Analysis
-
max time kernel
179s -
max time network
179s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system -
submitted
03-06-2024 12:24
Static task
static1
Behavioral task
behavioral1
Sample
91c6032ef6b84a2e5fcc437d67a7a85b_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
91c6032ef6b84a2e5fcc437d67a7a85b_JaffaCakes118.apk
Resource
android-x64-20240514-en
General
-
Target
91c6032ef6b84a2e5fcc437d67a7a85b_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
91c6032ef6b84a2e5fcc437d67a7a85b
-
SHA1
1579e048d6b63bb0e7646ce885b10a76926f689a
-
SHA256
3e2dbc15adfb5f8af2c294a75336670164b3a3fed1bb2b46f82fc418e0f7d2ac
-
SHA512
37bb0834ff8418600894f6343a117703f96b8817aec4b60c5473c0e33370779a3a05d84647cd2d4d5fc7e681115f0e5034106e5b531f8039ee6c40e6df4181f6
-
SSDEEP
24576:ecEoL0otaYtXMMSprkM4FqD5Bl0ZHqU+3jzo+UojMvwq/13tdHbZKm51Ob838:9Q7YtArkruBl0ZH6jfxjMvwq/1XHNKm0
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.zone.piag.dooncom.zone.piag.doon:daemonioc pid process /data/user/0/com.zone.piag.doon/app_mjf/dz.jar 4687 com.zone.piag.doon /data/user/0/com.zone.piag.doon/app_mjf/dz.jar 4762 com.zone.piag.doon:daemon -
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
com.zone.piag.doondescription ioc process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.zone.piag.doon -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.zone.piag.doondescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.zone.piag.doon -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.zone.piag.doondescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.zone.piag.doon -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.zone.piag.doondescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.zone.piag.doon -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
Processes:
flow ioc 47 alog.umeng.com -
Reads information about phone network operator. 1 TTPs
Processes
-
com.zone.piag.doon1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
-
com.zone.piag.doon:daemon1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.zone.piag.doon/app_mjf/ddz.jarFilesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
/data/user/0/com.zone.piag.doon/app_mjf/dz.jarFilesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
-
/data/user/0/com.zone.piag.doon/app_mjf/tdz.jarFilesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
/data/user/0/com.zone.piag.doon/databases/lezzdFilesize
28KB
MD5fdb8a92e5060ce104e8f0faca55a47ce
SHA1270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA256194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
SHA512ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122
-
/data/user/0/com.zone.piag.doon/databases/lezzd-journalFilesize
8KB
MD5397317db0fa8cbeda9f7b71f53df1fa6
SHA13f254c7042116fd4442b5cee810b975879d1e7c3
SHA25698585a1cc0197866ddeac4ab74a0760d97e040419bb8f8702a19750f1621fdc2
SHA512b4c5001713e61935dfdc2220b063205bcd8f46960bfda9a6f581bd2d949b71ea178541cb00809c024b812007eee11d298f7acc8615f6f9e018ec731736e5d721
-
/data/user/0/com.zone.piag.doon/databases/lezzd-journalFilesize
512B
MD57c6c92a53646d813ffef224f54f1ad5f
SHA1bd569503e1cf8f44edaccc34f0ce2211b814574f
SHA256421677a80de0d03da0b3c78ae445fdaec410334cf25e0e6e96441e00cccd91bc
SHA51240d17c39d40a5b8830ce5200d3bd7ffed6841449e31fdb1afa256993ce368e30ff9741f98be77809a3a5244261356cf23d7628576cb8cc63f2d67ecdd20a6f1c
-
/data/user/0/com.zone.piag.doon/databases/lezzd-journalFilesize
8KB
MD56e9f97c187b72fda80d6748ef56dbd68
SHA1a3c05b62dfbebb34bcfacc0053ecb31554f810f2
SHA2565eaf1566fb10fb918b74c6b8e835ecd81d849a6acae0fd8a8de161b5621747ed
SHA5123dfeeaad4cdc11348c8a6fe1112f0cfaec3126ca9cd392adbddb5872b164599bbfdc3ab3ca52c34626a656a011940bf4bc1de784ce63b1c9eec727522909d567
-
/data/user/0/com.zone.piag.doon/databases/lezzd-journalFilesize
4KB
MD5f8386f0d593101328cea54b89b0257ae
SHA1aea3b5420f1f5ac5f102e3e18cfbdce6665b2fbf
SHA256b6198317dca36b123a7caa5fdd264b76f33d4e3421b94f5da6a7b661c995b3c9
SHA5120c6875a8886099f298a45b2e0f37f328e8e6f0fe2d0f73a3936be6887ded55eb61c29895d142bcf1f0c121528e8286b22518792c0be3f9f386afd305c161a5a0
-
/data/user/0/com.zone.piag.doon/databases/lezzd-journalFilesize
8KB
MD553d6c212a42fef3c9d6f9d31479e801f
SHA1fd586b933332bb2ee75a2a5ff34b20062154387f
SHA256543b5925ee289506ca24608bb685ec38c9bb76db3224fee8acc21081e6781f2d
SHA5128bf549cf82d658fd81f929b18764121bbac8b666c03a2a2b0bff916b8788e3684511350e6229c74b48b43ee2d39e7ef9193b7bfb8797c6128dc2788da8a3fcf1
-
/data/user/0/com.zone.piag.doon/databases/lezzd-journalFilesize
8KB
MD5f32ca0725c5709c82958463b098f139c
SHA10dad521bd033c5a0ad72606d82c366fc327ffe6f
SHA2568c10313e114d6a9b1739262c4aff9819d2deb442d552239885c12ca42f935789
SHA51262b99fd58a500f6e0d954c7b761b489d2b993f87734c1aa3b7cd655ef4d5eed7555fe7f329e9cd58c779003828d1b72a65709e4ba5e9fcae126b320dce30a21b
-
/data/user/0/com.zone.piag.doon/files/.um/um_cache_1717417610873.envFilesize
644B
MD51b7df478874f8cee294ac87c8069ff5c
SHA1f0a6f0dd2b6581dcb2d3c8caeb063026b55bb1b1
SHA256d638de6aa96a4f65a80d0b9964798e1f246675e98eabc4b22c232357be16d8e5
SHA51250815306d2e6cb4adb468df6c33eaec48ece40cc868d8888610917ea67f0a5ec39ff40b441cd4c75802ed3bf97dba524668eab623409e2be05592e7a8af9b4c8
-
/data/user/0/com.zone.piag.doon/files/.umeng/exchangeIdentity.jsonFilesize
162B
MD535dca7e5bb9a564476258147f58d8adc
SHA1223b33b07d45b037dfb30a98c4d997e2a68f9989
SHA256a896170c068bb24ff356a930c0788ef62bf91f96805c80fff522c7a1d7a1aba4
SHA512b4b7aa82c7b5bd1e08e417ba921a0d09d9b289c1344c1b513c6f1cd9f6aff44f5aca5e8b696ccdf32cc338de71f2814f84449d1c52257244c83d7b8398047fee
-
/data/user/0/com.zone.piag.doon/files/mobclick_agent_cached_com.zone.piag.doon1Filesize
790B
MD5fe15dd31bdd3136a8f58f6c05108b539
SHA101bbb6008f63f2ec735643bb2091747a3ac10864
SHA256541e1bf46eef32a8676b916dd904aa77126e2db485e3a728ee775cb3da36e72e
SHA512a96fc2a8a7a21404c1b878a930c910f87edcd407669df3b7c788399e29026f075f0e8bcc2246fe5b3e8d18f468468756714d6c34755ec23bb0e33cf8e8406e53
-
/data/user/0/com.zone.piag.doon/files/umeng_it.cacheFilesize
350B
MD5dd629a27cfbf1682e442e6aa5cd795e9
SHA1a443431b3a111e9aa347f63b6a2d823a2872ac5a
SHA256d547601584b3b2eb925b67c5758481f6db9dfa9c6a8768be7b32bf952299f55e
SHA512a151c4661dba16a3ba00475e7f24ef68333636e50c741544bc60fecef1c9f3f0c645344a56998437fe73ff3dcd08ce2d73ea8dc36fe22a825f8f422d52218628