ddea3466943e984f7fe84eb0d1d20b3f6ff6b180e00698056fc568cd4e05cc3c

Analysis

max time kernel
176s
max time network
181s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
05/06/2024, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97e72d4314951b53a91fc70f0e8eb1b5_JaffaCakes118.apk
Size 1.9MB
Sample240605-mrrxwaeb52
SHA256 ddea3466943e984f7fe84eb0d1d20b3f6ff6b180e00698056fc568cd4e05cc3c
MD5 97e72d4314951b53a91fc70f0e8eb1b5
SHA1 ef1b6aa74d9aeedcedd2bd2cdd37c8aeb802b3c1
SHA512 14e53e591e13e71757aef77ea78174a257e2e53fcf6f7c3f58ee76129fad9d4c27e0e7e9c02ef65f3dbacc9a3bbf800ebcdc2252b9aac0ffd8bff505b0deed56
SSDEEP 49152:Bmx9im9dWXHWoXjHkDZ2kRKMkufXUBsNxW88qlXuWG2:+iCd02oTEDIk9ffXms7W85uE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ywqc.vygeytbijujh

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ywqc.vygeytbijujh
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ywqc.vygeytbijujh:pushservice

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.ywqc.vygeytbijujh

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
15	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ywqc.vygeytbijujh
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ywqc.vygeytbijujh:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ywqc.vygeytbijujh

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ywqc.vygeytbijujh

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ywqc.vygeytbijujh

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ywqc.vygeytbijujh

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ywqc.vygeytbijujh

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ywqc.vygeytbijujh

com.ywqc.vygeytbijujh
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5157

com.ywqc.vygeytbijujh:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about active data network
PID:5202

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

DianJinStatistics.db

Path /data/data/com.ywqc.vygeytbijujh/files/DianJinStatistics.db
Size 20KB
SHA256 eafd225409eba5142b9d24cd69d143f190eca184b5a5fe08980fd1892e512646
MD5 f56337c2ac28ff443f58f1d46a76082a
SHA1 5635519dccbee99986e0f028d408f764cf660a98
SHA512 c37b12bfaec196d4fe082e2fac4eed0f092529823fe2a25cdc1f29e00c6b14d13a4f66591560ae60269c5671f7573697943e95e96e46787222f91dbbe450d1aa
SSDEEP 12:TLyxqQyNTSFby/8UxF9/gpvRmBEyPbAVOwG:TLyxQl8Uxz/gpEGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

DianJinStatistics.db-journal

Path /data/data/com.ywqc.vygeytbijujh/files/DianJinStatistics.db-journal
Size 512B
SHA256 116fe80025a6fb52c69296db0252e3f9a3a4682d1b560bc735b8ec64a61839e9
MD5 aa5d0bbb4ecfdef4537219842bac9b67
SHA1 6f6d8ed855b2055167e392f44557d3b64d503d19
SHA512 02b8379e6cb0d9618e9469bd53452425ee8b7b7d44684e9b8ece465a69c2dc112d36389b946218356aa8a5bebadc81f9aa02bc410e1d43119dcf49862fc164af
MD5 SHA1 SHA512

Submit Download

DianJinStatistics.db-journal

Path /data/data/com.ywqc.vygeytbijujh/files/DianJinStatistics.db-journal
Size 8KB
SHA256 6cfd98ac1564225b0a72ad235b3e141a7fee57a3a99308910f96a2ffb93b078e
MD5 34981e9ab731ebf2d675afe3e849b246
SHA1 9e5b2f0595c0f53c58a26515a70f0a423ef48a22
SHA512 e7abf6e135a353659af2c0ebf98562ac07daba76723657b65e1cfbac6749a1a09c49079de746896eb1d7bcf56fe56f90d6f06dea4d8568d332ba04e03b308018
SSDEEP 6:7+/l9iGn1K/pg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKjn:7+tMbpqLiuWdwRmBEyPbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

DianJinStatistics.db-journal

Path /data/data/com.ywqc.vygeytbijujh/files/DianJinStatistics.db-journal
Size 4KB
SHA256 06cd69b0bae4ef759039c316d29b656d4f03fc5b8a3704618c0eb5e1cdc4f29f
MD5 89c1727097424efd6c10f3a6f979e472
SHA1 09888f7288d1482d6c5cb4bc814ee4376968d2fc
SHA512 316e1eb23e98f67d19b1739c5be5211d8f534bb9f4ada03c6a2a01966a87cb74d35af11d5e6c83773e8992d685ed61dcb9b4420b0cf359351ac34dddb6b2f46a
SSDEEP 6:7+/l8FPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKuU:7+tiqLJdTRmBEyPbfU
MD5 SHA1 SHA512 SSDEEP

Submit Download

DianJinStatistics.db-journal

Path /data/data/com.ywqc.vygeytbijujh/files/DianJinStatistics.db-journal
Size 8KB
SHA256 3835cbe3fe884bf4bce275404a6925142ecc64f24c3641289a4e082cbb7ee8ed
MD5 3023c2ce74aec08dfd2ec390072d68e3
SHA1 06fa27572d388c4b78ea72d86840c2d7e2cc3f5e
SHA512 80381994090fc70e62674d47bc34e1b036dd64d9e909bd941940bfd52c3fa83fe454e748c6a203d9b6e44072ea2daf45489ce57d6c67deee6ad694788c9c10eb
SSDEEP 6:7+/l9qdPg9bNFlqhKtwlOERX4PBX4ogLugMBX4suuKe0//v:7+tg5qLmVRmBEyPbf0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

mobclick_agent_sealed_com.ywqc.vygeytbijujh

Path /data/data/com.ywqc.vygeytbijujh/files/mobclick_agent_sealed_com.ywqc.vygeytbijujh
Size 532B
SHA256 a7517d42972f37d3806799c3037e7ae92b6556748531166bb669c588a0511144
MD5 7f57141d26472733e0d15ec4b453b1f3
SHA1 19405430d2d955a1e67cd15678a1cea4a6bf7528
SHA512 16aafaa60e403e6b716c001bab8854ff8a041a3e1b93588857235c84d3bc28d9615bf678a25ff455157d2606250831a88efaa467d91cf46dbc1a4e80ce3eed34
MD5 SHA1 SHA512

Submit Download

APK_RUNNER_DB

Path /data/data/com.ywqc.vygeytbijujh/files/snail_data/GS17B0Iaw5miZ3PIUouskQ==/APK_RUNNER_DB
Size 20KB
SHA256 d7998d32613de9f94c3a027f2e37c05fd702cf3bd19ce0adc5183078666033db
MD5 43ae8f1dcd7cc9f6cb537f1261422f4a
SHA1 d39c4881f956836645d811d145ec8541e844277f
SHA512 6e31f813d549cab28c8842627d83bde829b314d066d8c9a369477920d612e3cc3ce118eaf78f1026371c62837a43def0577026afba8693c0347b4b6cb99ec66e
SSDEEP 6:l9bNFlq4yl19bS8ay4ATSFRdLumL07tLuSl9yxL71xKf+ERX4PBX4ogLugMBX4sn:TLm9DayNTSFbynUM9SyRmBEyPbAVOwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

APK_RUNNER_DB-journal

Path /data/data/com.ywqc.vygeytbijujh/files/snail_data/GS17B0Iaw5miZ3PIUouskQ==/APK_RUNNER_DB-journal
Size 512B
SHA256 095b65575f87490ab42154c9b6de856e3b30634c1909c20b861f7beb85859848
MD5 34f15c0c748ed4c48c1ebeace2da5842
SHA1 46859a647da2ffdcaf2e74ffec36ec4ca6970fed
SHA512 1ffb7516dd1bb6917788ace0afd2a6c77ce0538c5fa25598ea11c24198bbb90a55d800174d74433ae2a2b90860c513a38545c2a463a01757e5b3d0d671858285
MD5 SHA1 SHA512

Submit Download

APK_RUNNER_DB-journal

Path /data/data/com.ywqc.vygeytbijujh/files/snail_data/GS17B0Iaw5miZ3PIUouskQ==/APK_RUNNER_DB-journal
Size 8KB
SHA256 bd89acc263600877a1af1fbb2743590db2efec010622b6af739d86bca92a7666
MD5 32a023c1fe3f1cef5d299d2c3f0be151
SHA1 e039bce22d23b59d727f2e55de8db3c948f0fdef
SHA512 ca151552d7598a0299e9de6f38db99a309206331c266c47e5dd559d18505f556ec4850c747c19831b4fc48721d2940173b7712ddcc0af30d075009e8eacee1ca
SSDEEP 6:7+/l9Mngn1Unng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKd:7+tq5nnqLiuWdwRmBEyPbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

APK_RUNNER_DB-journal

Path /data/data/com.ywqc.vygeytbijujh/files/snail_data/GS17B0Iaw5miZ3PIUouskQ==/APK_RUNNER_DB-journal
Size 8KB
SHA256 9ca9bbb8a916ab707d3ec4b304d990f464afa0b5f9dc0c70a8775ad59936b925
MD5 2b68ae511aab787494462bdafb6eb530
SHA1 279d1be055d17ba3a68ca37a7f78ebc2e6f224d6
SHA512 1b11ecf0caf099961b37fa231dc43498c159ee11159379eb266ba24c01407b0be195cf551ba84cfed524fce7efe76fa62122ba35293af9861072303bd0c242ed
SSDEEP 6:7+/l9eNHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKr/Gu:7+tQRqLJdTRmBEyPbkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

c1.r0

Path /data/data/com.ywqc.vygeytbijujh/files/snail_data/KEfZCdOKUz82ENpr/c1.r0
Size 311KB
SHA256 c3790b4404007b9aa9ff4d444f8a6dd06bdb87d0abd577526d53f61c48ec2aa1
MD5 2105b6912a973581d03e2d90037242a2
SHA1 28413eee553aebb3074c0d3cd00c1daeaeac6e8d
SHA512 3e356da40853bd761d3c1c91a8fb46e520263daade23e889d7c432d6326dfbbfb60f890a6ef389c593cb59edd2803d758a3953a96bc34df1dcdf66c513f29292
SSDEEP 6144:r/NaQmzmpxvWytr8+I9hc0K0jo/GD/KL3nV5sbH//dFbyc:1SmpxWytPh0HA8E5oXb
MD5 SHA1 SHA512 SSDEEP

Submit Download

cAxY5kEtnA9aAxkcPKKnGJ7S1uc=

Path /data/data/com.ywqc.vygeytbijujh/files/snail_data/ar-IWnNfy6ETh_pY/cAxY5kEtnA9aAxkcPKKnGJ7S1uc=
Size 48B
SHA256 06f812eef62ea324db93355b970a5984e525d61c4ea442db56886b25e7dd752d
MD5 52d5c7ace93542a726c1288306ef7179
SHA1 9cfc511c3c2568b1ac18c78e174a6d2a2df67669
SHA512 8f7f29d203128e03dbdc67d138a0b930e1a46e9bd9d5136b43bb16dd9bfbdafa7fbd74ddde154dc22871b8d8b3f1bc0c043c5b97e0f921be741965a7a98aaf68
MD5 SHA1 SHA512

Submit Download

tYDDNm8S8PJmBHVCxbe9QVp4nLOjmMYU

Path /data/data/com.ywqc.vygeytbijujh/files/snail_data/ar-IWnNfy6ETh_pY/tYDDNm8S8PJmBHVCxbe9QVp4nLOjmMYU
Size 41B
SHA256 2f13ec4b4e60e55043800c7c1dc5b8fe21039c728b14fee5ebbc8c61eeca693e
MD5 6e48c4d2d6bc0c29bc18d6b6b8ed17f1
SHA1 e0d48c68f4c36e0bed4ea991806f446635089ec0
SHA512 ef17b5d750b13ff5c322377fa80b707420b971868074fc98ad3be5afebc1009a30d0a8053990fa6742064559c1c325caaad436b33f6926fcbb31c260270834a6
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.ywqc.vygeytbijujh/files/umeng_it.cache
Size 148B
SHA256 1682b0da076f334cece390a664ab585207923f84054cabc3c3c6cd4eacee6814
MD5 d9ee5429fc11418fb266a92bfc9e16a5
SHA1 2994320934a73c8260bb476876b0458cecaaf3d6
SHA512 4189a16f360a3cd7376fc1cb97653e6204ffe5ca7e624c150f57ea1b801bac0ddf2eb8d61ff10c3e991a793060341b18cb96e5f77930ba160885f4b72dbc4f77
MD5 SHA1 SHA512

Submit Download

.DianJinStatisticsTid

Path /storage/emulated/0/.DianJinStatisticsTid
Size 17B
SHA256 c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a
MD5 0f607264fc6318a92b9e13c65db7cd3c
SHA1 c1976429369bfe063ed8b3409db7c7e7d87196d9
SHA512 9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1
MD5 SHA1 SHA512

Submit Download

b8e5a81af619976819edcd6494d63d9.properties

Path /storage/emulated/0/.dianjin/com.ywqc.vygeytbijujh/properties/b8e5a81af619976819edcd6494d63d9.properties
Size 81B
SHA256 a28ac6a5123b0e75bdbd548f8dd0e07ece27f59f75ec8b702ee78cb15897c160
MD5 1724514bc06737f2610051198e4978df
SHA1 baf3bfee40aa131dddcd7da16ff0a911aca2670e
SHA512 90ddc6a77e28c621ff0660d20d9ab427bf5e44cb4ddc08cf948e890c56bf90f6b8b2f543563f76accda84262536663d16f7eb91bbf90d3b0e3ae083a57a674a2
MD5 SHA1 SHA512

Submit Download

history

Path /storage/emulated/0/.dianjin/com.ywqc.vygeytbijujh/properties/history
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads