Size 15.0MB
Sample240601-eqd1maaa55
SHA256 4f32a98ae8727f66e649c243b938d4cbdabeb0789dd8ee505df8ee509aec1d89
MD5 8951daf652772f6953e067d7ca815116
SHA1 abbd6fe9ee17b2e6254ee3ed14177f417bc2e1f9
SHA512 dae0419654ab96d224197153a5dcda9038eca019e26580638aab48eb9a4441fc6a5cd82e37fb8483cdfa088f5a3f627aa68c080e6c6c244e2b3e4802ab00bde6
SSDEEP 196608:R1ZpyQ/f4kysrCxHi8ybG4Et1xnHd+JRLGd7M98pdEqahSicD3dbE+OPxwvfDIl:RI6OsYHPX4y1x9+gw98LEqwz+4wzIl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.aspirecn.xiaoxuntongParent.cq/[email protected]	5114	com.aspirecn.xiaoxuntongParent.cq
/data/user/0/com.aspirecn.xiaoxuntongParent.cq/[email protected]!classes2.dex	5114	com.aspirecn.xiaoxuntongParent.cq

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.aspirecn.xiaoxuntongParent.cq

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.aspirecn.xiaoxuntongParent.cq

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.aspirecn.xiaoxuntongParent.cq

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
25	s.appjiagu.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.aspirecn.xiaoxuntongParent.cq
1⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5114

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classes.dex

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/.jiagu/classes.dex
Size 3.8MB
SHA256 15f41f2e28fa17227c53eb01b7b0324cc26a6eb13949c1cdbbfb2cfc26287bda
MD5 e4ec278aab9de2b7729e36ae7558a9e8
SHA1 36d0de8630de2b6a5df02fbd4825fe70f8065dab
SHA512 bb04481587aa5ee5bf46313ea9a166fc5a2b5846f06a369ba418abbf93b7acfaeae35dc0790aeb5f3f0fcd497534d04b097a745a5102da2166caf89be96d99db
SSDEEP 49152:9HfbeuoOlD5rNEpIRcB9p190w3hg5j8WGaJA19fumc29BDd/f0m:9HfbFoO9TiIgZt5JaJA1Fjcef3
MD5 SHA1 SHA512 SSDEEP

Submit Download

libjiagu.so

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/.jiagu/libjiagu.so
Size 456KB
SHA256 707cbb7d210699b111f050a382224f04ba2dbf72ecb4ee8f420d5759b6a23681
MD5 7e7125a1193cfa8a696c1b8a6d2a103e
SHA1 af193df6127a47f455ebb7d5b792d2e982f4e004
SHA512 91a62f00c2a9dc3c28348ef512ca56ab44d999e11dd806d565109159e79f25833c9141023ad639c7f5132acb8038ca0d7cc049ca2118534570d3ef1b36798b03
SSDEEP 6144:lDjcsfgPhZt6JPe6xK2MiaDKApynUKpZ5wuPUrgNYQE4J5uKRz+EHwCNG6maDqY7:dfCZt8e6w33yn/P1YA2sz+EMqOm
MD5 SHA1 SHA512 SSDEEP

Submit Download

edupexpress.db

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/databases/edupexpress.db
Size 20KB
SHA256 fda50e9f1b8ce13103dc37179d914308b9d702ed44b56715b1fe395e5d1376a7
MD5 f6b9e0ba3a4953b520018e7cd1777992
SHA1 cd6460e0228878dbcf73d79736638825e5ec9cde
SHA512 1e6538c0339b7498ce69dae1405ed2d876591ce48477983aa4405cd640d9b7dbe9cfb06e860ec8d46ddde5b8b9e7cb4f0303de7b5541d5e4df25536705c066e4
SSDEEP 12:TLm2oyNTSFbysuLzlxi3XE9a2RmBEyPbAVOwG:TL/F3LLUwIGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

edupexpress.db-journal

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/databases/edupexpress.db-journal
Size 512B
SHA256 179a6d003d91e9990a2cd1e4ba6230eb8fa99d75bf747d5a2aced64bad653127
MD5 06d17c94012cd4f1e9ad57b01d700aa2
SHA1 fe1d16c54d0dea92d1373e36bcc2d9caf8aab283
SHA512 814565bcacb446dc975788282c22452a1921709def45cce1a6e1932a47aed3f597f3365ea8ab7776be665ceea5c57448d65a08784db43b9aaf11b37fe9ae986f
MD5 SHA1 SHA512

Submit Download

edupexpress.db-journal

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/databases/edupexpress.db-journal
Size 8KB
SHA256 ab034e85fcf2e9199845310974fb766fe66c3607016e054f41b607af713ba4a0
MD5 ec884c0d23970a7e13503b67f546b4d0
SHA1 92270baa2100c1d6b0ac497d27df55cdc87b2962
SHA512 4ef54b50d547762d91885001ace23ba13010b883656ec37104da6a0988bc497690a3d0887f16153608a653bd7c79fdb55c516af9cdbe77628ab566a2796482d9
SSDEEP 6:7+/l9Vpn1Eg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKeq:7+t0qLiuWdwRmBEyPbC
MD5 SHA1 SHA512 SSDEEP

Submit Download

edupexpress.db-journal

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/databases/edupexpress.db-journal
Size 8KB
SHA256 5ad6e688f185f11b93ac752215a483f4a432a4623a9f3cbb3503ac5b66d861d3
MD5 97aed462e4bfbbe8507ebedb45bd1bf4
SHA1 739eecee872ea3e9b06c666bb5ff6fd6ec9f0dd1
SHA512 d33c9b428285f207eaf8e136264ed87cfeeb3b36cdee385d0aee45486fa395fc1418152c000ba33ed1485d827ed5683cf101b4247d31bdce8d3ba24588d2dfe5
SSDEEP 6:7+/l96Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKL//D:7+tkqLJdTRmBEyPbYXD
MD5 SHA1 SHA512 SSDEEP

Submit Download

microschool_v2.db

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/databases/microschool_v2.db
Size 384KB
SHA256 c3a4bf748e08eedce7221d9a20eae1e9bb045b8acb2fa893ef5e694ff94cbfc0
MD5 720eb88461cb098f9e9bb48527ba0829
SHA1 90931cf9e0d2cee5486c1fcdadf65901e380aad3
SHA512 ce66f1ed9bd3c906e69b5645474646f39883cea509e6c153b70924cae2cc3790d2a60542aff3b612017100059d025fd3f68a394f45683870c85cc4af41cb648f
SSDEEP 768:4M9qyE8eh8rGJVlbe/dGAayt87JXscUeBqDbLRY++Xd4Up:K8e+rGJVla/dPayt87LqDPRYPXdp
MD5 SHA1 SHA512 SSDEEP

Submit Download

microschool_v2.db-journal

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/databases/microschool_v2.db-journal
Size 512B
SHA256 1422af992b5833b2469b60e50428298fccf94cd20ff1e6ae4e3744df42a917d7
MD5 85b53073f36431c9d1b46af2accee129
SHA1 72cf6b73b320d5413d3a3a85a2c9d8f40a88868f
SHA512 dc0a676b533284a292bc69cd7cd3f0c3a52b3006549ad2308cce782564c0ed51d1751e4fea1d046f8d24e7f3436ba36280570c0e73488ab25aa205d977b77c0d
MD5 SHA1 SHA512

Submit Download

microschool_v2.db-journal

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/databases/microschool_v2.db-journal
Size 8KB
SHA256 40d4a5fa8eedb433047c32c20886502f0d0a978e4bf47477b0a75015fac05cd7
MD5 cf512dbf84a48cf2d202d50a8c14be12
SHA1 40f890fd0ad43c9de900f241a92c7c48d9a0425e
SHA512 cf726052046f23f9d774e670746347d0af23d5fbca9deb34620dc8b2e4e28d2292b4f1a789dd49630f1d50d0c3a3a35dabcac3c5eecbb0c98dd6efa7e5c90099
SSDEEP 6:7+/l91Gn1Pfg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK4:7+tkfqLiuWdwRmBEyPbT
MD5 SHA1 SHA512 SSDEEP

Submit Download

microschool_v2.db-journal

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/databases/microschool_v2.db-journal
Size 8KB
SHA256 06553d23f0364697e425dcf6affbce455df42a0be49b1370e1a69e8f8218300f
MD5 fb980f77077959e1afa56a164aca5866
SHA1 ddda384d9d44aa544dd3959040ab05120989c7d9
SHA512 192bb0aab6beaf806f60fe24cf6e5588599c00efeb28f2589bff2649367613a740fa95490e95254672827a8f33c8f81aa1bcd4542f12151b3ccc58a0f9e46e3e
SSDEEP 6:7+/l9N/mHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKSM/n:7+tLwqLJdTRmBEyPbIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

.jg.ac

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/files/.jglogs/.jg.ac
Size 32B
SHA256 41386c53d0d511aa2983d46f08c525bab529eacf5ad40d24914719402098a8d4
MD5 1194b621e78188c8d0fb6c58c941545e
SHA1 a302fbc4b4b795afed2ad30abab12dd841887685
SHA512 507582a78bd135758405399b9ce135132d27bca5dfee8b22562d47e416cb5ff8cb1956938dfba8b00d2d1374e0eb3b83fe61dc408d77b5a418b3754e017e991e
MD5 SHA1 SHA512

Submit Download

.jg.di

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/files/.jglogs/.jg.di
Size 340B
SHA256 77365242560f53d341d770cea0d993fb186b11fd0c40fe63020b1613d6a0aa0a
MD5 a59ee813442beefda921c8eeac88bb0c
SHA1 6167a993ad1ae81a61066bed2af445a1b5827506
SHA512 2baf7d70cecee8a005fc542f871d72cc9ad4f3fe8c3287c5a403c4839bfea322a36458c7a3577ba489a80aac68232bc581da77a85ad023780d896423dd13c0d7
MD5 SHA1 SHA512

Submit Download

.jg.ic

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/files/.jglogs/.jg.ic
Size 32B
SHA256 ff187b83725f90f86ad1aa07f6406da12622966c5f678ed751c5e35b52f3df28
MD5 c376fb9e4f840807768a28042f1c20df
SHA1 d14db28471feedb65f0c46831a726b655a661e02
SHA512 0b45a112053a598d0d2c57443579f4fbde19404931ae4b5540d88c2b477648671ae0b802e3578ce09588c89ffbc93fb3306802aa977361afcbf4ab1c4e7d2d44
MD5 SHA1 SHA512

Submit Download

.jg.ri

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/files/.jglogs/.jg.ri
Size 314B
SHA256 e14e5143a6781d4774e00234a4ab6fe8e71227aae2dba27dffcb448b48800e9d
MD5 dcb4c11e2ecf571a68ce132721427e52
SHA1 2e07a54ac07eff6bc7b057ab78d86211066bfd79
SHA512 c3005077f1cb36b0b5bd76ab9e3893c73b67abe3ea1ac29889c2a8efa54d78964fdbdab79ce30fbc0c97aa528ededf42e0d2ff39985541b3784e8d806e105bed
MD5 SHA1 SHA512

Submit Download

.jiagu.lock

Path /data/data/com.aspirecn.xiaoxuntongParent.cq/files/.jiagu.lock
Size 27B
SHA256 d71ba724b22bacd4cbffeda4e880e504c13e3695050e6ef96b8f37c134f665d9
MD5 155c3282affc12af8c0c519a0a2f4bf4
SHA1 ea68927fa3a68606134c47e866bf6fcb7fbe07e0
SHA512 d70187330470f9939964f0e5ccc628dcf9e705aaa48d86ac745e25a50984642a0dcaa5cdf54a8c54200d3674f583f986e5260815d156afacbcf63e6ac92a13a8
MD5 SHA1 SHA512

Submit Download

[email protected]

Path /data/user/0/com.aspirecn.xiaoxuntongParent.cq/[email protected]
Size 5.7MB
SHA256 63b6b77021ca3e1c5c048a786dfe85e725f8f8d6456c500a7411187d1c2c4086
MD5 90055e293719e3d530d0fcbceab0d2a8
SHA1 ce6a992d0615106c08083644688b64c798315673
SHA512 bcbf5253afe1e4a71e81f237b611c072788026b58b1c25931018a6f1f191c8dc1d5626cfdaa3bee2ab90c9e5dfce15711028d639062a28faa28b7df8b373c229
SSDEEP 49152:I5bwMkLIPR5IqlTWkK62KmueEpkqzfhlMxPGnQ6qrlObI1lqAsnQhRUD9p190w3Y:It5BK62G3p/huon6rhlqAIZtK
MD5 SHA1 SHA512 SSDEEP

Download

[email protected]!classes2.dex

Path /data/user/0/com.aspirecn.xiaoxuntongParent.cq/[email protected]!classes2.dex
Size 3.7MB
SHA256 21c05e490daee4b457fc86755189aa65d250d5a78b8fb10e742de7fc1fe2885c
MD5 567711eab400aac97e4d412538a3f691
SHA1 0e5233595ba8fa0993b66e15a3c721f8bfa64a35
SHA512 8f71b5b6e4e7c64985d106c9c8105ce69860800853d8ac5b5f73e9abc5cd0b09af820feac14ecf94efd900b6862e110e86945b85d9702f1abe6eebb8a39d397f
SSDEEP 49152:RuFi7h/E7ywAbuer4wPmtnTDIk5JBgap0HWMsfJ3OjtIw7Shhi2mJs13UcO:RTt32hTmEUn
MD5 SHA1 SHA512 SSDEEP

Download

.deviceId

Path /storage/emulated/0/360/.deviceId
Size 48B
SHA256 36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
MD5 4c4c5285293d5141f582aefa4e038669
SHA1 e01852a72e5a8e6f7d63a21426b515118196047b
SHA512 097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399
MD5 SHA1 SHA512

Submit Download

.iddata

Path /storage/emulated/0/360/.iddata
Size 32B
SHA256 b0dfb8abf2bafeb6b7a3e737c2521a59f44fee908b45c3436f01ad73a4d43a01
MD5 22c1397dd180cb27781cc37206719bdf
SHA1 ad32ffb3a22c6fbec29675e70b8dbd020b399081
SHA512 64aa093981e2a2a792e8aa2b5fa973a1320471107b2f50307eb9bdd1b60586f200f4bd64dd09c79d9818d6f5fcbd54e3b74c20073c3c4a20dbb0610c1e202635
MD5 SHA1 SHA512

Submit Download

cq_20240601.txt

Path /storage/emulated/0/Android/data/com.aspirecn.xiaoxuntongParent.cq/cache/Log/cq_20240601.txt
Size 1KB
SHA256 b737c62e8f486e606801288fb7069a3d7a5d6edbe3282ecaf124ed30c8f9a4d5
MD5 d4f39bd3d6f46311916c91379592ec7b
SHA1 79e455dd7f67705747de74b12ddd19624204d6a6
SHA512 baab836b319edbe4f958fff2e1d91307167ccc5ad8a4737cde34b1a004af4f071ccef444a598c5640be7a4cb05d538631674c48b1e55112ef915a42427313fa0
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads