Analysis
- max time kernel
49s - max time network
156s - platform
android_x86 - resource
android-x86-arm-20240603-en - resource tags
- submitted
04/06/2024, 17:32
General
- Target 95b27fafeb263f37717d90ac84a2e356_JaffaCakes118.apk
- Size 11.8MB
- Sample240604-v4knbsef84
- SHA256 f28d7105067580d6a30f913751da930442471043e5cae47e83455a65a380f186
Score
6/10
Malware Config
Signatures
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
Processes
-
com.yxxinglin.xzid7231631⤵
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
RKStorage
RKStorage-journal
RKStorage-wal
cc.db
cc.db
cc.db-journal
cc.db-shm
cc.db-wal
cc.db-wal
ua.db
ua.db
ua.db-journal
ua.db-wal
ua.db-wal
.imprint
exchangeIdentity.json
exid.dat
umeng_it.cache
umeng_it.cache
dso_deps
dso_manifest
dso_state
dso_state
libjcore110.so
com.yxxinglin.xzid723163