Analysis

  • max time kernel
    179s
  • max time network
    179s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    03-06-2024 12:24

General

  • Target

    91c6032ef6b84a2e5fcc437d67a7a85b_JaffaCakes118.apk

  • Size

    1.3MB

  • MD5

    91c6032ef6b84a2e5fcc437d67a7a85b

  • SHA1

    1579e048d6b63bb0e7646ce885b10a76926f689a

  • SHA256

    3e2dbc15adfb5f8af2c294a75336670164b3a3fed1bb2b46f82fc418e0f7d2ac

  • SHA512

    37bb0834ff8418600894f6343a117703f96b8817aec4b60c5473c0e33370779a3a05d84647cd2d4d5fc7e681115f0e5034106e5b531f8039ee6c40e6df4181f6

  • SSDEEP

    24576:ecEoL0otaYtXMMSprkM4FqD5Bl0ZHqU+3jzo+UojMvwq/13tdHbZKm51Ob838:9Q7YtArkruBl0ZH6jfxjMvwq/1XHNKm0

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Reads information about phone network operator. 1 TTPs

Processes

  • com.zone.piag.doon
    1⤵
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Checks if the internet connection is available
    PID:4687
  • com.zone.piag.doon:daemon
    1⤵
    • Loads dropped Dex/Jar
    PID:4762

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.zone.piag.doon/app_mjf/ddz.jar
    Filesize

    105KB

    MD5

    23ba0b249042b7ba33e92c0199b0ea4a

    SHA1

    99b13ee9f7307316c2337953fceed87e9942b794

    SHA256

    1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

    SHA512

    0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

  • /data/user/0/com.zone.piag.doon/app_mjf/dz.jar
    Filesize

    248KB

    MD5

    a54a18b58c6720991c021f433dfb2a46

    SHA1

    d2ffa07919f92b6e04914e39843f08fdb2a75b68

    SHA256

    3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

    SHA512

    e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

  • /data/user/0/com.zone.piag.doon/app_mjf/tdz.jar
    Filesize

    105KB

    MD5

    293ea5f01e27975bed5179ba79d80eac

    SHA1

    c5b0806a537fd1cb753e11f1a9684933317716b8

    SHA256

    8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

    SHA512

    c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

  • /data/user/0/com.zone.piag.doon/databases/lezzd
    Filesize

    28KB

    MD5

    fdb8a92e5060ce104e8f0faca55a47ce

    SHA1

    270d7ca30673e18cec1d2b9add71cba96dc426fe

    SHA256

    194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a

    SHA512

    ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

  • /data/user/0/com.zone.piag.doon/databases/lezzd-journal
    Filesize

    8KB

    MD5

    397317db0fa8cbeda9f7b71f53df1fa6

    SHA1

    3f254c7042116fd4442b5cee810b975879d1e7c3

    SHA256

    98585a1cc0197866ddeac4ab74a0760d97e040419bb8f8702a19750f1621fdc2

    SHA512

    b4c5001713e61935dfdc2220b063205bcd8f46960bfda9a6f581bd2d949b71ea178541cb00809c024b812007eee11d298f7acc8615f6f9e018ec731736e5d721

  • /data/user/0/com.zone.piag.doon/databases/lezzd-journal
    Filesize

    512B

    MD5

    7c6c92a53646d813ffef224f54f1ad5f

    SHA1

    bd569503e1cf8f44edaccc34f0ce2211b814574f

    SHA256

    421677a80de0d03da0b3c78ae445fdaec410334cf25e0e6e96441e00cccd91bc

    SHA512

    40d17c39d40a5b8830ce5200d3bd7ffed6841449e31fdb1afa256993ce368e30ff9741f98be77809a3a5244261356cf23d7628576cb8cc63f2d67ecdd20a6f1c

  • /data/user/0/com.zone.piag.doon/databases/lezzd-journal
    Filesize

    8KB

    MD5

    6e9f97c187b72fda80d6748ef56dbd68

    SHA1

    a3c05b62dfbebb34bcfacc0053ecb31554f810f2

    SHA256

    5eaf1566fb10fb918b74c6b8e835ecd81d849a6acae0fd8a8de161b5621747ed

    SHA512

    3dfeeaad4cdc11348c8a6fe1112f0cfaec3126ca9cd392adbddb5872b164599bbfdc3ab3ca52c34626a656a011940bf4bc1de784ce63b1c9eec727522909d567

  • /data/user/0/com.zone.piag.doon/databases/lezzd-journal
    Filesize

    4KB

    MD5

    f8386f0d593101328cea54b89b0257ae

    SHA1

    aea3b5420f1f5ac5f102e3e18cfbdce6665b2fbf

    SHA256

    b6198317dca36b123a7caa5fdd264b76f33d4e3421b94f5da6a7b661c995b3c9

    SHA512

    0c6875a8886099f298a45b2e0f37f328e8e6f0fe2d0f73a3936be6887ded55eb61c29895d142bcf1f0c121528e8286b22518792c0be3f9f386afd305c161a5a0

  • /data/user/0/com.zone.piag.doon/databases/lezzd-journal
    Filesize

    8KB

    MD5

    53d6c212a42fef3c9d6f9d31479e801f

    SHA1

    fd586b933332bb2ee75a2a5ff34b20062154387f

    SHA256

    543b5925ee289506ca24608bb685ec38c9bb76db3224fee8acc21081e6781f2d

    SHA512

    8bf549cf82d658fd81f929b18764121bbac8b666c03a2a2b0bff916b8788e3684511350e6229c74b48b43ee2d39e7ef9193b7bfb8797c6128dc2788da8a3fcf1

  • /data/user/0/com.zone.piag.doon/databases/lezzd-journal
    Filesize

    8KB

    MD5

    f32ca0725c5709c82958463b098f139c

    SHA1

    0dad521bd033c5a0ad72606d82c366fc327ffe6f

    SHA256

    8c10313e114d6a9b1739262c4aff9819d2deb442d552239885c12ca42f935789

    SHA512

    62b99fd58a500f6e0d954c7b761b489d2b993f87734c1aa3b7cd655ef4d5eed7555fe7f329e9cd58c779003828d1b72a65709e4ba5e9fcae126b320dce30a21b

  • /data/user/0/com.zone.piag.doon/files/.um/um_cache_1717417610873.env
    Filesize

    644B

    MD5

    1b7df478874f8cee294ac87c8069ff5c

    SHA1

    f0a6f0dd2b6581dcb2d3c8caeb063026b55bb1b1

    SHA256

    d638de6aa96a4f65a80d0b9964798e1f246675e98eabc4b22c232357be16d8e5

    SHA512

    50815306d2e6cb4adb468df6c33eaec48ece40cc868d8888610917ea67f0a5ec39ff40b441cd4c75802ed3bf97dba524668eab623409e2be05592e7a8af9b4c8

  • /data/user/0/com.zone.piag.doon/files/.umeng/exchangeIdentity.json
    Filesize

    162B

    MD5

    35dca7e5bb9a564476258147f58d8adc

    SHA1

    223b33b07d45b037dfb30a98c4d997e2a68f9989

    SHA256

    a896170c068bb24ff356a930c0788ef62bf91f96805c80fff522c7a1d7a1aba4

    SHA512

    b4b7aa82c7b5bd1e08e417ba921a0d09d9b289c1344c1b513c6f1cd9f6aff44f5aca5e8b696ccdf32cc338de71f2814f84449d1c52257244c83d7b8398047fee

  • /data/user/0/com.zone.piag.doon/files/mobclick_agent_cached_com.zone.piag.doon1
    Filesize

    790B

    MD5

    fe15dd31bdd3136a8f58f6c05108b539

    SHA1

    01bbb6008f63f2ec735643bb2091747a3ac10864

    SHA256

    541e1bf46eef32a8676b916dd904aa77126e2db485e3a728ee775cb3da36e72e

    SHA512

    a96fc2a8a7a21404c1b878a930c910f87edcd407669df3b7c788399e29026f075f0e8bcc2246fe5b3e8d18f468468756714d6c34755ec23bb0e33cf8e8406e53

  • /data/user/0/com.zone.piag.doon/files/umeng_it.cache
    Filesize

    350B

    MD5

    dd629a27cfbf1682e442e6aa5cd795e9

    SHA1

    a443431b3a111e9aa347f63b6a2d823a2872ac5a

    SHA256

    d547601584b3b2eb925b67c5758481f6db9dfa9c6a8768be7b32bf952299f55e

    SHA512

    a151c4661dba16a3ba00475e7f24ef68333636e50c741544bc60fecef1c9f3f0c645344a56998437fe73ff3dcd08ce2d73ea8dc36fe22a825f8f422d52218628