Analysis
-
max time kernel
178s -
max time network
178s -
platform
android_x64 -
resource
android-x64-20240603-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system -
submitted
05-06-2024 12:26
Static task
static1
Behavioral task
behavioral1
Sample
9827db94c1e7747f2d8d5f1d6879be56_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
9827db94c1e7747f2d8d5f1d6879be56_JaffaCakes118.apk
Resource
android-x64-20240603-en
General
-
Target
9827db94c1e7747f2d8d5f1d6879be56_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
9827db94c1e7747f2d8d5f1d6879be56
-
SHA1
ab5effdfa86895231b4db85feb241dae771e8942
-
SHA256
43c99b2c2cf886d561635ebe6e87b8fb7d166bdce2e569a42405b329af04a5ca
-
SHA512
5e9f0b0db7f91a357d29a3671955dcf95ff721ed081e3c36b0940641eaa6d254083f972efe33db46e5c8e891fdfdc609d8e4faa60190f36bf45c27e61ed11704
-
SSDEEP
24576:eoL0otaYtXMLeJ2sepAvb6vsm0ZGpUvbYjzo+U4jsXYq/13tdHbZKm51Ob83N:tQ7YtBFeGv0sKUvbYjfBjsXYq/1XHNKI
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.afjc.onen.jfjxcom.afjc.onen.jfjx:daemonioc pid process /data/user/0/com.afjc.onen.jfjx/app_mjf/dz.jar 5203 com.afjc.onen.jfjx /data/user/0/com.afjc.onen.jfjx/app_mjf/dz.jar 5287 com.afjc.onen.jfjx:daemon -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
com.afjc.onen.jfjxdescription ioc process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.afjc.onen.jfjx -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.afjc.onen.jfjxdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.afjc.onen.jfjx -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
Processes:
flow ioc 36 alog.umeng.com -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.afjc.onen.jfjxdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.afjc.onen.jfjx -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.afjc.onen.jfjxdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.afjc.onen.jfjx -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.afjc.onen.jfjxdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.afjc.onen.jfjx -
Checks CPU information 2 TTPs 1 IoCs
Processes
-
com.afjc.onen.jfjx1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
-
com.afjc.onen.jfjx:daemon1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.afjc.onen.jfjx/app_mjf/ddz.jarFilesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
/data/data/com.afjc.onen.jfjx/app_mjf/tdz.jarFilesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
/data/data/com.afjc.onen.jfjx/databases/lezzdFilesize
28KB
MD5dae68dcffc3d522a79f98ebbc3b6d457
SHA16df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA25656cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA51223b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
-
/data/data/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
8KB
MD50a743aec13052aa1e061a3f695cdbcb5
SHA107cb83ebaa7a53bf687427ba1bedc594491b5150
SHA256e5854662c45b738d4a51bb6aa2b52da9618fa7526d8e951c732aefd45baaf2ed
SHA512a5790c6b31bf18480c3b4dceaa1c32d1a432a7bbe01f3f50e21ccd86c5ec333193f8bbe8bf66a6244031bd14212e37cfbf457f2e0c1ede701454aa5d3a0df82a
-
/data/data/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
512B
MD56f216d23773b47c5db495fcd4e413551
SHA12c8fc6b680cce8f8a3c30c2667549e2551109ec4
SHA256481382e4c83c375735a48346ab263bdd6f8d63bb4ec281dcd58be649708422ee
SHA512202c183b13db7dc9de5160f60dcdd30735f9e7a440de9d28505e060bd88abfc9175454b98f6fcef791515c83ceec685c40a0fe3900ca7fcf3f0758ade504d612
-
/data/data/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
8KB
MD5c1e2217eec6c5bdf03479e6bc817f9b5
SHA1fe3ee0f0898d7238cb75821721661b374cb2dbd0
SHA25604e62b9f92be79fed5de7113ecf796eb3fa4f5a5e24dd1286b11544db184bf4d
SHA512333c1709e7f1f7314b9ba00663f3e5afad061e63f2b6eab82d61beaec301f41e0f10dd8e528efa3df89b293f6e606205f14269a89f64db1d26d1bff631e332ba
-
/data/data/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
4KB
MD5b53de3a54a790c8dc29e45d0276bc070
SHA129e26d08c18dbb1a26d71cc8d26099d14f6e9188
SHA2564204d64a33460e991fa545226765fb89ea380035df6c0f88baa6571ac1b6e72c
SHA51218144708901ed04b9384eaef9002abcd03bb95161e0f29785232474dd0d2e9c9a226fcb2159341ba24e14ee2d5230636f40367121838445e00d67a839276354c
-
/data/data/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
8KB
MD5918013f93cb0265be4ed1fa660786fbc
SHA152bf450589fb883ca27d373a75f68d1bb1e5f878
SHA256177305880e229ecde15f50a8d7263dab7bf76af181aa70830391de561fd1e16f
SHA5120b65934d355a4dc970bbeb58bdea8e14c1f08659bca5af717e9cb73298b437009e13a49580eb04a066c76658ee4646dfb1a4f3e136d774af434b1b20d061cac4
-
/data/data/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
8KB
MD5e37b1993294890eec7df040a6bfcbdc3
SHA1bedb091a9571e4b0db3235a793eabd599e6a2743
SHA2562cccb091dba423c3b4df3bd0ba783d3db913bff343da7af893e2c70f5605405d
SHA512b77b41ebb03b2c2bfd7cbd567159df93fec63785fd02c769f924855bb036373f4ff4c41e898088766f25ae936694fd4f9c90726b3ec3748cb67daaa75b84be7b
-
/data/data/com.afjc.onen.jfjx/files/.um/um_cache_1717590510460.envFilesize
650B
MD5ddc27b0305ad97c31cce59665d33caa6
SHA18cce3feffd8ce8b30458056d0337ef6df7ed92a1
SHA256eb26ce56821f69a4ddeec757246ffbeaa12ae30a0ecd3c59c598fbb657bc1526
SHA5128b1edaf9ed8d444f6902c0cb0e7e11b352db54899807b5b6dd9001d20ed79c6af02cc1e2b5c14ba63d98dff064a8a43182f7886241fc7eef85eb17c822ea71fb
-
/data/data/com.afjc.onen.jfjx/files/.umeng/exchangeIdentity.jsonFilesize
162B
MD549a245437ec7eb57e3a72078c565d8aa
SHA1141323abb594d440199f43a52208ea41d20ba147
SHA25655cb1239ea259e9f28f5774e46ade0d45eef28777104c32f5295bf6600bed4dc
SHA5121d8c881cfd377373f24e9e2b70f6116fd0b580fc35f3c7a77e1d59574b5bcc0c2d92d5a48b9ca0d889a68db75fa9a691c2098e133edad10273a8ad4505c1bd31
-
/data/data/com.afjc.onen.jfjx/files/mobclick_agent_cached_com.afjc.onen.jfjx1Filesize
794B
MD5f689c43a7a963de5203e977f2f5e631c
SHA1edb253a45f18c3a541b1abd8f8770ca8b2c1ea1d
SHA256acb68e02f2bf7e5578867fd11e882efc2738e01b8d48a4e14b48cbbce671ffd0
SHA5127555f3d0de787bb8b2cab27639351126daaa197cb1c224223dd4e3f9d452795d8fe7c3b5a690fc8c102733f7c4cad2eda117b24db78297b8ec638fbd26d95d13
-
/data/data/com.afjc.onen.jfjx/files/umeng_it.cacheFilesize
350B
MD5265693e0c96fb53c200c205948eb923f
SHA131a65d5548ef24fe12fc3d1ad677913491381309
SHA256dea8b5cd9bb23ab9995e890cdeefbe2275bd75ad274f4725cf9f970f54171032
SHA512fee5cf952eb63111cbf6bdc448041cb77acceaeef8de7afdb8cf2848cd33708db233039949550841ca2b6005842d28ab0482aaa8e0f7a130385dcf9ee0d907f0
-
/data/user/0/com.afjc.onen.jfjx/app_mjf/dz.jarFilesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc