a7554f86b01f3f69e4e562f6d1ba3e27a7dd708b5c5876505d33af30cf075708

Analysis

max time kernel
172s
max time network
187s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
05/06/2024, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96ecd132b3ca77ac8fcbfbe3ff234c33_JaffaCakes118.apk
Size 25.6MB
Sample240605-b44lnabc68
SHA256 a7554f86b01f3f69e4e562f6d1ba3e27a7dd708b5c5876505d33af30cf075708
MD5 96ecd132b3ca77ac8fcbfbe3ff234c33
SHA1 307d5a61106dd46a9c917353f39de85522ef68bc
SHA512 47f2b2ef2fdc0f72c367ad4b1d21fe59f1de64f5f694a2a762d9186b75bbcac662efd3680ccb0c1f23aed5e432cbfe2590cc6a166ff956c59de4c2a6a2e4714d
SSDEEP 786432:dENMdeXZy9XKZVupbg5txfJJeDHpUWQs4W:OMdeXZS4ewZajD4W
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.huangtaiji.client

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.huangtaiji.client
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.huangtaiji.client:pushservice

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.huangtaiji.client

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.huangtaiji.client:pushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
17	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.huangtaiji.client
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.huangtaiji.client:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.huangtaiji.client

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.huangtaiji.client

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.huangtaiji.client

com.huangtaiji.client
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4477

com.huangtaiji.client:pushservice
1⤵
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
PID:4523

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

init_c.pid

Path /data/data/com.huangtaiji.client/files/init_c.pid
Size 80B
SHA256 eedf9784108f7bec43d4bf891cf0e9973f18670556d38e760c838728747a8e70
MD5 cc64e0c4ba8573e5843c3b1e2ccabd49
SHA1 6b8e5c6f76024a78d0ccfc1d11cc68dd29392d9b
SHA512 54b4ef911f3a3b2dd0e3cd95645a4242574b3b8689af69d3ae330ef594515f8606a64133ad5ac40f86afb3416a412a26c8611bc5fc6c75aa6be4ffc7733908b1
MD5 SHA1 SHA512

Submit Download

pushsdk.db-journal

Path /data/user/0/com.huangtaiji.client/databases/pushsdk.db-journal
Size 7KB
SHA256 0dbd224c6b31d84b93c8fa1c1ca507a9b6f0eaaf5e07c379bdd4df84765de1ba
MD5 aab42363602699809ee0a46a473ddb48
SHA1 d095aa8648f5b8588dfc7d143544743e85f62e8a
SHA512 f9b3dbe1237774a8541c6955b2ff93a7106df7b3f22c38aa649ae1d7585678b3db7c533dcdd4ae69812daf49fb4ef19804df5290ec35b5ef9584f3961c9a06d6
SSDEEP 96:6eH/HeFrmSn5kFAn6spdWuXDzCSI1Z7gNHDYLX5xNlE50Eof8HeIW1Su:5Ohsc6iddzzgOHqs5v+8Hhu
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/com.huangtaiji.client/databases/pushsdk.db-journal
Size 8KB
SHA256 222ab2b71aa32378446d8ecec46c70f4d910b0bf98040e7819e36c5037981f62
MD5 e6a4e89e5e240d08b60afdddb7e81406
SHA1 c4bcd7162bd7019c47c1148030bb2852e073907a
SHA512 f2d0aa391fb3b542a501ebe557f8737748a56dc48dee183b741ec15711dd2c7de311573a50a439cfdfc09ab2543e29b99847fcb06448a4457a53aef74a85917e
SSDEEP 24:6yJi80qLYvW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSEi:6yJeqR0xopA/t379y/MSEi
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/com.huangtaiji.client/databases/pushsdk.db-journal
Size 18KB
SHA256 474eb194b1eedca4d0166a7b9b4d67c52eafaba8dd5469dea346bc4c083aaed2
MD5 ab45ef407b7642dc2f5bc3de034f3971
SHA1 06040aed35962bb35787a47c8f79a21a96fdc4f8
SHA512 8cf23385ccdfd3fc63e7d603909b9a92e05ac40a9321a6c8f631af683be4fc0daae700b8f9bed93a26313e350c5d08b384c1a7efbac0268330c6f8b009b2f8ac
SSDEEP 96:71XM0+pYto/toZi+A8vv3EvKs9oJrNk7ydBaCXgzYcIYAejrtl2lxSjLIj5G0M+/:7BMyto/A39JrNVrQfn3WSiLilx1Y1
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1717551894457.env

Path /data/user/0/com.huangtaiji.client/files/.um/um_cache_1717551894457.env
Size 659B
SHA256 c40cce76e3accb0dfd3152fd798428b6f182f00e071134fc4312c3e213a253e4
MD5 cf9691ed2003ada8c42143d664310785
SHA1 daca0a46fc139b5e6936b5b5c75cb45ac2f455f8
SHA512 32abc4a1115fac9c18c4b3b7f18537d2b45f6fd04e9d5b5baa88d0420068c73488655dd092df8851e2e4ee1fb0924c7b73ca2b1eeecda5d3a14eb2db8c7144ee
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.huangtaiji.client/files/.umeng/exchangeIdentity.json
Size 8KB
SHA256 1b6b8107b0ee5313cf5bc8cdd9c2b2ce67725de5ecd2099c169dfa50a76eac82
MD5 c7d1af44bb81b4344c5371114904a926
SHA1 c4d8252e6bc801df9e8e4fdff0a009a4b110abd3
SHA512 696e2885db70d62d42a731409b321d7277ce4b0a32bd4042c2129931a52975c0b739f11f605433968c647909f58af3e499eb66f5951f82c2e706a53994bcbe41
SSDEEP 6:7+/l9it8Fn1KtRg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKkmn:7+twt86RqLiuWdYRmBEyPbgn
MD5 SHA1 SHA512 SSDEEP

Submit Download

lotuseed.s

Path /data/user/0/com.huangtaiji.client/files/lotuseed.s
Size 159B
SHA256 4078c3dfd5c995d823b9eadfe8079b010c68240ea97103f2b77ed414322ae864
MD5 2551c8ea20ce2fd9170654be871f489f
SHA1 dbd7380ca21d6f788464eddb836b5034a534dba2
SHA512 c8ad098b427f63312e3dcdb8c2f7dc7442ebe805688226e7383145159a9b3af28d17d0854c111f2d9474322b37b02a9509320e06fd09ed7324effb023cf753fe
MD5 SHA1 SHA512

Submit Download

lotuseed.s

Path /data/user/0/com.huangtaiji.client/files/lotuseed.s
Size 8KB
SHA256 5d45c6bf84431eb017dba41f2975ade4ee6c0c5d00fb0b96fec5aeba6f20fff9
MD5 6d2b87f0f8b22c9ecfc40ce0b078cc9c
SHA1 6a3b441d5a5ec28ab0f130168e7a9c1fe7dd1925
SHA512 f85781dc257da9e21f29e595ea1890d289bf2058458025d17abb7c55263bcb781f9f33f036b08e6b9ca58173b9629aef80ed8066947e6e93df092c7839051887
SSDEEP 6:7+/l9gfPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKX/4s:7+twqLJdeWRmBEyPbc4s
MD5 SHA1 SHA512 SSDEEP

Submit Download

lotuseed.s

Path /data/user/0/com.huangtaiji.client/files/lotuseed.s
Size 165B
SHA256 6754409f3657088651b3b18c31b99200ff68d1232565cd60abd67204634ec39c
MD5 024e870dea2cd3809df7f7568c40c214
SHA1 e89b1a421948f4e3f937a5d1b08a822d8fb2b8b9
SHA512 e780f8435a7df4c318aa4fe6c2c1cb84e70f2fafb13c7cfd63510f0a4f095347e0fb6a3f559708a0959e2388e6f220c1f25d085a01d72754e0153a89772e42c5
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.huangtaiji.client/files/umeng_it.cache
Size 512B
SHA256 db0db0e935ca3228cfe4625c159e94f88c41a48fd6b060f0bf56ee71af88b762
MD5 46cf96b31b5ac432bbb61e61b1908906
SHA1 5bcd44be418ae0cb2ae75e88e0eca69576156d7f
SHA512 46f36c346845005b127745e7c0b721e3b96d132c22fbfd19da3a6eabc40a7827d2e41eb6e6b30d898ec3d013846107f151f08e451d1c978f003e04815ece8a9d
MD5 SHA1 SHA512

Submit Download

lotuseed.devid

Path /storage/emulated/0/.system/lotuseed.devid
Size 44KB
SHA256 4fc643debe60da4a780f66531fbdd0e4a7988960706fd3355b77321d36c39e14
MD5 6cbed7cdda0db8bd56338dfd5b10ba4e
SHA1 3431fc1e927bdd31728a3007af64469bcb7a3d8d
SHA512 bd64e988fb82bc8a0db6f57d531b2ca68bba5e6e6204751006fbd36e30182ac80bb7abfca9e45c80dfcb42e3ca0759963c37cd3aab57ae617c59923565a3cd77
SSDEEP 24:TLavo0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGS+qU9KCAoMQqI49uQQe:Tx0xopA/t379y/MSBMKt7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads