b17571c6b9e91ce006e4fe5180cb6b8341187d661fd9b99f1d25000327b01507

Analysis

max time kernel
178s
max time network
189s
platform
android_x64
resource
android-33-x64-arm64-20240514-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system
submitted
03/06/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
917608a46219c1d298cd6744fe3a18da_JaffaCakes118.apk
Size 10.3MB
Sample240603-mlt52sbd8v
SHA256 b17571c6b9e91ce006e4fe5180cb6b8341187d661fd9b99f1d25000327b01507
MD5 917608a46219c1d298cd6744fe3a18da
SHA1 b5e4af4c36e6dd4de2a8af727228e70b36d1373a
SHA512 10a3bd8e76b00b5a6f900abeba91afa29e0ec0d7802cded184a67b476a34ccb9bee233e72bc5ef286937de63260e919cd73065a510a11ad6b80690d26cbb5554
SSDEEP 196608:OYBRKp0kP41GaK7ljWOE3DOt9g5InOOoVW5uPRHV3fejrf9KTZgm7MK7Roz:OYBjY41Ga8j/Eg9gOnno8Enuf9WZbMKY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.caiyi.fundjs

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.caiyi.fundjs
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.caiyi.fundjs:pushservice

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.caiyi.fundjs
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.caiyi.fundjs:pushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
28	alog.umeng.com

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.caiyi.fundjs:pushservice
Framework API call	javax.crypto.Cipher.doFinal	com.caiyi.fundjs

com.caiyi.fundjs
1⤵
- Checks CPU information
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4356

com.caiyi.fundjs:pushservice
1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4389

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ua.db

Path /data/data/com.caiyi.fundjs/databases/.ua/ua.db
Size 32KB
SHA256 eda21e9bb4ad31e62a195d99b6e8e7f361411de6ae8f3049537055c8e688f837
MD5 17bb57268badc491266a2729e57b37c9
SHA1 ebcb029dd3fc1f70e210d93ab3086bbd5d39e3c5
SHA512 a4a6b7ef13c6d81777bd583c1a96fdfc735b7aae8fa67d9502807d1e150784abad3fec756af3f59a0f9086447b89ceed5fdaa726e67682915285beb6d23f2182
SSDEEP 12:TLWXBc0uOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbP/WQ:TLi94PPvP/BlmqygGSP/WQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db

Path /data/data/com.caiyi.fundjs/databases/.ua/ua.db
Size 32KB
SHA256 b5ad5c23e11239010e43e20df16f06f0d6e77c316fc5835f0692dfb835d59718
MD5 5f0c0a284ceb329b808b158d61c94c99
SHA1 25609fbd733f36ca109bfe72243e3b1ae09926e4
SHA512 b163b9f0a058e44bd753247e4d6cdcfd5effef6f0ba52fe9b17fb6236bd448a16c89422976a7130030aee100f1e0af1a9a983b7efe94d04b094c26f14584682c
SSDEEP 12:TLZx0uOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbVDLOwQo+amHc2PP:TLO4PPvP/BlmqygGS9jQocHcQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.caiyi.fundjs/databases/.ua/ua.db-journal
Size 12KB
SHA256 84168c82010be414cb563439b1dd1b6de711d3cbb50b6cf0ee1dfb393ef6ef7d
MD5 04174cef7499617d22ddace89fad3724
SHA1 7a4335771c6357b3f9bb1897cd9a8f69696a6097
SHA512 79a37dfeff841f5abf6d4880fde71332cab2d3ab282c0fc6dd0a29de6f84078ad24d519661c33c571308f292615ac22de91b74092fb8848497d22a6c7c175d99
SSDEEP 12:7+tE29esTqLZx0uOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbR:7+t2gqLO4PPvP/BlmqygGSR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.caiyi.fundjs/databases/.ua/ua.db-journal
Size 4KB
SHA256 b99fb3f53c1881810bf4babbde6c1c985f86b0a82edcb2eebb48b5a6c86e4744
MD5 909b74029c0b140f9f4b7b3bc80fc26a
SHA1 4888248ab902fce9020cc662c65fcb820f36a2b7
SHA512 7fdece4717b6cc352540c071b9507de63030833c49327c6b65b18f539df612828bab4c3282b65cebfd10661c4e5fd60280bbaefe56c1723d34c4a19a270cd0b5
SSDEEP 24:7+tFeqLq7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSM:7M4qG7/W0xopA/t379y/MSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.caiyi.fundjs/databases/.ua/ua.db-journal
Size 8KB
SHA256 00e4685b42d1fc17f745566e48da5b62f73aed84a1cf8e1e917c9056d3f22822
MD5 b6c4c43605cde2ac0c359aee649e8a71
SHA1 cb4094a144109f750483ad8170c71234f4d35dbc
SHA512 cf9679e9819d348472a93b7c2bb58dd8c99fd6e02dea86e520514757a5eaf59f6d678ea8fbbfaa9faf5902f845b8a7933215b7428f7f9b30a72867cf0f0205fa
SSDEEP 24:7+tLjqL9As9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGS5:7MHqRA/W0xopA/t379y/MS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.caiyi.fundjs/databases/.ua/ua.db-journal
Size 8KB
SHA256 cb49c2e418a13d10885a4da2a7bc68e192179137f832725a4f5f06e58fd1b8cc
MD5 737e2e3e652e3d30322425b71a428ae8
SHA1 5fd0247f7b6f00131dbc0ad8f8d9d10b34dd9213
SHA512 275b1723008b8838915bda5bbaeac87a18e036102ba8e82cb9e4c5dba06e07327c54e0a5b5fa2daa4b8f7576fb06f9fbfc6212769a148ba2eac13298fe0ce03a
SSDEEP 24:7+tPXUbCAVPIqLCT9s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSP+:7M/kQqE9/W0xopA/t379y/MSP+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ua.db-journal

Path /data/data/com.caiyi.fundjs/databases/.ua/ua.db-journal
Size 16KB
SHA256 9c890a5eb0b9e3de282d6f70bcd991fb610c530f497923ea18426e29ecd04461
MD5 5bac30c095d94fc081acbf198caae1d8
SHA1 03d6eaca656c49137c6a6c5d0cfeba0920a76cd3
SHA512 e7d40360396107df5539904972e80c829df9818570e6fee0c342bd9bebbdb3f4e17af4b37f5946abd3b771a8f6a2610ecc9b6be2274fecfde9edf7238b40d213
SSDEEP 12:7+t7ZAIAiAfqLsbM0uOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbO:7+t0qLe4PPvP/BlmqygGSO
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.caiyi.fundjs/databases/cc/cc.db
Size 36KB
SHA256 6945d75275af161fa082eab8b348f4cdccbab03854963f5e861fde210447e058
MD5 b986a138e325f9ed31653e246087baa6
SHA1 1cda06c101efbf7c89305f44b552e38282225064
SHA512 5894180006885af44962dcd92c6f33a640d6080060a51a38ee4e348ee2dafe9abdcf2a931cfad4c395ebe20e08b96f810ca54b5b1f584fa232cdabc76be0740d
SSDEEP 12:TL/1FP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOw9:TLtu7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.caiyi.fundjs/databases/cc/cc.db
Size 36KB
SHA256 66c83ae35e997c33eaffe9c0557d98ee31931c18b99585a64eb6cc8f63d303e3
MD5 1b77217d803a7c04af9466680b92d104
SHA1 0cb959f4773c6730e8aed5746706c0f3ecb35c1f
SHA512 39ea189895ca93855bb71b4a5447815e9373ffd39b50611ac172ae321ee7716fd4af5f86c1fd0d17e12b771f4016a86184620a7c5d07f57b88f017c4ce8312ec
SSDEEP 12:TLg0FP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TLdu7sL7yot3BVrHotGGSP/WQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.caiyi.fundjs/databases/cc/cc.db-journal
Size 8KB
SHA256 84a86f5852eeebca2208143fe65b1c2127d77b1c867985fb2b8c45cb0e4f253c
MD5 412822b17ed2c1d82f31c81f24e91003
SHA1 16b4b98a046f694e6c5166efaffab17a6fff541a
SHA512 7163ffdc8d4a6668c796a17a34590aa4e3777e96fb7a487af0036940faf891cbba12771ae35e7f63dbfa336683fa6c348f84bdd3466755c51f322caf1adff2c3
SSDEEP 12:7+tPlsFlqL/1FP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBp:7+tP6FlqLtu7sL7yot3BVrHotGGSn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.caiyi.fundjs/databases/cc/cc.db-journal
Size 8KB
SHA256 a08b6e1fab07a30cacf6b4885aecec2e48e76c054079a7725a7810fbf91b60a4
MD5 75797660c26c6df3fd00db02be1bd792
SHA1 26990d8fbae0a8339d89b776bfb9782201e0659e
SHA512 5a46fc654688f78b8854c40ba52032786b0e867dcf4efc2a6382ad409ab45f9822499a823ae4dfaf1fa82383bfc7908b6b1ac4651ab0136c9938b3c996e28c36
SSDEEP 12:7+tuEqL+/+FP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyS:7+tuEqL9u7sL7yot3BVrHotGGSWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.caiyi.fundjs/databases/cc/cc.db-journal
Size 12KB
SHA256 64ae4b584b1e9abe0ecb70731916190968635852d69658caeefde5b13802a1fd
MD5 81f8afcfaf1e923eb06aa5c144ebd555
SHA1 6c535c54d0d39fa7ca9037c161194821bf5109ff
SHA512 cb377f120e097c3496a0156555fb6de80313c60187a32f5eb56a8bdc18feb5c30014637c8125708e88a2c80e4b7f08316d02e75e7911f851d5fe8ed6290eb8da
SSDEEP 12:7+tHWm+uonqLWEB5FP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtbt:7+t2zqLD5u7sL7yot3BVrHotGGSw
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.caiyi.fundjs/databases/cc/cc.db-journal
Size 48KB
SHA256 47ffa0aa53af70e996dd8f6b8bc9bd2e7529e6d38bd18a00d50d0e8d37164d66
MD5 da16f3c3c1d8d1773ccba36404fdcd94
SHA1 86ee5aaaedbd141b54374781bd9967a7cd868b14
SHA512 103afdb631879a6a4f66a8051cf14c621faca8ff71251c126bf9105ee86c0b5301c80a66693a092d3e4f80f719410992962e5e75f0d999a38b081fc647d0d34c
SSDEEP 24:TL7aps9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSFqU9KCAVPBQQQeQ:TXq/W0xopA/t379y/MSAMKZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.caiyi.fundjs/databases/cc/cc.db-journal
Size 8KB
SHA256 b35116e2b25ad078b1b4626ca7575fd6176942b38335bfaf3de06e01968326d0
MD5 40b3444e20146cbe171d781ba3c1ef58
SHA1 c693c4b7fafd94d25686ef0e3b3cbb8211d6d2a4
SHA512 ca4fed8efc12fed3643a6efe2a81c56375fc8e0f858620ea80e709d10d008e35fd52ef9636005ed8ebdab48cc45ff1f6db2eea7ab381d59a688a109e7edb9e64
SSDEEP 6:7+/l/l1og9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKs34:7+t/wqLiuWd7RmBEyPbG
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.caiyi.fundjs/databases/cc/cc.db-journal
Size 8KB
SHA256 7b7f9b29a0ba0b012ba0e57893c95022398d5a3fefdfc2fc80e9d4dbffff4466
MD5 9f1efdf819fe5459a2af6aa4cc09327c
SHA1 16bc1398b6b4d3e22e062c8c6cf13b606c1e6712
SHA512 7046bf165bfbb709fb9ca1aff20676f1d195bce55dd1184cc0e4b58e093a023a40928326d0f116a5184d9931653be83cd02c6116c62f59d9d06f40f24cbc3453
SSDEEP 6:7+/l9GUmHn1PllkWg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuK7:7+tI/zpqLiuWd7RmBEyPbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

1717410835733.bin

Path /data/user/0/com.caiyi.fundjs/files/.YYStat/1717410835733.bin
Size 464B
SHA256 de17d64b923a5c6d25b18a614c5e27c8f8378be7bb4c7e7bd4ce58d39b013b25
MD5 9534a3acd8ef7184d1af2f02e0cd5dc8
SHA1 d1a03bff6280e16856f9186abf6df5db194be647
SHA512 6a4d4b8f0cefed300f5f3f7da68cc63c608e640742f1660fe7626e1f86af35c5bb020b14e7e954fcd69e66babf29c58d806fe2ca950bf5b1ff097ed165727e28
MD5 SHA1 SHA512

Submit Download

um_cache_1717410958684.env

Path /data/user/0/com.caiyi.fundjs/files/.um/um_cache_1717410958684.env
Size 1KB
SHA256 cd996bd8c58758a01153c4be1aa991ff5233d8db475d6793c83a875c0cd5bd73
MD5 097b1e4081d2f225132b4cfd95245a25
SHA1 904a84d6b03635d4196bee734ab5b3a4c8a05bcc
SHA512 1585c13a096a39376e0c185c1f8428fbb6f9c0dc4bf1a250bf50739981a869ad529bab317d2b8745158006266c65ce9b94005d41b1372a49419007f88e2c34aa
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.caiyi.fundjs/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 7057542c8d7a8a1e3d77e9a13034087ef1f102b4d6d425b76e762d4f1c9e7406
MD5 16a7e282b09df5744ec58c4ec90bc078
SHA1 9cf903d1d312a0f9b38e55279c6cdb2d15e5285c
SHA512 c43562a9eaa3fa1b67b870553e94dd573396741fd3e115c7d61e6a38a0382d31f31b875739ee419e754ee39bc10234bb5c9b0aea24e93cddb9f666b9e49fbf75
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.caiyi.fundjs/files/umeng_it.cache
Size 350B
SHA256 3e4f9d24ca23368cc3c9fabfef7873d431b33d231d37b363e3530ecb18ef2fea
MD5 3553b838d2e38cbbfd5559f5d445320a
SHA1 6c00437cf81338407afd2563345b37d3a3e0fa2c
SHA512 74b2ff074470405478798e012316c8447af1317c749f40eddb4bf4de680953ea56ee84e622deaa3016da9e84ca34bf59479accccd769801b27e7ad8384c6fe5d
MD5 SHA1 SHA512

Submit Download

com.caiyi.fundjs.bin

Path /storage/emulated/0/libs/com.caiyi.fundjs.bin
Size 69B
SHA256 f6e9a6f41b295ac29af2ebbc9deb43d99e4c252ece667bb826dd0e2c5d80ba07
MD5 9749738098c4b8051c6d1f10cab4c45d
SHA1 8b6fe232ef067ff203e9a3982c65905791808375
SHA512 418c4802252c8603282d05e1f71e53ee3518c279b2eb4bc843b2c28beb9257174e698a203caabecd46286df8390659b4f058c5990364524905336cc8551fc38b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads