Analysis
-
max time kernel
178s -
max time network
180s -
platform
android_x64 -
resource
android-x64-arm64-20240603-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system -
submitted
05-06-2024 12:26
Static task
static1
Behavioral task
behavioral1
Sample
9827db94c1e7747f2d8d5f1d6879be56_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
9827db94c1e7747f2d8d5f1d6879be56_JaffaCakes118.apk
Resource
android-x64-20240603-en
General
-
Target
9827db94c1e7747f2d8d5f1d6879be56_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
9827db94c1e7747f2d8d5f1d6879be56
-
SHA1
ab5effdfa86895231b4db85feb241dae771e8942
-
SHA256
43c99b2c2cf886d561635ebe6e87b8fb7d166bdce2e569a42405b329af04a5ca
-
SHA512
5e9f0b0db7f91a357d29a3671955dcf95ff721ed081e3c36b0940641eaa6d254083f972efe33db46e5c8e891fdfdc609d8e4faa60190f36bf45c27e61ed11704
-
SSDEEP
24576:eoL0otaYtXMLeJ2sepAvb6vsm0ZGpUvbYjzo+U4jsXYq/13tdHbZKm51Ob83N:tQ7YtBFeGv0sKUvbYjfBjsXYq/1XHNKI
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.afjc.onen.jfjxcom.afjc.onen.jfjx:daemonioc pid process /data/user/0/com.afjc.onen.jfjx/app_mjf/dz.jar 4559 com.afjc.onen.jfjx /data/user/0/com.afjc.onen.jfjx/app_mjf/dz.jar 4619 com.afjc.onen.jfjx:daemon -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
com.afjc.onen.jfjxdescription ioc process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.afjc.onen.jfjx -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.afjc.onen.jfjxdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.afjc.onen.jfjx -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
Processes:
flow ioc 39 alog.umeng.com 44 alog.umeng.com -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.afjc.onen.jfjxdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.afjc.onen.jfjx -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.afjc.onen.jfjxdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.afjc.onen.jfjx -
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
com.afjc.onen.jfjx1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
-
com.afjc.onen.jfjx:daemon1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.afjc.onen.jfjx/app_mjf/ddz.jarFilesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
/data/user/0/com.afjc.onen.jfjx/app_mjf/dz.jarFilesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
-
/data/user/0/com.afjc.onen.jfjx/app_mjf/tdz.jarFilesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
/data/user/0/com.afjc.onen.jfjx/databases/lezzdFilesize
28KB
MD5fdb8a92e5060ce104e8f0faca55a47ce
SHA1270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA256194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
SHA512ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122
-
/data/user/0/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
8KB
MD5c1451194eae8431a7bf407eb92525795
SHA1ccf7ae67ec41d0ff4798e233d776de624c6520b2
SHA25674e0f1f99af9fa44e7cff5b4c14cc5ccea49cd28862fb6e4510f0ee37f3fe176
SHA51293c77eff520a7266eef0629d14d63cf6b45a27bde0e5926b69c343320e87005c11b962b25402e0c73b9599ccd71271c3964d4f7414499af3b7dbd35bb1ac3a20
-
/data/user/0/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
512B
MD5aff5961e770efd36adc727d5516355f5
SHA13b13cdc22543ff8e835fafb6f8b71cf0aba0e54e
SHA2569748d30b490b03b52fdb503009f95c52120a97368bb7fca3d9d7ac1daf3ff7e3
SHA51224a35c71e5017b1f96f9117bf6ebdfee163cc27109113159c4d8ee9d752ef18760e8b381f88217aec973100cb7f396b71af64f8983b36c7e58ebb9e2de6a673e
-
/data/user/0/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
8KB
MD5dcf8be1ae1670d14649982a6cfcd6f52
SHA13600c015ac03828117b1657f04c23ed9dd11c382
SHA25637451b21652f6a181b6096c7b5fd7fe8ce271ddfa611f1a56ec422e91b2fe4f6
SHA51217b2e34919ba21d093f01b94dbb349259bf6842adef984ee0f3aab8ca124097926841d34e73b1fe0adf11184d34ddc683bc37c5c3ef9804c52740be3ded93068
-
/data/user/0/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
4KB
MD51384c12e8e4c413c89777d811a7a7259
SHA10eb9d54ac71dc10a62efaa974bdcfe4644e3821e
SHA25610d26cf123313be36e5417c6b405761608266fad28c3602e51c738b00c893a49
SHA512b59c46d70112d514cddcbfd96ac90c58af832138fab2f157d6c9f108d21f35b58cd440f7725ef685cbcad719e10b1c002f00cf376cd0f172c9cc8416a7291b16
-
/data/user/0/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
8KB
MD5003b097e4eef9385979b680f8ede30c4
SHA18200dc7c8092d0876c92b772a0935e72eaa33b6b
SHA256ffaa2093e336e107b15a8e8677842c981a64d031dc7fb15759a154f281b64773
SHA51253b71b843dd64fb08bacad2a84476796134f7f3a79c490c39f25943cee7ac15866d36cd1cf2bf5c287b0f44230afb6a9e4237b1265c940c701cd82a9fc90d571
-
/data/user/0/com.afjc.onen.jfjx/databases/lezzd-journalFilesize
8KB
MD5c81b689460f72cc5f3d6d0a4b363dfad
SHA14b48d2999e8f0c692f9e120fd6dac7f540bf90b8
SHA256e0ed2e8bd255d5334edb9dbcce5e0290bc6e304d43da1585404013c519f9b49a
SHA512dd841793cfede2a7426022018034bef16e9c906efb010aeb78a8bec75efc2b6c2b2d1f4584b95031491da997a6d2f9eb804fd6bb136353dc884856277d4b2b7e
-
/data/user/0/com.afjc.onen.jfjx/files/.imprintFilesize
943B
MD501583ef8294ca77c8ce72032e3273df2
SHA1493646dbee5f68d51557216baa351729c8122d10
SHA256b132298254fdcf41089854d224a52b64f481b06491ec9e86804073d703f3c57b
SHA51274c40c84a1ad27f8a6206a14dde1f353e65534ab4839203b9cea17d0522f2220b8eee749bc6c5f858721a1a33fc0c046faee1d82d081379fd98319eb96303219
-
/data/user/0/com.afjc.onen.jfjx/files/.um/um_cache_1717590569643.envFilesize
1KB
MD5ff7cd7d08d2865d82abc8448ad230cb3
SHA1bb670d9ec52dd5881ef03b53a7caf52674ef1f3c
SHA25664c703246dbbb960cc18e599e23068d9147eb22916fc8fa118195086f33a5ac4
SHA51298a719cea1a0563948fcceb987faee85465a71649f72604b4da91b8051864e1e07076460355c91e7a070071d60701ab5e6bd266da79c1ba4ba5e4c3695f17f99
-
/data/user/0/com.afjc.onen.jfjx/files/.umeng/exchangeIdentity.jsonFilesize
162B
MD5b43c5ffc90f02cb534e077bbebfe9378
SHA1f3e3d65a0fcaf55d56e51a2310c0a07aa15e8e7d
SHA2569747c37c5daecd8286a10da5bfd6373f5df74448a83d142e45fa2e208813cc37
SHA512965f5644efbf44e0ea950bc92448be336bbc0bb3e865f9afb27d858f51232d84aa71b714ba115153b3d10185303be647eae00f32799f9421c1c0045e1ea1d3f6
-
/data/user/0/com.afjc.onen.jfjx/files/.umeng/exchangeIdentity.jsonFilesize
203B
MD545fe42a85271947843b2b4e15cad8325
SHA11a074baf8069704655d3eed06b2a365720a8762c
SHA256d57009741915d7d5cdd98bae6502c5789b09e1348b852da06b224b1417883115
SHA512a87457dd14500ac48c49cca3f8f275791936b69390fafba7bdf20689661d0a68a822e2420cc889d2417d17a905a981ea5f29c858e0dfb8b710a0e5fc08af790b
-
/data/user/0/com.afjc.onen.jfjx/files/umeng_it.cacheFilesize
350B
MD5190db91a019442515080745a87a6605a
SHA1767410635d829511bcd618f0fdf4501d00041b6f
SHA256b8c2334ea93d6606ef1666a5c1c9f4166f7f659bbc31cb5bb3422ad40aff2f76
SHA5120727873016e3aa18f95af178b0c2f4db932c7906338267497ba4b9d8b9165efdd097f0ff091298eb396e017e2e621d80e7f15c50957be402a1f0e81d492b1472
-
/data/user/0/com.afjc.onen.jfjx/files/umeng_it.cacheFilesize
178B
MD5eded87424ed5b3a76cd405bc9b20124f
SHA13038c475eac4b498e64be04c5c23bfbfc216ea89
SHA256206a3e5f7f53afd45cf311638acb134e601289ba0f847a9e64bfe1a97caa93e1
SHA512871fb6b08dd0195837b79d2fa564731ba71d0a85db0ff97e6061f2bdfaceda1718d65c08828cb5e870bfc9bc4cf0d0028d3a4e8fb9fbaa3950c6b139a4fd2f0a