f94ffc60ff2f11dec86797a27a6e1eaea683c0441efd58c0f6e8d88352b299d4

Analysis

max time kernel
63s
max time network
183s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
01/06/2024, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89ce380d048ec891986c7f1f1b4b0704_JaffaCakes118.apk
Size 4.7MB
Sample240601-jrtvpafd64
SHA256 f94ffc60ff2f11dec86797a27a6e1eaea683c0441efd58c0f6e8d88352b299d4
MD5 89ce380d048ec891986c7f1f1b4b0704
SHA1 c4c50e757825b9ce3f14a926629c2271dd965ea3
SHA512 d6f37732555b2907ec03705a61db038fa18d8672bfc97a2482e4b1ea6577e29f1d3ed0f12353888b9ef805f6538e89a9755745d5e678aa3ec24cf233d5e208af
SSDEEP 98304:nZl44dy1OFZWWCtYlRfhnCjDCO4FhS5nJM+AVfvehCOs/yvaUH:nrDCARZnPO4LknJfA8n
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.ting.etgsdq

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ting.etgsdq

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ting.etgsdq

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ting.etgsdq/cache/ads4126111517021849174.jar	4615	com.ting.etgsdq

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ting.etgsdq

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ting.etgsdq

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ting.etgsdq

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ting.etgsdq
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ting.etgsdq:bdservice_v1

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
25	alog.umeng.com

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ting.etgsdq:bdservice_v1
Framework API call	javax.crypto.Cipher.doFinal	com.ting.etgsdq

com.ting.etgsdq
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4615

com.ting.etgsdq:bdservice_v1
1⤵
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4684

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

ads4126111517021849174.jar

Path /data/user/0/com.ting.etgsdq/cache/ads4126111517021849174.jar
Size 2KB
SHA256 ee2de01a238f9e1834f9f9934dd1f5b267bdf9747965641d2fd636d740041f9b
MD5 d80f6d032778b02d10a9c9a2f1a24714
SHA1 e34d4ea9618b1b499b65032723ea029ab3998500
SHA512 34fa52d41831142f86999ac407aafeb2b69bb4cd45ada9f739be84c80deb0414d11d6784f385eec287e4f6b5bdf29ba1c9a6a77c07707d66a73c60eb389136e1
MD5 SHA1 SHA512

Submit Download

ads4126111517021849174.jar

Path /data/user/0/com.ting.etgsdq/cache/ads4126111517021849174.jar
Size 4KB
SHA256 f3c142f78cadcb57d7da3d8e4dc5f8c7b05377417c639059910696c844afc1f9
MD5 12670a32ad1380c9021a9e74aa5f2281
SHA1 7e8caf0c7a4d78452efb90958e8ce1aae5148e44
SHA512 1277dde373cab02d5df62732834adb79f8dbf1d1a9ac56b5b348e354317fadc24fe20b5ebdd1ecc28f8fc98dcdff807d2839bef75ef7d871e976e68a95851b06
SSDEEP 96:8V0+Z8fg8M9CC/mkE2K6Uq7tJ5FVDNqv3jokVbdzfgDmM0/:8VXYglD+kE2K6r36v3dLgKx
MD5 SHA1 SHA512 SSDEEP

Download

subting.db

Path /data/user/0/com.ting.etgsdq/databases/subting.db
Size 20KB
SHA256 84516610c4a7a886bef5fe415dfae8f0eaea6ecc19f942c8c910e61271411836
MD5 d33a763baca13e7e9093bfb4608cf85f
SHA1 dfd9eb374da482ea48669bd5d28be2cb3bd7b00a
SHA512 b9916a868253748f9f51821f4d12b280e66398cd819d31f237b4959b784dd8bb0cf5021a14c5731f3120f7344dc95381b273fcbfb090b4e1fa8607fdb4b5f84a
SSDEEP 12:TLgEEyNTSFbyN6h9TRdM9cdMi7B6RfER9jmdMUdMHdMklVlA2WHk3vfdMDX0dMpJ:TLgERG/G8QRfFzy9M8V9drgkHWGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

subting.db-journal

Path /data/user/0/com.ting.etgsdq/databases/subting.db-journal
Size 512B
SHA256 a963f684683e394be5206c51d55d30d73931a504a7bb8037c06a7e4be156e4f6
MD5 70f0d104dc1ddf193776396ab7142309
SHA1 e00407a311bea6877f50451490e7652caecc9326
SHA512 9c71179c10a375a10b13cf1262bdc5821d28a582b8e584faa73c4094f3b80c5a3f3a94e918d7561b527d6f852e2d1d1063bcb43bd8f618e0348fbb4eabcc59c9
MD5 SHA1 SHA512

Submit Download

subting.db-journal

Path /data/user/0/com.ting.etgsdq/databases/subting.db-journal
Size 8KB
SHA256 e8259312ee49c5917baaa2c7dea9e7b8b29b3639c773e6ff43f737ecdea6b2ad
MD5 70737a13e87d574644e1d75deb9fae56
SHA1 90af7fc63d4b15c722565c32f02fce53b48b99a1
SHA512 34ad0b8939a3220d548676b1f1272c204dd8729e4f1732629ad929bb8002901a4a6c67aaf6935d5e3e447924ad224a5b86208c6368f76778f586f585bcdff858
SSDEEP 6:7+/l917gn1q8ng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKuR:7+t/UqLiuWdYRmBEyPbfR
MD5 SHA1 SHA512 SSDEEP

Submit Download

subting.db-journal

Path /data/user/0/com.ting.etgsdq/databases/subting.db-journal
Size 8KB
SHA256 a31a1c98402eee22b13ca03c7bf499c3b43cbc0511fc9254d1c99cb64b43ceca
MD5 7a8c84ed2e474bcb948ab45aa5a23317
SHA1 61da57d111a8935a29edd604852c49d51f9e0e02
SHA512 cdfacfd588b5d0c21c4606b0a512484c436b190d5931353e796f7f022efb353abd451c3f125dcf154804e2993391651f2408f0557954eda41bae97d72fcaac02
SSDEEP 6:7+/l9jJFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK4wOl//oZn:7+tBJBqLJdeWRmBEyPbzXoZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mobclick_agent_cached_com.ting.etgsdq

Path /data/user/0/com.ting.etgsdq/files/mobclick_agent_cached_com.ting.etgsdq
Size 121B
SHA256 75ee79303a572ce875beff637345cac08052427bddb573a95c8347e01ac5d782
MD5 14e412693eaf55e1dd5175b8b9f79e56
SHA1 86064e09bf6498e173aa755b4e740fd3cf3ff740
SHA512 e78a28a19db0269b6e5abc0811e5aea47b7bd5ac711419038ce0e4812a5617e1787a6f839387c40e7ab56c35c84256e2c5bb0da97cbc4f795e9f5e28ec2abf6b
MD5 SHA1 SHA512

Submit Download

tcagent.db

Path /data/user/0/com.ting.etgsdq/files/tcagent.db
Size 40KB
SHA256 51e57a9d0f16cce0bae8e08b5c489bf6bd2524377816eebe8d9d2310c3cb3959
MD5 2c6ad66b74b2d18c823a57149b8e83e6
SHA1 174a3de2255d1ac1afb82d9205388b8785301398
SHA512 4a5af6aedeab4329fc2faee118aaaa7bb1d0faa0494fa33429ef63b0b82b02e0de9e713f9f372073f2f71f437a55d3e17b2e5d02fed2e1cad499b8d419fc426e
SSDEEP 24:TLd5g/30tRMFd3MNM2lF4rr7nq7qyS9DbJSrkFEqiRgyBFOrjqFMClFCBF1bGSv/:TJ8z1MOSgnuMYbBFQSnfKASK9w
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db

Path /data/user/0/com.ting.etgsdq/files/tcagent.db
Size 24KB
SHA256 bba11be4bda3eae6f0a57e3ae99ed332d447476c2731f1a01de407800367da0b
MD5 d2ea73059712cd56b67c14308f7604fa
SHA1 6df3c15837000e5e8955a0d61dda98e12e602f45
SHA512 4c2aae7351e14321e4d7779906cdd560f02ab4d9806681b26ebaf0cd130ddbaefacf75f55d897aa398b81b5d7d328313cdfeceda7a973aa4cef772025faf4496
SSDEEP 48:TuxeYTDHY8qlBaUd/gpTSP/8E4MyNm+CMyLGZtMyLGZ8Cp:atg8ql8Ud/gpWPjy4qyLAOyLA8E
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db

Path /data/user/0/com.ting.etgsdq/files/tcagent.db
Size 24KB
SHA256 d95673b54eaabe03f88971c74c557cb86059fcaadebb181cfd3bf1bcd6c36034
MD5 1431c5cdc397c4b41400c4689f65678e
SHA1 22f9ea1b23c4eb19bf3a73bfff156917fc398b23
SHA512 c6227af4137ade8e0e59ea8fd0467e61aa9986b2da0b65cb6237cf186ee52076c8d03523ca50680b4db9b36b4132ffcd5f2cce6b3a976555901d81429d915fd7
SSDEEP 24:TLS3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/qvXcysmGZct6dnp:T+xeYTDHY8qlBaUd/gpTSP/+MyLGZ8Cp
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db-journal

Path /data/user/0/com.ting.etgsdq/files/tcagent.db-journal
Size 512B
SHA256 df978c2a5244df8f25f6d600dc83ffbda03ac4d64b69b3689e6ca2b956415415
MD5 2f5879e13973bc6939d7e6f3e97ea32f
SHA1 94b3cb11b58b8d21f69ea1ea496dabc03b1cd08a
SHA512 2f3ccd42fc28b9129143e134772934841f678a5e328e0e9a062905848ff346d8bf10b5a4dd129e733df8374389e2a52b368a9c2a22b5fb2eee12e6b031c06ca7
MD5 SHA1 SHA512

Submit Download

tcagent.db-journal

Path /data/user/0/com.ting.etgsdq/files/tcagent.db-journal
Size 8KB
SHA256 099b03cd3f5f08f7ca72b30d0a46277c83effde9ca08986a0f42d9c09c77be82
MD5 576cdd9ce25f3d01c6126685cb99f841
SHA1 46b8a9b525e16e06db750d75d5a41fb0bb1fa3b1
SHA512 618767a06025921444f5479fd40e478abdce2383ed8ad0f3d9a9c4f36252e52c75271b9297a4d91a18d360049000b035cb42410ea0921d5fd3b44f4654e4a3cf
SSDEEP 6:7+/l96n1Lpg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK0F:7+tsqLiuWdYRmBEyPbXF
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db-journal

Path /data/user/0/com.ting.etgsdq/files/tcagent.db-journal
Size 8KB
SHA256 565d30d27632db86abc3f5bbffbf8e493e34f1bb0a9eaf49e801d32e5351cc76
MD5 1b309c4b630becfe0e34d08bc1e1f085
SHA1 40dbe9be674abdfe18bd88d4d41bb52bd7dc6976
SHA512 0b169ba45dc3e4f79a9d825e37075291b2626706d2007811866c182b10a30bce67a05d1bf2b4afc998d2aeaa1833350b65a2ed66716e2d42cee46e96f6d6080e
SSDEEP 6:7+/l97f4Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKgN9s//qq:7+tZfwqLJdeWRmBEyPbFsR
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db-journal

Path /data/user/0/com.ting.etgsdq/files/tcagent.db-journal
Size 12KB
SHA256 93813093bc9b7654ae822c9594859ff59643eae9e7da8563031f3089d7e70f9d
MD5 76d416add5c225ae6e454cee652fc97a
SHA1 f6f68b85bc10d2dcf2b5e6f28c6854b05811d36a
SHA512 269646f90b8fcf9705541e96c382eec535b7b0be0525a65a89de538a8f9ab49a075ea0368eaa00b6660b2f24ef80f32e1959c31c91b77fcb07e64f31ab3ad505
SSDEEP 24:7+tyqLDg/30tRMFd3MNM2lF4rr7nq7qyS9DbJSrkFEqiRgyBFOrjqFMClFCBF1bg:7MyqCz1MOSgnuMYbBFQSnfKASk
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db-journal

Path /data/user/0/com.ting.etgsdq/files/tcagent.db-journal
Size 16KB
SHA256 84249e0049f14af1c09163d2360a110ffff531351e7af2e64e6b9fa874c55228
MD5 05ffb18c5f7bd8a09774c19291da41d9
SHA1 ec25ddbba480785c7825e950dac9119054af3eeb
SHA512 4af644db8d5a3a60bae2cee0f0ece87521ac5fe87381dedfe08cd1c9213c8f4f14a6dbb40192039ebe935ff4a07e983dda0dd3cc0d03241e0db922728009e66f
SSDEEP 24:7+tgJ2vqLzg/30tRMFd3MNM2lF4rr7nq7qyS9DbJSrkFEqiRgyBFOrjqFMClFCB0:7MuWqSz1MOSgnuMYbBFQSnfKASs
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcagent.db-journal

Path /data/user/0/com.ting.etgsdq/files/tcagent.db-journal
Size 12KB
SHA256 1474d0ad12286bcce0d3ad44f1b4b591e4d41f46a665769f00ddcb191568e4b9
MD5 59a395ce965ab5ab918fba29883e2859
SHA1 e220ea2da14408af80d2d055c2c5df7e5644b017
SHA512 ecd789dafa0cc53cb1a087dc7f962e84f22cf78499d3e6f77d2a4e59748b3fa84264db71fd782be745f0e4ee9d673beba3630f47a618b0e551bbada29ec89143
SSDEEP 48:7MXKMyLGZ8CLq+xeYTDHY8qlBaUd/gpTSfe:72yLA8wptg8ql8Ud/gpWm
MD5 SHA1 SHA512 SSDEEP

Submit Download

.tid

Path /storage/emulated/0/.tid
Size 32B
SHA256 cf816d08f61efe9b51c002f0d26170ac9fa50d7c9ada06d1831f27a774fce138
MD5 c04226cb017ab1bc05263bfa4a063f6a
SHA1 a5b7c57f556b71c34353226d31f4fb2b4ae2503f
SHA512 bdda475a42556f06b46497e6a296bcc9c367d4562b0e1f6be4c35238d50ae22bfa9796a42e9aeb96f4801f1bc8323bc7f8c572c09690ba8d22a7bba65a0d3448
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads