ddea3466943e984f7fe84eb0d1d20b3f6ff6b180e00698056fc568cd4e05cc3c

Analysis

max time kernel
175s
max time network
177s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
05/06/2024, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97e72d4314951b53a91fc70f0e8eb1b5_JaffaCakes118.apk
Size 1.9MB
Sample240605-mrrxwaeb52
SHA256 ddea3466943e984f7fe84eb0d1d20b3f6ff6b180e00698056fc568cd4e05cc3c
MD5 97e72d4314951b53a91fc70f0e8eb1b5
SHA1 ef1b6aa74d9aeedcedd2bd2cdd37c8aeb802b3c1
SHA512 14e53e591e13e71757aef77ea78174a257e2e53fcf6f7c3f58ee76129fad9d4c27e0e7e9c02ef65f3dbacc9a3bbf800ebcdc2252b9aac0ffd8bff505b0deed56
SSDEEP 49152:Bmx9im9dWXHWoXjHkDZ2kRKMkufXUBsNxW88qlXuWG2:+iCd02oTEDIk9ffXms7W85uE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ywqc.vygeytbijujh

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ywqc.vygeytbijujh
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ywqc.vygeytbijujh:pushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
18	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ywqc.vygeytbijujh
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ywqc.vygeytbijujh:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ywqc.vygeytbijujh

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ywqc.vygeytbijujh

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ywqc.vygeytbijujh

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ywqc.vygeytbijujh

com.ywqc.vygeytbijujh
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4550

com.ywqc.vygeytbijujh:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about active data network
PID:4588

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

DianJinStatistics.db

Path /data/user/0/com.ywqc.vygeytbijujh/files/DianJinStatistics.db
Size 20KB
SHA256 2b64f47638731959b570170568d73c1ee4768aeff733e357a74fcb9654e85376
MD5 9635335110f5783d68c6e57e5288f00d
SHA1 d5238c0a8c1aadafebcfeef0aee3a1b7e15125ea
SHA512 eaeb047c1492c456a2b7e775c30657f2dcc11b5414eb7c8c1cdfa8f92a298064a62809ac43e02e1f403649869f3519a23fbf4c83b5494f68c54fd2b4093d3393
SSDEEP 12:TLy69QyNTSFby/8UxF9/gpvRmBEyPbAVOwG:TLy67l8Uxz/gpEGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

DianJinStatistics.db-journal

Path /data/user/0/com.ywqc.vygeytbijujh/files/DianJinStatistics.db-journal
Size 512B
SHA256 4f7dea56381e9f6f849bbd60b57003492c473a7b142006c0261d06d5e39ded19
MD5 d3e8923bd6984f09fd93836f0145dfd9
SHA1 326c7ebe1c2b2610ff6ec67b26b5ca9df445894d
SHA512 d8c5fecaf04b4bbdc3fb26ddd45b2b08a13bcceea2534ac06846d16f4d60c60481a47da8d61324248f232e20f0113dabaaab9c2c8a180ba6d57371c6ba131b62
MD5 SHA1 SHA512

Submit Download

DianJinStatistics.db-journal

Path /data/user/0/com.ywqc.vygeytbijujh/files/DianJinStatistics.db-journal
Size 8KB
SHA256 bb61c3e50ee5856e8eeebe9193b524ca96164e86ef6d206ed4942074075ece5a
MD5 39b87781869b362eb4d46351efcec211
SHA1 675a9046b184ac6ed14e325234cb8d24ab1bbb6e
SHA512 a29a64b557a7275e7ad8c02c57ddbe3e2e27973eeb4b9c6683f084650dfa48011e417fe377ebd42f5ea78975f4499b1cac25ae5a529efbc39208f8dd9739ba70
SSDEEP 6:7+/l95Fn1Ypg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK6gn:7+t8pqLiuWdYRmBEyPbOn
MD5 SHA1 SHA512 SSDEEP

Submit Download

DianJinStatistics.db-journal

Path /data/user/0/com.ywqc.vygeytbijujh/files/DianJinStatistics.db-journal
Size 4KB
SHA256 6ca21e3366f76dd90360dc3a5e4e883aca5f819472cb1ec1381ca2173367895d
MD5 d520894fb6a61f7a7e9bb5a418598e81
SHA1 24da66a1cd383f3df3d6c4b13b4c717ecdf48148
SHA512 24d22fdab293d6e77ced58d92ea4685db2277ade5c10a40b84c83282d69bb1c6ed5c28e99300198f199c3ed9d61ea86a64256b8fdbed480d6f71071fe3d67baf
SSDEEP 6:7+/lpPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKWn:7+tVqLJdeWRmBEyPbR
MD5 SHA1 SHA512 SSDEEP

Submit Download

DianJinStatistics.db-journal

Path /data/user/0/com.ywqc.vygeytbijujh/files/DianJinStatistics.db-journal
Size 8KB
SHA256 fc9fe3f8b70100a5ebdeb906dd23e8ad012055168f9b5d35ad93c995f8723b35
MD5 ab640e473f97b75489890d7515ab0a05
SHA1 28de65333d5b8f10de2a38e2dcbc22bc44a887fd
SHA512 8238c45b0060c456e032c271bd7584c97b9046eb6c3e6aa0a5031903788ee01de1e0db6fd6312c4a6744777ea8cb4e24ff7d96646cc3e23b3bd10157c9e8de13
SSDEEP 6:7+/l92XZ4Pg9bNFlqhKtT/kPlOERX4PBX4ogLugMBX4suuKm5/oj:7+t8XWqLmNRmBEyPbXh+
MD5 SHA1 SHA512 SSDEEP

Submit Download

mobclick_agent_sealed_com.ywqc.vygeytbijujh

Path /data/user/0/com.ywqc.vygeytbijujh/files/mobclick_agent_sealed_com.ywqc.vygeytbijujh
Size 527B
SHA256 33ffcd39917cf93a0a13dfef598064a6aba3a963b6693e1c6ac138188e0d1312
MD5 d2a7a6eda957f4d844ab2b544b805b4c
SHA1 09b3989b3d66d15c36644e3b1fd6eab106eb4aa7
SHA512 3f18446c2c84d6502287cfc5638983c108fb5948655a02bcb5cd0ee46a58d04b88a1b0fa7d1dfcc62161570b87f2de84e3c756b804f649ac53da91140b7ce6c5
MD5 SHA1 SHA512

Submit Download

APK_RUNNER_DB

Path /data/user/0/com.ywqc.vygeytbijujh/files/snail_data/GS17B0Iaw5miZ3PIUouskQ==/APK_RUNNER_DB
Size 20KB
SHA256 ef9b8ab1c91f76fda1c2d3d63bd5c2d315a6fa9fd2b258d7bbd1ba7880cb9c0c
MD5 4a09798399823cd18290df168292817d
SHA1 64ccdc3788cf6b199f481ed19c281ad167faf107
SHA512 4dd7eadeae7b3ee2edd6a0d758b3d7f3968638da9efe6512209f9ae2b4511ccf3122ed43ed50c648bf1468f8381f7187b8caf543ccc3e75dadbb1e8aa43f88bc
SSDEEP 12:TLmaUDayNTSFbynUM9SyRmBEyPbAVOwG:TLXaN6GSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

APK_RUNNER_DB-journal

Path /data/user/0/com.ywqc.vygeytbijujh/files/snail_data/GS17B0Iaw5miZ3PIUouskQ==/APK_RUNNER_DB-journal
Size 512B
SHA256 9501a9a8c0defff244beec42929af3c9846cbdde2ebf1016d6d048885781c53f
MD5 55fe635b99184bb4c6f95902a4d5434d
SHA1 84bc75ed69dea50a9b4b3a88974db03b9beb2b1f
SHA512 b96c85a42e20a49a94677822000c03d9a1882ba9dce696af58688b5dd4a01c09ce79b6aade7fcdb1e26025cd98ee4c51246e5b26da794ab1dbb67935d784151b
MD5 SHA1 SHA512

Submit Download

APK_RUNNER_DB-journal

Path /data/user/0/com.ywqc.vygeytbijujh/files/snail_data/GS17B0Iaw5miZ3PIUouskQ==/APK_RUNNER_DB-journal
Size 8KB
SHA256 82fc4869a681dae6909ff6b3f443842bd97422f6e2793022318bca989d92ea04
MD5 28860badbdb5d7a43097bc4ed9c5f9a0
SHA1 2f1d68276ebb4f7d04010fb5b30f5675e8d686ad
SHA512 99248df6ef44a61493bdfccf5cd452d90b19a515a0d415f2aba19828ec1e65792d264d5f54f4098fbf4119c8f46385274bf8663146ca628ccc501486d960f02b
SSDEEP 6:7+/l9uGGn1xpg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKw:7+tQ3pqLiuWdYRmBEyPbL
MD5 SHA1 SHA512 SSDEEP

Submit Download

APK_RUNNER_DB-journal

Path /data/user/0/com.ywqc.vygeytbijujh/files/snail_data/GS17B0Iaw5miZ3PIUouskQ==/APK_RUNNER_DB-journal
Size 8KB
SHA256 cee0d6d4d985df5cf696f64e7fbfd0e9c820e6cda7322d6514e1b9a60ec8e8e8
MD5 b9798b5b18546219cafc040b9f204b28
SHA1 b6c34755ee8ff3b9fd23224ed9a38f3ef1fa77a3
SHA512 e216376e6c8d01bb6bbd692882b05bf1d7d699d953796709eb2697ce53af601a10a44d8836688e29ad044866e7eb55d15e01dadf95bc4a8996f6f2fb65a7cbff
SSDEEP 6:7+/l9G+FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKuSkt/u5:7+tZBqLJdeWRmBEyPbfFu5
MD5 SHA1 SHA512 SSDEEP

Submit Download

c1.r0

Path /data/user/0/com.ywqc.vygeytbijujh/files/snail_data/KEfZCdOKUz82ENpr/c1.r0
Size 311KB
SHA256 c3790b4404007b9aa9ff4d444f8a6dd06bdb87d0abd577526d53f61c48ec2aa1
MD5 2105b6912a973581d03e2d90037242a2
SHA1 28413eee553aebb3074c0d3cd00c1daeaeac6e8d
SHA512 3e356da40853bd761d3c1c91a8fb46e520263daade23e889d7c432d6326dfbbfb60f890a6ef389c593cb59edd2803d758a3953a96bc34df1dcdf66c513f29292
SSDEEP 6144:r/NaQmzmpxvWytr8+I9hc0K0jo/GD/KL3nV5sbH//dFbyc:1SmpxWytPh0HA8E5oXb
MD5 SHA1 SHA512 SSDEEP

Submit Download

cAxY5kEtnA9aAxkcPKKnGJ7S1uc=

Path /data/user/0/com.ywqc.vygeytbijujh/files/snail_data/ar-IWnNfy6ETh_pY/cAxY5kEtnA9aAxkcPKKnGJ7S1uc=
Size 48B
SHA256 f56298ab868b8ba4b91bb2f07e0f05640e86be3bc268bff1fd1e34502793c36b
MD5 50deb36d523b31a123a40fa993a9f004
SHA1 6e93d9bd31aaf15306e173837a0fcca9dd13f697
SHA512 a0b97bd652017a9b35e9a5613ade71f48299d68b692e8e25c0bf29807a13398e1d710969c03e28d63d8514e80acf6c000cc6145ff7073e618228ed2a299f8b57
MD5 SHA1 SHA512

Submit Download

tYDDNm8S8PJmBHVCxbe9QVp4nLOjmMYU

Path /data/user/0/com.ywqc.vygeytbijujh/files/snail_data/ar-IWnNfy6ETh_pY/tYDDNm8S8PJmBHVCxbe9QVp4nLOjmMYU
Size 41B
SHA256 5ca4f83b9859edbc6823457b6538274f6836c154cd2969230384d64edf0c812e
MD5 f507d0e4536f72196b34549248580288
SHA1 49b3ff96ca05e1e9c0d9f45100c6ac7e3121d141
SHA512 4df0015a132cf3d83b22a7772448b874c509f5ccd6f4771dc2027c3a215fa8b73cf3c84e69b6e7ffa8863fa7389ae47fac2b9928cfad60049ee21ecfe8bc5652
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.ywqc.vygeytbijujh/files/umeng_it.cache
Size 148B
SHA256 26a8555f6a670ef4c5921aa52792e2607498d12c9349a1a51c3b042af8f35acc
MD5 ea0d40d6c97657e99ed1cb95e5180b0c
SHA1 a0301d611d166062254f060fc4f604444c413746
SHA512 49af060d76ec7075fd7f6e85a55e1872829b3680e7d1ec7c5809ea90d9f564df3b8e927b0dd05fa5c6746ea951fffc02d185fb1b24396c6077302ad20bad9df2
MD5 SHA1 SHA512

Submit Download

.DianJinStatisticsTid

Path /storage/emulated/0/.DianJinStatisticsTid
Size 32B
SHA256 a04aa028f3da98f41f1e96057a47be788a64f7b5ecbfca5b7e86c89835dec275
MD5 b8cad150b3512529d2e892e579bfa024
SHA1 ec0159cbeb0da1fc9a106ca503389edf06b0aa27
SHA512 f880b03a9814466e8b7fe05c7a0d59f3a712d44fd326130d25b61c591e791bcec8a5c23437eeca887bbb70425f5dfd9579d30ddcb85498c3de737bd661a85282
MD5 SHA1 SHA512

Submit Download

b8e5a81af619976819edcd6494d63d9.properties

Path /storage/emulated/0/.dianjin/com.ywqc.vygeytbijujh/properties/b8e5a81af619976819edcd6494d63d9.properties
Size 81B
SHA256 85da9d42dbc89883df2549a5c653deb8341a0376893c562807e9eb253d7b84c5
MD5 4159a91debd3d4e095e822b95d7fecdd
SHA1 11b0da56406aca0868d5dd5434e4e63e86972754
SHA512 51fb5c125c241d1a392a7774403840ca1b7ae7db8505534123ab5c21077b086da5eadba3d13114a980c0d6d9919faee4841bf7d8f6d6c964a19c0d5c6d7bca6b
MD5 SHA1 SHA512

Submit Download

history

Path /storage/emulated/0/.dianjin/com.ywqc.vygeytbijujh/properties/history
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads