cbd688dbe049aa0cf1c70179bc44a5dba0b7fb86c4cbf1d8805c1e4bed67aad2

Analysis

max time kernel
19s
max time network
134s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
03/06/2024, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9111a9f43cd8eec64f827f2445a39b3b_JaffaCakes118.apk
Size 11.9MB
Sample240603-j24gwaaa82
SHA256 cbd688dbe049aa0cf1c70179bc44a5dba0b7fb86c4cbf1d8805c1e4bed67aad2
MD5 9111a9f43cd8eec64f827f2445a39b3b
SHA1 b7132bbc28c45b8d5d8dd1d75269dfaf2ad926e6
SHA512 ecf05d130e417e1d00cfa1b340d221d9364e66665e6a9733f2d8fd89105bfd20375d8507c839eebccae85801da04c2449dde34932ea5d4d186985e0b44ef76b9
SSDEEP 196608:zRfvY6U7ITDJO7U19gOJrScrfqf1voD2BkBKNVfRj:ztZcKJfgerSifM1o6aBKNbj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.lx.launcher

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lx.launcher

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.lx.launcher

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.lx.launcher

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lx.launcher

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
20	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lx.launcher

com.lx.launcher
1⤵
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5215

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

UmengLocalNotificationStore.db

Path /data/data/com.lx.launcher/databases/UmengLocalNotificationStore.db
Size 28KB
SHA256 f338cd34759dc56064be9758b8f028b0013f70bb2e14baa81de9b1085842062c
MD5 000875e1a2106f82b0f0ead4e052747e
SHA1 5cf90b842489c3e12c9faef7ddbdf20d009a4291
SHA512 1dfdd9f99426e7592ba7958b5f37cd95c2cecd45bbcfd8823506718e5a48b73f691f5f5755618994d8fbe7118caf6c45fadecdac26763530b405be6fc39d4eba
SSDEEP 12:TLZnqzVy0oLae/WEf68bgqx1xyxbleuDrkkk/kekHMkHq17htqfnVVtkwP7We+xZ:TL0Rvy+NtXuvmVVtkwqZxhgeDGSiI
MD5 SHA1 SHA512 SSDEEP

Submit Download

UmengLocalNotificationStore.db-journal

Path /data/data/com.lx.launcher/databases/UmengLocalNotificationStore.db-journal
Size 512B
SHA256 db39e11693950ed0e9dbc56f5c18753cb566a6a71f09da72cc128c046bd48472
MD5 447805fd5defae7b48dbac05844b655c
SHA1 2ac3b10325835df93e7acc0bc6bcc30c10f5f0e0
SHA512 fdfd555c3b35a0847dcabbbe9678cbf6d8dcfefadfb6e713c5b68fe16287fa0f7c8e8444451981cdb29f70e496dbff7ebc6810586fb217ce0bdc9a17920d836b
MD5 SHA1 SHA512

Submit Download

UmengLocalNotificationStore.db-journal

Path /data/data/com.lx.launcher/databases/UmengLocalNotificationStore.db-journal
Size 8KB
SHA256 64c0c9c21765c7b996e9db38348a73f2e4f7ed7f1b4c6f5a8d9413fd8a30e382
MD5 64ddbefc1ccc564cc23d5fa638f45c80
SHA1 92fc76bee68d7365da76ef86e629a842e2e5c0b4
SHA512 aef6fb336c63ee67a294f24787bae43c116d7473908de59a89102d63533dccf4959fa67781b07396f957e6806cede2edc3a5cb471d4ef9d2b5ffb97047fd7178
SSDEEP 6:7+/l9vRn1qg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK0C:7+tNCqLiuWdwRmBEyPbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

UmengLocalNotificationStore.db-journal

Path /data/data/com.lx.launcher/databases/UmengLocalNotificationStore.db-journal
Size 8KB
SHA256 6bafc4af9d8a3e9b9162c050aed24e38055df0ba31b7c76b4d2651c5e9cc3af2
MD5 4711ad2869ec3c32629b8dc309838cce
SHA1 d38aa5e64c65a25d8a5c6c24716e222a0000dbc2
SHA512 32696645c6a5ac6f55a0810956879160ae29416c17c9cc4a6d4e33b4896228f29440edf98264191e0e0306f2c00b8d031b1027182861572f8ad5fba76806b896
SSDEEP 6:7+/l9LGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK8HrC/r:7+tYqLJdTRmBEyPb1Sr
MD5 SHA1 SHA512 SSDEEP

Submit Download

anallLauncher.db

Path /data/data/com.lx.launcher/databases/anallLauncher.db
Size 20KB
SHA256 7156b4a7e81123b2d005ad6ab60ff8a3805b398c3dda2ec0df1ca03399383e5f
MD5 a0117ac537c6079fd449b8a1fff77ffc
SHA1 ded1598951a9b90375d9cc0c9f260539452187b7
SHA512 f21b207641ed377ff9ead38702bb736d6aec3be1832446a2ec55431f2236d311484683aba18b17a5a9d1174ba71f9d0bb28147b7fa075555e334574367dcdeef
SSDEEP 24:TLIIby2xeTxz5v+5r+ml9rJlLqbPhW/qGSEG:TNyokxz6KmLrJlLqb5W9S
MD5 SHA1 SHA512 SSDEEP

Submit Download

anallLauncher.db-journal

Path /data/data/com.lx.launcher/databases/anallLauncher.db-journal
Size 512B
SHA256 719ced89883e508ca93323a89320d86708d4628c1e2b0af763c08b329a998455
MD5 12eca19ff9357513025477147654dcf7
SHA1 91dc4c3c26b668098ae9a3312a0883dd01edbc60
SHA512 da6951a84d90aa9233ff9f9968b580677ada26451381f0791e02375d4f100d9df2fed73283aef95a51def5d7ffc114d08801ca7147ada345f5848b352c9ed807
MD5 SHA1 SHA512

Submit Download

anallLauncher.db-journal

Path /data/data/com.lx.launcher/databases/anallLauncher.db-journal
Size 8KB
SHA256 4d49306849c3f835eddbdcc15a427b189c0698bd089c8e1a7d11931ecd669a0f
MD5 f01eef68a102308c20b3c4944b7da331
SHA1 7f81f534c99ab64bb036337e5356814dffe7d4de
SHA512 ceba4dbfefb9a7d8103079d8a00a832ee1b3e392f45b93f2fd133a54e1710e94849e4f28978ac8302a4efbd357b80cb19eb566321c4236edf312978a74c826d0
SSDEEP 6:7+/l91Jn1dCg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKt:7+tRCqLiuWdwRmBEyPb2
MD5 SHA1 SHA512 SSDEEP

Submit Download

anallLauncher.db-journal

Path /data/data/com.lx.launcher/databases/anallLauncher.db-journal
Size 8KB
SHA256 b4fd5cfe29a66b4d9adc482e12cba8236d149c039d7729d252e08697825322ef
MD5 23b4128a9ad29040d3c9d8f9f5a4ff71
SHA1 a6dca97ac43b93f7999a5438b20918b4eb190182
SHA512 9fe9583d7973f3955f8abf1e34e1075cd5bf3a181e29b229eb8c23052223849cff70ce70a699f1214c26f5f6d6c21127458203ebb26aee6dad3a13b24ce7dcba
SSDEEP 6:7+/l9q8lFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKHGt/C:7+tvvqLJdTRmBEyPb0G1C
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.lx.launcher/databases/cc/cc.db
Size 36KB
SHA256 38f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f
MD5 0908e924aa236931dc7166fef6e00862
SHA1 7782648d6d8f6e835bd47058d4852932c096a467
SHA512 3c16fbc5172aed04cd206e776c46d26e911732c6e3631536410a71f1d217449475727ac9b3175e827c5ce645a1da9e05900258ee6ca27c936a9060f241361dee
SSDEEP 12:TL/sP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQ:TLd7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.lx.launcher/databases/cc/cc.db
Size 36KB
SHA256 abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40
MD5 67c12933d1e0e63d9801a6aa43092ce7
SHA1 b6936908554e4a1986b8eb08289e2d3545e8ff74
SHA512 db8b818daa3ff4ec7678645f84bf8b45c809bcbb758ea78b28982d071572655bba2d20e6f1ca4f0d057ab34fa655c5bc40457dc65050180351a2fc04a47175dd
SSDEEP 12:TLgRP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TLt7sL7yot3BVrHotGGSP/WQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.lx.launcher/databases/cc/cc.db-journal
Size 512B
SHA256 21fdbbcc8f727d135b9836b97b542235cd3061d70c07c4ef08ec6b4de5963961
MD5 e582bca57a0de45fefc5f5711bf466b0
SHA1 3d097827440e65d9e96d8b7e7da4cc2a67221417
SHA512 8bd341b8465b754a4d08ca526554cf7e32ac8b2bb5c4b321cd6ab49296d9ca7028f2244875730b2ce9864c82a3de8f265a3b002e00a6c165a76806ebe13f2184
MD5 SHA1 SHA512

Submit Download

cc.db-journal

Path /data/data/com.lx.launcher/databases/cc/cc.db-journal
Size 8KB
SHA256 c4961ce1195229a95fbcb33db7bd4af87f26129c90255a1ac3249a2d497225ea
MD5 fefa0dd79b1dde99d976c6b40ec40709
SHA1 c1da5eb179b221f58ff1985c3c2c7d6019ba33a6
SHA512 739b716dee667bedb27d61174ac798babaece0fdaaeb1361c5fd1f1ab77327429524f6addd3821eaf4a852f924c14dba408c6ea91d24a4135642cdfaddc387d4
SSDEEP 6:7+/l9Yn1mwvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKU:7+tkqLiuWdwRmBEyPbn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.lx.launcher/databases/cc/cc.db-journal
Size 8KB
SHA256 197453676c4862eb2bd02b1916d018921de9a5ad1364b3d8da3f8172440b49de
MD5 c86a69e984b6af6710abce7186b0e291
SHA1 21c7158ada0024d5e8ea0a68299c23afb0cd5010
SHA512 a805b2c388bbb87754bbf648749133e2b6f273228e2e6f38eb4b12b35efe1b832941f751e78c28fead84e6e05d3d549c6d8eb323030d05e82141e63b0e8cbe34
SSDEEP 6:7+/l9kgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKbnM/DY:7+thqLJdTRmBEyPbXE
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.lx.launcher/databases/cc/cc.db-journal
Size 8KB
SHA256 dadec2cba4241360753aeda73f4d173fc3935814fcaa92885bcaa4ada7f15340
MD5 ac19127ff6df37b061f8dc8f496ed7df
SHA1 eeb09986f9c20ac82fdbdced1240e23b7c0d38b4
SHA512 a5efb1ae50b2dcbad0e70155afb7dd89b420c57b274c09c22da9aabfd98106a21bb882f7e3715871a98226f97b920b389d1846be1cc1fff51ec7a94efab35b49
SSDEEP 12:7+tZjWt/vqL/sP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBC:7+tZjWt/vqLd7sL7yot3BVrHotGGSQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.lx.launcher/databases/cc/cc.db-journal
Size 8KB
SHA256 43adb8b6eb01645b54d1746420f4fe55efe9b88dc0ce51544c7e624231f8d7aa
MD5 9300e92f7ab2a97fa0674eb357b1663f
SHA1 2c5f16de5dbd2110880418dba555b7e37bbf4f2d
SHA512 ca31bf7ede9656d1e3eb72b7ebfe408aa6ca11593d4b50148e461bf4431134981b45fcc2952226a61f9066e1cca2ef6b3f7d5e4e77c31245d61859ee7d8b93af
SSDEEP 12:7+tYHVWqL+/E6P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBn:7+ta0qLpr7sL7yot3BVrHotGGSJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.lx.launcher/databases/cc/cc.db-journal
Size 12KB
SHA256 5a3dfc812586949b60dd288172d12f17187a67f4ecbeb08b6a357bdf5258c871
MD5 93c1f64efbfbbaf175a8ef11fa85fbdb
SHA1 6de354d460fe5b9d1314ca8823b052728b79aacd
SHA512 a31f1b48be2cd66256d1224a5e57125811f8af000f7bd50863410d5fc4027ea48e0b9bd15e15a1b8741b46044e68ccfd87245953e9c4ae02d742421a19c5030e
SSDEEP 12:7+tYImsjqLWEOVP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5Rmo:7+thnqLEe7sL7yot3BVrHotGGS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

download_status.db

Path /data/data/com.lx.launcher/databases/download_status.db
Size 20KB
SHA256 62c616369b05deef0a22c4ee8014e78d8f7564106d0feb580bf65ab4cd0a62b1
MD5 fa63b36e30f8cc2030a74a9ff1baea30
SHA1 689a1c3cc70c5a4e933e0f39b233e602580832c7
SHA512 ba6f0f445236f103800134f8fa47d283f03f30fbef9f19c0809e17edd568b89d143d32f6277de169a0d07037f072ad9b5463395ab081b8713bdd292ef0c32ca2
SSDEEP 12:TLtCEFsky40UXkn3xO8JBYEXEWnEyKE9Jc3e+6bSkn3xOYyxJTJEr4E8EXEW5Rm7:TLlFRsVoW/nhKGbWx9vdW/qGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

download_status.db-journal

Path /data/data/com.lx.launcher/databases/download_status.db-journal
Size 512B
SHA256 7e7c804a9031fc3dacbf7ab8658b27041ccea877a06dc05facd83f032e16f5ee
MD5 2cbbd3ea34dea4294d09775438c912a2
SHA1 15401618478ef5762ecd99c2413fe6fb2dd7e223
SHA512 7f1c0783525e71e074e879db8d6df1603a413282f6163fe4626e28abb78562fa97c1e3d492666611fe296dbd4f76928a9efe81b1426b40f991ce272852e04d9b
MD5 SHA1 SHA512

Submit Download

download_status.db-journal

Path /data/data/com.lx.launcher/databases/download_status.db-journal
Size 8KB
SHA256 f011b98a11aadab5e51883566f9ca08112cbb0977f30f110672a0bcb7ed77e51
MD5 6c9ae4adb58462c6c0cefc89e69bc235
SHA1 77800b80a75759515c506b05f5b3fdb4364f06a7
SHA512 cff0c10e01b90b73a3b1424e4e39f8728dd49fab93588baa17093f5cc6c75b57d4d3e3beca6bd37940961dd5cce341cbcac8b33dceeceb92b7dc728ab968675e
SSDEEP 6:7+/l92O/gn1flng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK+:7+toOUqLiuWdwRmBEyPb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

download_status.db-journal

Path /data/data/com.lx.launcher/databases/download_status.db-journal
Size 8KB
SHA256 44c1af2b8107336dd923f7738b9e217097644feb582500f1a90021e3a5e94131
MD5 ec47d6e19144792e83ee2a6071fcf744
SHA1 d63a1fe483a770801934cf4c721af9af2556d2dd
SHA512 a036e174968f9adae75b905f68a016eb1155c0bff6fb065182683d06594f43aa50b89a210a72c3ac1d70a39bb43eb3efd6d9729310c8a2feb31eb5f0e137df0c
SSDEEP 6:7+/l9pGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKohL9M/i0:7+tKqLJdTRmBEyPb7LS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db

Path /data/data/com.lx.launcher/databases/google_analytics_v4.db
Size 28KB
SHA256 23e77ad339ef36b604643bab90d5ec657a167357c4af5ce5b67df4232581c262
MD5 cc380f910524fadd875e200a16fed776
SHA1 47d0c2f01d12d67b4850552b2062f2a1578c8a4d
SHA512 f7246f90f50f487e19f83b8c8d9847cc58d1368267874db59bf7ea74631f4b1d87fa4b08695864a269f116a8b1db9a64852f3b030fc468749edcc03956f062e7
SSDEEP 24:TLmLVXixByqQWWEqrUhCafBGBGSiGDPRPlsdGPRPr:TKhX9hWfqrUhnBZSxDA81
MD5 SHA1 SHA512 SSDEEP

Submit Download