f94ffc60ff2f11dec86797a27a6e1eaea683c0441efd58c0f6e8d88352b299d4

Analysis

max time kernel
64s
max time network
183s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
01/06/2024, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89ce380d048ec891986c7f1f1b4b0704_JaffaCakes118.apk
Size 4.7MB
Sample240601-jrtvpafd64
SHA256 f94ffc60ff2f11dec86797a27a6e1eaea683c0441efd58c0f6e8d88352b299d4
MD5 89ce380d048ec891986c7f1f1b4b0704
SHA1 c4c50e757825b9ce3f14a926629c2271dd965ea3
SHA512 d6f37732555b2907ec03705a61db038fa18d8672bfc97a2482e4b1ea6577e29f1d3ed0f12353888b9ef805f6538e89a9755745d5e678aa3ec24cf233d5e208af
SSDEEP 98304:nZl44dy1OFZWWCtYlRfhnCjDCO4FhS5nJM+AVfvehCOs/yvaUH:nrDCARZnPO4LknJfA8n
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.ting.etgsdq

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ting.etgsdq

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ting.etgsdq

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ting.etgsdq/cache/ads3405628516719989444.jar	5094	com.ting.etgsdq

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ting.etgsdq

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ting.etgsdq

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ting.etgsdq

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.ting.etgsdq

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ting.etgsdq

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ting.etgsdq

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ting.etgsdq
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ting.etgsdq:bdservice_v1

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
11	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ting.etgsdq
Framework API call	javax.crypto.Cipher.doFinal	com.ting.etgsdq:bdservice_v1

com.ting.etgsdq
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5094

com.ting.etgsdq:bdservice_v1
1⤵
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5176

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

ads3405628516719989444.jar

Path /data/data/com.ting.etgsdq/cache/ads3405628516719989444.jar
Size 2KB
SHA256 ee2de01a238f9e1834f9f9934dd1f5b267bdf9747965641d2fd636d740041f9b
MD5 d80f6d032778b02d10a9c9a2f1a24714
SHA1 e34d4ea9618b1b499b65032723ea029ab3998500
SHA512 34fa52d41831142f86999ac407aafeb2b69bb4cd45ada9f739be84c80deb0414d11d6784f385eec287e4f6b5bdf29ba1c9a6a77c07707d66a73c60eb389136e1
MD5 SHA1 SHA512

Submit Download

subting.db

Path /data/data/com.ting.etgsdq/databases/subting.db
Size 20KB
SHA256 008cbee97bb10c72280a4bb3dd9c96805b35cd215c7cdb820f7967fdd7472bac
MD5 ba2995e990b5cedbcf9afe0afa4a8fc6
SHA1 9a466a8a56307c3658cff75ba0ca8937ce0ef0aa
SHA512 354fe8e1bbccbe92a1bcb65686180265589792ea0bb84981adbc95e86f98aa9b7e0e1fbb7cf10659e7c75396d8030ba2eae63da4724292769ef135f14e7b62dd
SSDEEP 12:TLg5yNTSFbyN6h9TRdM9cdMi7B6RfER9jmdMUdMHdMklVlA2WHk3vfdMDX0dMpU0:TLgMG/G8QRfFzy9M8V9drgkHWGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

subting.db-journal

Path /data/data/com.ting.etgsdq/databases/subting.db-journal
Size 512B
SHA256 9ab52a1543f77b0ee4533d451b4cf1f1b4a2614fd25cfa3e120be38c1e381913
MD5 ec7026e65f84db2d6965beb3f0d0e347
SHA1 ec6c712dec1a1bdbfc37ec4362b2e75965b78cb7
SHA512 9cc6a47a651cc3ed0650cf7c30f60c68b5a8b13a63a48d5fc551ebaec416f1ae1c809564e9974192a90de7297ecd4c5fb243df2abc84b705305e55b4fd466865
MD5 SHA1 SHA512

Submit Download

subting.db-journal

Path /data/data/com.ting.etgsdq/databases/subting.db-journal
Size 8KB
SHA256 14001b26537be59fe231f694c3435489c43d931a006bf7411dc7c5c5e374f233
MD5 5205f51fbc51f369f688429a5d3b62a1
SHA1 3d6617422eda4051d379d5c7b9d1c186cc64c6f3
SHA512 459f7b8eee14ee6ef9cadc3fd596fdfa079c6a4659540a73a2e0eefcf59d19e572c6e8f0a4d71e07ea8a9e32a31f59862bb85dddc48d50ed7dead920b0bb0119
SSDEEP 6:7+/l90qFn1Ug9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKGg:7+t3AqLiuWdwRmBEyPblg
MD5 SHA1 SHA512 SSDEEP

Submit Download

subting.db-journal

Path /data/data/com.ting.etgsdq/databases/subting.db-journal
Size 8KB
SHA256 f8e648d8fbfab5c2b4997b015f3397fbc95e2169cfa125a40582ce3c50ae4d30
MD5 82f0980f92cc3054a50d2b667b74c0b9
SHA1 aa0abd8600e4a1bd149aa854dd25e645d732e1cf
SHA512 7607fb1a95960fa1672aa4d8cf1d330f885aec1d6b91b3cb3c3a8748928d06677395e75823cbe3b968f5e6e80d9cc2f761950172940c283e6381a0ef34606858
SSDEEP 6:7+/l9hPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKvC/6:7+tHqLJdTRmBEyPb0S6
MD5 SHA1 SHA512 SSDEEP

Submit Download

mobclick_agent_cached_com.ting.etgsdq

Path /data/data/com.ting.etgsdq/files/mobclick_agent_cached_com.ting.etgsdq
Size 121B
SHA256 4804eeef9ee80cba7d88c67ab3c687387925d2b9d0257e5554ccaba5eb11aef2
MD5 8dddae6079c48f682d90105a5cb2322e
SHA1 a135d28352354cbfbdafdabf60f68bc341d241a2
SHA512 046a36ae250f2bf793473d3065643f15f0b957148e497a4efe9d9baae07c24044773ad2d91d06fa73e5051921c7895bf2d0074839b905e710587d14c8fc70698
MD5 SHA1 SHA512

Submit Download

tcagent.db

Path /data/data/com.ting.etgsdq/files/tcagent.db
Size 40KB
SHA256 96c0703d6db4575d2d0dd141f91169ca2e30f8ed43178424d390e989d5fc8e5e
MD5 5533e0d370e7c25a56e5c1dfe5242607
SHA1 5dd874ae56c33452f81131d02a894e88a7bfcea8
SHA512 33f7969ae64848f38da10be37383e821e869dfd92082fb0f013c622f6c1dd30577ca8b7778eaf1b7ad7024ca8c5a85eac80416b0e4e6b1bcf3764a8dfd965088
SSDEEP 24:TL1Kqg/30tRMFd3MNM2lF4rr7nq7qyS9DbJSrkFEqiRgyBFOrjqFMClFCBF1bGS8:Taz1MOSgnuMYbBFQSnfKASDw
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db

Path /data/data/com.ting.etgsdq/files/tcagent.db
Size 24KB
SHA256 4f55d7f0c93d040f33b4c3f961d187111e79f3d1f4608c0426e228c1fd7033c8
MD5 47c2b9a5b520cebe9369d77026d14c37
SHA1 6581ae6af11705821466cb9f5936e95df4c3dfbc
SHA512 3427dd21efc1ea98f7d2a211bb339ff8fae36c0ab623fabe84f72abc7b8aec063cf533f78d0f100e66b10ffd35a346d2c22b68e1a710e192fb5b4d9c675c23ff
SSDEEP 48:TWxeYTDHY8qlBaUd/gpTSP/8E4MyNmLrMyLGZ7MyLGZR8:Stg8ql8Ud/gpWPjy4kyLAQyLAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db

Path /data/data/com.ting.etgsdq/files/tcagent.db
Size 24KB
SHA256 2d1739ca99ee510f930cdae9354327228e39fad60e7cecb002839a482e94ff0b
MD5 c44d14c9901f3bde71804114d900a58b
SHA1 417235ad4f2299ea9e6a43370d605c49874b7de2
SHA512 6872620e9dbe90d2fc5cc7f424388d7121e92f10fa1b5f07c381fd6f4b0da73fc11860f9ac01d343f0d3b3ce9e2f8ae75e4e9986a73830952f5d4a643ac0125d
SSDEEP 24:TLa3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/hXcysmGZc+8:TGxeYTDHY8qlBaUd/gpTSP/hMyLGZR8
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db-journal

Path /data/data/com.ting.etgsdq/files/tcagent.db-journal
Size 512B
SHA256 fc95440aa5e58bf5bcf337d2581b5d884dc5e2db03f16f71636dca9cecf98379
MD5 eeaf2539d988dc8d2c2eda102ba15dd1
SHA1 23d9a221b99a68b5e29295e8d2a41e7819b35105
SHA512 906d6c2aaff946c3f7cc3557d24c563336c4cf687d948abc88c0ad06099446f2437bb593394b187a8fd52e3f5a01a2b03ddf778ded7dee6df82d60a46c1062a4
MD5 SHA1 SHA512

Submit Download

tcagent.db-journal

Path /data/data/com.ting.etgsdq/files/tcagent.db-journal
Size 8KB
SHA256 35d687f7cc1129a20e65c0333d2c14f031b3c043691436968b1cebb720d90291
MD5 be3da0472d4d9d4f05f10a879cd54c92
SHA1 7d5ee74197d405f1580029b3f56f6576a3beb708
SHA512 0e3824b02e9a3e69fb5e61f1e9c8ac1a3e689747c102e274ac9991eaced7ab5e0ec67a0dfd23dd01bec48a593adeb4a79915df44efcfcda3dffa9e3de5cd2ae5
SSDEEP 6:7+/l9UoFn1MLRg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKHln:7+tALRqLiuWdwRmBEyPbSln
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db-journal

Path /data/data/com.ting.etgsdq/files/tcagent.db-journal
Size 8KB
SHA256 0fda28c9ce5dc96d78ae9660cc1863d5128f5bfa5d3ec4c285d7e837d411d19e
MD5 d550511dedb91b39a7605b3d1f539749
SHA1 8effe15be9645bfc47c6738e07c3f0a851370c73
SHA512 f6ac4b87c6ed982bade1597084fb2ecf8a7bd36333e2e198ae512979a0c61e972d7732e4803470687d53ae5c6a92079c944526a914921eaad605c070e5e1f82a
SSDEEP 6:7+/l92Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuK7ul0//3n:7+tYqLJdTRmBEyPbk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db-journal

Path /data/data/com.ting.etgsdq/files/tcagent.db-journal
Size 12KB
SHA256 a0f470ba20087c5b97898fadb52284f41696dd36690550cd516df97114fc38a8
MD5 5c203be3c3278d540fac0c73304ba937
SHA1 f08ed740ec63629a5f06200bc3b069bf9cb61f19
SHA512 cc12301d34a5259105035bca1c94541af9800edc24b60c0e2d4eeb12c481138e37fd545fbf8fab49a14bf66fa3252ea5531e822c7657086cb094d5222fa98776
SSDEEP 24:7+tqqL8qg/30tRMFd3MNM2lF4rr7nq7qyS9DbJSrkFEqiRgyBFOrjqFMClFCBF19:7Mqq6z1MOSgnuMYbBFQSnfKASd
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db-journal

Path /data/data/com.ting.etgsdq/files/tcagent.db-journal
Size 16KB
SHA256 4599094ccdf56bce5bf87add5cfc3d1356e35ab1273918c567dd6c53b1386c3b
MD5 6b0c38273035bc74da750d0685337f87
SHA1 121840a7d245d267b907ec9930c3410e1c5b890a
SHA512 7c1364157f97389979b0e0ea31a879e8fb314dd2e8b14bd220255088842a1dfd01e77fcbd98d54e7d95fc2dcff5b7ff513d4fba9b2cba09ca79cf9111eb0cf72
SSDEEP 24:7+t2mqLw7qg/30tRMFd3MNM2lF4rr7nq7qyS9DbJSrkFEqiRgyBFOrjqFMClFCBG:7MxqkJz1MOSgnuMYbBFQSnfKASe
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db-journal

Path /data/data/com.ting.etgsdq/files/tcagent.db-journal
Size 12KB
SHA256 3b3b7e2551d313d4c093ded7733424929d161c8397e0e41c53d7466d9b247e13
MD5 74394935b5bd85c5888089ca82755cfe
SHA1 35113cf07d18d566cc5869e021bab35ad8168725
SHA512 7d15422ffbe0dce113523bfffa962cfa0249abd61c5d9196e1ffbea74302cd5b3fb493e28f1b42ccc31a3de0be16cc507e5abbecf5c1a25f10aa6bf678d8d469
SSDEEP 48:7MRtdMyLGZRUhqGxeYTDHY8qlBaUd/gpTS+:7G0yLA2Btg8ql8Ud/gpW+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ads3405628516719989444.jar

Path /data/user/0/com.ting.etgsdq/cache/ads3405628516719989444.jar
Size 4KB
SHA256 f3c142f78cadcb57d7da3d8e4dc5f8c7b05377417c639059910696c844afc1f9
MD5 12670a32ad1380c9021a9e74aa5f2281
SHA1 7e8caf0c7a4d78452efb90958e8ce1aae5148e44
SHA512 1277dde373cab02d5df62732834adb79f8dbf1d1a9ac56b5b348e354317fadc24fe20b5ebdd1ecc28f8fc98dcdff807d2839bef75ef7d871e976e68a95851b06
SSDEEP 96:8V0+Z8fg8M9CC/mkE2K6Uq7tJ5FVDNqv3jokVbdzfgDmM0/:8VXYglD+kE2K6r36v3dLgKx
MD5 SHA1 SHA512 SSDEEP

Download

.tid

Path /storage/emulated/0/.tid
Size 32B
SHA256 95efba4b752480bebfb18a77c05be19e63b00b3badf1a19a00a60a27d21f3877
MD5 7101cee15d2f913695d77b112cafa081
SHA1 aaa47f4516feee27d3b8f267bde669e4835da6c2
SHA512 0c0e48a2cab25ea291a19842c4f0185549f9d147ec22cf976ecd8e9acd9661a2bad6c8ef2f748590c8f0e7f1fbaf8c6320e83e523d5f948df440ecb4b1125b9c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads