Analysis
-
max time kernel
179s -
max time network
188s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
03-06-2024 12:24
Static task
static1
Behavioral task
behavioral1
Sample
91c6032ef6b84a2e5fcc437d67a7a85b_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
91c6032ef6b84a2e5fcc437d67a7a85b_JaffaCakes118.apk
Resource
android-x64-20240514-en
General
-
Target
91c6032ef6b84a2e5fcc437d67a7a85b_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
91c6032ef6b84a2e5fcc437d67a7a85b
-
SHA1
1579e048d6b63bb0e7646ce885b10a76926f689a
-
SHA256
3e2dbc15adfb5f8af2c294a75336670164b3a3fed1bb2b46f82fc418e0f7d2ac
-
SHA512
37bb0834ff8418600894f6343a117703f96b8817aec4b60c5473c0e33370779a3a05d84647cd2d4d5fc7e681115f0e5034106e5b531f8039ee6c40e6df4181f6
-
SSDEEP
24576:ecEoL0otaYtXMMSprkM4FqD5Bl0ZHqU+3jzo+UojMvwq/13tdHbZKm51Ob838:9Q7YtArkruBl0ZH6jfxjMvwq/1XHNKm0
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.zone.piag.dooncom.zone.piag.doon:daemonioc pid process /data/user/0/com.zone.piag.doon/app_mjf/dz.jar 5182 com.zone.piag.doon /data/user/0/com.zone.piag.doon/app_mjf/dz.jar 5330 com.zone.piag.doon:daemon -
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
com.zone.piag.doondescription ioc process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.zone.piag.doon -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.zone.piag.doondescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.zone.piag.doon -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.zone.piag.doondescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.zone.piag.doon -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.zone.piag.doondescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.zone.piag.doon -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.zone.piag.doondescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.zone.piag.doon -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
Processes:
flow ioc 37 alog.umeng.com -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.zone.piag.doon1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
-
com.zone.piag.doon:daemon1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.zone.piag.doon/app_mjf/ddz.jarFilesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
/data/data/com.zone.piag.doon/app_mjf/oat/dz.jar.cur.profFilesize
724B
MD5df1ff980a354417d0c471130c49de84a
SHA1ec6f5a0c8501b74abb9b35ee5e72cc245be59a6f
SHA2568628b7439382f5cf1d2ffc743a19cfb34ab6444186c21755c919b23586967cad
SHA5124b1761a91eb352dcafad7e33405e9416028ad859e975a16d8a72cda68e9f6a10ba09de0e77e9a6d7518dc747d33546d31f9aa63803b319676bf0fa092e19e889
-
/data/data/com.zone.piag.doon/app_mjf/tdz.jarFilesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
/data/data/com.zone.piag.doon/databases/lezzdFilesize
28KB
MD5dae68dcffc3d522a79f98ebbc3b6d457
SHA16df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA25656cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA51223b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
-
/data/data/com.zone.piag.doon/databases/lezzd-journalFilesize
8KB
MD542be78cd0e724e732785cad6690beb62
SHA12c38aa0c5bf47cee01ec29747bb9d3b5058b3a24
SHA2560d42e90974f8cf0d1868dc94b1cb2b6f6dc6e42a2040f2bb1afba4e196f9b8a7
SHA5128c2dce320f0edb0792e0f7ee26139ddf2330d7cf66b922603dba3522645271074b08d1e481d78c6fdccb097b36aeef44ebae3b5ef459af3d9d173e13a412971a
-
/data/data/com.zone.piag.doon/databases/lezzd-journalFilesize
512B
MD57376f682511993233290feeb40ed0b95
SHA16ab7b53ff0567e69a0b39ca8f2de1f7d5935c30a
SHA25633ea5840692d0c10c0a5941f8ed3af66d9cd3a1c140e19ff847b43667cc660d3
SHA512afb41a22f009e76fdcb0eb96b25ef2701c06bff7839867e3d784f36bc200b060c83a1047cbf0d45af6be6bd1e10af23b019c13a932d5c36f4060ebd6a7e732d2
-
/data/data/com.zone.piag.doon/databases/lezzd-journalFilesize
8KB
MD56420ef936300ff4f7b9749564b8ec40a
SHA1c66765eed003a60d494db3f90abeb3b08b178f16
SHA256a4d5b5c04a382202edf910a5f32b4040e3874ab5cdfdb03ee2a4dbb03acbd53a
SHA51271f44e6e85737a62019e5d0bc1260c1ebd56e79f121022242af88c19297d9c32f01a1b84c02621ddad52469ed16f3896e268c9d0453568908e115fe88bb6a050
-
/data/data/com.zone.piag.doon/databases/lezzd-journalFilesize
4KB
MD54f340fd6ae6978db8c8eca97dc517602
SHA1d79bb254ba5869f68bc979b6258dcec924e5b145
SHA256120a9fecd6d02ae8a8c07cd0e14a23fdf247adccec3299927c519fa208ffd214
SHA5122301b41c7a7b3d175ad402e3e31a77e6d8a07ed19926c912a469b5afe0e861bbfb9339fa4510e3b53994f16181b172f57bc9099be590ae46fe97e7dbe14d6ccb
-
/data/data/com.zone.piag.doon/databases/lezzd-journalFilesize
8KB
MD570eadf626989085bfd1b833b0d35ac06
SHA17709fc3cdc3a9c4cf1c5116f3d3d5a60af9b8ba8
SHA256dab38b047463d65e75318c81d8282a412a6e009d6bed3132f5f1405d0106c31b
SHA51217bbcf0a9ad7bb72b7e297e16be2c75818b3ecdd020cacad73fb96251151a979b8cff0734a50f99408a3c659ca89bf299fcbc494c489230f93d209b8ccf08dd0
-
/data/data/com.zone.piag.doon/databases/lezzd-journalFilesize
8KB
MD55575299ea382d713acc7d645395a1fa8
SHA155abc1445b990b8861be68e3832acd2998397160
SHA256d74982ba6dc2313c527135201bb5f26f91e8523b29b9f3b543e777f6d7245026
SHA512d229fc57ee9e505157d17a47bd4842bf76a46fa5b026e6943839467fe1bb5549acd8aaa0b00e754b93904efb2f6a734d9f060a55cca81903e9d312706d7420ec
-
/data/data/com.zone.piag.doon/files/.imprintFilesize
937B
MD579a184203169267e408f46709e31449d
SHA1e7e493bed58232d1b1dbc54b7ccfa72c67d6ee67
SHA256cb925c0207a133b068b4e7fae33491b5fbb86643385f32a342c9d08cce8bc4d7
SHA5125a4419a48494eceac4b637b3caa3e283ab10a337894c4650df8121b39fe40ece8b03f695d2ad3f86add3fad68b532021647088483a81ce4689957adf9d3c71c6
-
/data/data/com.zone.piag.doon/files/.um/um_cache_1717417677492.envFilesize
1KB
MD5c3dca20ff8b28ef004f870eaf3e484fb
SHA188e531d762c96da863b0218e567ef2755deeafa6
SHA2567be934c175530c80b5e0b1f2c8f1c46e0cd960c49724b1ed42db317cc8ff77b6
SHA51232c7c0050e7cfab1c17e54b9fe594bb1e2dff5ce378e533ec53845ddf55a4151e91b9f52b5964ce1d7f019dd5e3a60db30af84753f8673a0b83d5f6fcd8c5521
-
/data/data/com.zone.piag.doon/files/.umeng/exchangeIdentity.jsonFilesize
162B
MD5794b67e33c127b5d7e7493fa17ccd4ae
SHA1628e5434f24bb901a3120a4947cd7a39b83018d5
SHA25602b9dd3ae8b6166390851b9c773ae904df1d77bc225bf49305897d54e7b25fb2
SHA512bd80f7861f14b75718fe07be1a5a32ccda5e9270def9ad45cb2bff2a46582d248a7e4c4802ffdd0b024c89bbd9c21e2d4392974ae789abf27f0729b92aebe0ab
-
/data/data/com.zone.piag.doon/files/.umeng/exchangeIdentity.jsonFilesize
204B
MD5b14f6bd92d98250ca4d24976d610cab8
SHA108b32245930017c52dba54a8914dbd8d7d47f23a
SHA256aef4515dc4307b342894d6308b778fee3ee50ab27ee9a1bc3cd79c0230000d8f
SHA512d3dd083f30930e7b231c558d9eb3080b109cbfa7f0cb66af30b0cacb33d438d4cbd9240ebf16ad90b8fb13b3035f8f0a1b48b39726718fcfb2cb53d97edea522
-
/data/data/com.zone.piag.doon/files/umeng_it.cacheFilesize
352B
MD5f761b2d8a5862e59acbe952cd2941b56
SHA19e3a58a5be114015eb2b454a4adc164fd43305e2
SHA256da0bf8bdffb928d30759792b3a7c326c95c4fa711cf575d1766ee68c0946e42b
SHA512a83a240dc9e0085924a8b34eddac0ce178ea9e8ac6b3455279e43858d7809cf3f187d2acd8aa0184b56f950fe6fc38c9a5d0dfa31b836bc6a8a27cc4c461e9b8
-
/data/data/com.zone.piag.doon/files/umeng_it.cacheFilesize
179B
MD57f9d575c2c222a2599d419a510ed3114
SHA12f48470aca6ad49941323c990d3215396ef5736d
SHA256857fe87dee6cf5e0667d16220a19ed10f7a9fa6b35abbad98e361a7bd909895a
SHA512284a76e1a2242af8378be2b69074771084a782cc7ce7d9c74d97e3b1e3e93c282dea865192aa3ed2969462a2b7da7a8ec842cc3afcd58779f5b1b71c7aa069a5
-
/data/user/0/com.zone.piag.doon/app_mjf/dz.jarFilesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc