Analysis
-
max time kernel
179s -
max time network
178s -
platform
android_x64 -
resource
android-x64-20240603-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system -
submitted
03-06-2024 13:10
Static task
static1
Behavioral task
behavioral1
Sample
91e6b4f1000ece702971b42bab9827cd_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
91e6b4f1000ece702971b42bab9827cd_JaffaCakes118.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral3
Sample
91e6b4f1000ece702971b42bab9827cd_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
91e6b4f1000ece702971b42bab9827cd_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
91e6b4f1000ece702971b42bab9827cd
-
SHA1
3cde035d99777a0ddf74cfd87e83b89dcca7e5dc
-
SHA256
359e9df94f774ecf19b3bd9b938a0d1528d0767a9c35e45b206268d159d1329d
-
SHA512
a68e51016d62956e65c640cf01f2728352131714b2c3257947e98b3cee351a6fbf851bc38d2d3c131aca85b1c0c849620fb50df429fefa4b6d580fad8cc6a805
-
SSDEEP
24576:AvQ4oL0otaYtXMheS8X3lUKfcfIkuovSp0Zj7o+cwjgz4q/13tdHbZKm51Ob83j:NQ7YtXX1wvTvSp+jXxjgz4q/1XHNKmjf
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.snaz.oout.txvwcom.snaz.oout.txvw:daemonioc pid process /data/user/0/com.snaz.oout.txvw/app_mjf/dz.jar 5140 com.snaz.oout.txvw /data/user/0/com.snaz.oout.txvw/app_mjf/dz.jar 5208 com.snaz.oout.txvw:daemon -
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
com.snaz.oout.txvwdescription ioc process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.snaz.oout.txvw -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.snaz.oout.txvwdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.snaz.oout.txvw -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.snaz.oout.txvwdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.snaz.oout.txvw -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.snaz.oout.txvwdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.snaz.oout.txvw -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.snaz.oout.txvwdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.snaz.oout.txvw -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
Processes:
flow ioc 28 alog.umeng.com -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.snaz.oout.txvw1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
-
com.snaz.oout.txvw:daemon1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.snaz.oout.txvw/app_mjf/ddz.jarFilesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
/data/data/com.snaz.oout.txvw/app_mjf/oat/dz.jar.cur.profFilesize
727B
MD523c181a2d36eccbada96c4a58386ff94
SHA14cc44adf7fd391ba6474547827d07722270af8e5
SHA256562322ecfb89a7d02c0bd6a17a66cd1f96c81ec7bbf0e322bce177358f74307a
SHA51259429c8524df4f4d1d1e2ca1c507f41a82364f2c455aed7000dd95191b5d47da4fc8aba9cfa7439bcaf7bffdaf29f5d550efff8bc06d432e179620c95ab90857
-
/data/data/com.snaz.oout.txvw/app_mjf/tdz.jarFilesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
/data/data/com.snaz.oout.txvw/databases/lezzdFilesize
28KB
MD5dae68dcffc3d522a79f98ebbc3b6d457
SHA16df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA25656cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA51223b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
-
/data/data/com.snaz.oout.txvw/databases/lezzd-journalFilesize
8KB
MD57a27d61b9c118d77777cf0e9362d9cec
SHA1dcc499bf348c63e5049350747ddd07ea377e04e5
SHA25628109b16d9775dbe1bf9d8682dcee2f2f604be320635112504f8beb542944f40
SHA512eb8c119253324503ad6a5c2eddbcf06a7484d729013ca7dbb87d267a451bc8ff02e5fe54203ff85d5559b07cb5b355f3098bf895d316038e31954b67378833da
-
/data/data/com.snaz.oout.txvw/databases/lezzd-journalFilesize
512B
MD50df5dd5e335a8ca73ef2027f98be8bca
SHA1e64975041afe4a977be2b09a195a12f131c2059d
SHA2561260a2836adf8d1f961df7c028bd17f31612bd710ccd299034add066e3d7f0ca
SHA512e9b4c803375cd112a78ebc370b58e5e16c34f82185f441768bbd0bfc2fc18dd1a7f065ca6c4b6ac11e0f56ad463507b8408c21ffe55a89af43df2b6e4b94d885
-
/data/data/com.snaz.oout.txvw/databases/lezzd-journalFilesize
8KB
MD5cb5ca837a8c54ba41325561c7ec54912
SHA1993f6fe762af5b3c21c6a1e3ead8a49505801336
SHA2562d4c5a84664e421fafeba53ade74ccd8631f925533172d256905d10ffcfaf9c7
SHA51236ea665be0ff2dece9ad284a34139ee8a25a03e71f84285963dc7b8bc006b29e78943ec39ecad37090e264366f967cd1ef6a28c7e42f4b19d044b8b82cff96a0
-
/data/data/com.snaz.oout.txvw/databases/lezzd-journalFilesize
4KB
MD55e896ec39967765dc1406e4740faf2a9
SHA168b576e337c42e69db8eacbdfafbc25da240f7d6
SHA256f02da2a0719d9055c3e55eb9bb7d5148e37c038b3b2087b83e8cab9d4b52be43
SHA51294fffa064923e95d4f2e4f73a8cdbe544feea260d734ee74c78401fc805c33c90d9ee6352f722a5dff927069e319d7afad8a9ef52d72646095851ba6bee59095
-
/data/data/com.snaz.oout.txvw/databases/lezzd-journalFilesize
8KB
MD503885b8d0eebf46824a5ead3f96d5f86
SHA1cd14b091446c24ce8fa4a097a0ea89bacb96524a
SHA2561abdf9c9ecb43ceb41df5191edba0cf9fc3195326a9f40dbbb7deee0425459e5
SHA5125e06dd1f92acf110002bf6361a8b21703ef0b491dfe8c2c6c904fb6b0a5540b4e77d49d9db951a7880c655178840eece56529f59b5e3c49da4fd6ef2704770a6
-
/data/data/com.snaz.oout.txvw/databases/lezzd-journalFilesize
8KB
MD5632243421d802b3338044d8e487191c6
SHA10ce2539465d53bbf8377fcda15049a3838997515
SHA25676646b6e16a29003585401b8574010047f9fc2447169289783d8fced1b3881a6
SHA512458a8ade10e4d0f37585677dd8f39d716ba2163f1e100cbf0774a801a407055e73a12f7ce294f37dd96b4c7e6724d7a7f296e539d23d16c86288a7986d1e081c
-
/data/data/com.snaz.oout.txvw/files/.um/um_cache_1717420341356.envFilesize
656B
MD5500f5997db63ca0266df2d2b15271ba6
SHA166f091d6a9c1e43468be66ac4946d02762d8dcef
SHA256a415914e13f60b1cb4486152e6dce4bab9b0f6b9216d5720850e40e3a1618b70
SHA5127e0a2abac917e361a89a7c800a4febfc07218feaf0f3b2ddb9787d74bc39805377f5b50393db0541a1e17a5d03df52a9ae3b04f7e5541409e12a705fb9f03ddc
-
/data/data/com.snaz.oout.txvw/files/.umeng/exchangeIdentity.jsonFilesize
162B
MD5f04f989563d8084d8f2a59d48603e4f8
SHA1ba6d5fb7e627216c517f2ede79bdcdee456de261
SHA2565d93f2e47c8bb32d75ee287aae6a811dd710563494b81e8bffc07dc1ea4d2f8f
SHA5128fd7f13a4d8cc31ef393a56129471550f1a76d665639ff788870c4dd98070f83a3af559db6ec044502c04f96c1d279f04aea4af41afa73605331e0dc292cccf1
-
/data/data/com.snaz.oout.txvw/files/mobclick_agent_cached_com.snaz.oout.txvw1Filesize
794B
MD559b5bfe09cf6e35c701845cdf6232a51
SHA15d773a31d30d85b92785c6f968863409dfaf38a8
SHA2560e3d82530c067eb231b4fa3a5ff66948d6e501f35c6a92b74894c1d65da58061
SHA512bb57258bc4ca24cc9202f1e782800bea3acd3faf6751bbecb62e20040998eaf582068858d75f4c96a080799653cfda3e0395018b5c46582a49361fd5da21f992
-
/data/data/com.snaz.oout.txvw/files/umeng_it.cacheFilesize
350B
MD53ccfe83a63cfd8df668e4d6f87e1c9d7
SHA15bfd7fc10e15475346201cf99ed1ee07f1c926c6
SHA25625550222cb37d79be9d146d6d0fac07fc25303d1bf4d8542a71da0569c56aaf3
SHA51249e3b54d7343c6592c7571c334acd746ed334037d64f9a45c741265ccc668918fc218f35de9151822a642594da8e39a207f386577e39ca1ff479ab1a55389e54
-
/data/user/0/com.snaz.oout.txvw/app_mjf/dz.jarFilesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc