Analysis
- max time kernel
35s - max time network
169s - platform
android_x64 - resource
android-x64-20240603-en - resource tags
androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system - submitted
05/06/2024, 08:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
979194d3351a26cf637ec97920e5790f_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
3 signatures
150 seconds
General
- Target 979194d3351a26cf637ec97920e5790f_JaffaCakes118.apk
- Size 20.5MB
- Sample240605-jysafaad31
- SHA256 cb754874f8d6ee93fd0bc1bf9d73b3c8fe76d9aa40f64b29b3470bf6a18280d9
- MD5 979194d3351a26cf637ec97920e5790f
- SHA1 8e0743f92b07864ca45a4260d5e8883ca38c5bb1
- SHA512 d1c23c752fc21883f1cd3e3db8a7c81c3bf273d26bb5ecd04319a85a0ba13223b7f1dcf7b987bb64d8fdeb30128fcf4740a42bd09a2ee97db6e0ee467e8f237b
- SSDEEP 393216:3oGUlncmZ3gNJpng1Tohv+BDUKp7rxVPJ26NzNCPf1megmkcRrvVQC029R7UEmQA:3FmcMgNJpncDxp7rzP7NzQf1BrrZ0CRC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
flow ioc 2 f.appjiagu.com - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.gsjinhengsheng.www - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.gsjinhengsheng.www
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.gsjinhengsheng.www/.jiagu/classes.dex
- Size 4.0MB
- SHA256 c2a068b0e1411bd1971dd91eb4f060cd5aca353d72acba3874ec90d12055ff63
- MD5 71d3a74f29d189f76ffd175b686e7d32
- SHA1 e49df4773fed13071dcf8e7d68ded05a39b7cb2d
- SHA512 eb71638996ac584ff9e45ddc56cc3691595c6ea85c90c2890130eaf6cf1af5f67e72d4d4dad46878beaa62b3a5943bc402fccbf722fee3bb8e3f28626abea640
- SSDEEP 49152:4ZX3QVY20Rgantu4wxHka51A8qKa5gfOfrl7FdXR5LWgrrDb:oXua44wFA8qBGf8p5dXR5HrrX
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.gsjinhengsheng.www/.jiagu/libjiagu.so
- Size 363KB
- SHA256 945e12ea3019404a01754579a234b21ff3c7c17c175750e514c0d404e9f30554
- MD5 1383b616dee6678b3591e577ace67225
- SHA1 f2b0f5968b52f9c3ed022f3b3ba67e6142df89ba
- SHA512 72dda5b9833701c52e44260d979f6b91dface07899aa20ea686ef3d09f3225826140b7e8c336072aca21d51e88151a3fdb6952fc53b9749051f16197e8086b60
- SSDEEP 6144:dssXwsfgPhZt6JPeUTN/yt6q7GwyKpbJMDAEcQuK7sUCuut80i5bnyupho2v:+6vfCZt8eu9K6qCPKpdMDJutH80wbyup
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.gsjinhengsheng.www/.jiagu/libjiagu_64.so
- Size 349KB
- SHA256 b0a8f05575799435edaa9aa48319c459062259cc127748fc123536ad79f11470
- MD5 fe499af830d13d61e81eb64ad109a06e
- SHA1 49898e14b29efc938099c7a4acc05064a09d5831
- SHA512 8f4edfb2b22d326e55fb6186ce66640300f150e236e5c5bc69206bb21c8b4bbf9e4b759f2210ade37fea15c6772bfacb8510d03b6cbe1e6c966298c7d7a7055a
- SSDEEP 6144:BrA6LXicRD5+YTRJK9f6WG6SMeckSM4+QNtp/5O9EXRqDI7Hn6dodbwJ:Kyn+wJuDRjM4ZxIAq87Heo2J
- MD5 SHA1 SHA512 SSDEEP