Analysis

  • max time kernel
    178s
  • max time network
    180s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240603-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
  • submitted
    05-06-2024 12:26

General

  • Target

    9827db94c1e7747f2d8d5f1d6879be56_JaffaCakes118.apk

  • Size

    1.3MB

  • MD5

    9827db94c1e7747f2d8d5f1d6879be56

  • SHA1

    ab5effdfa86895231b4db85feb241dae771e8942

  • SHA256

    43c99b2c2cf886d561635ebe6e87b8fb7d166bdce2e569a42405b329af04a5ca

  • SHA512

    5e9f0b0db7f91a357d29a3671955dcf95ff721ed081e3c36b0940641eaa6d254083f972efe33db46e5c8e891fdfdc609d8e4faa60190f36bf45c27e61ed11704

  • SSDEEP

    24576:eoL0otaYtXMLeJ2sepAvb6vsm0ZGpUvbYjzo+U4jsXYq/13tdHbZKm51Ob83N:tQ7YtBFeGv0sKUvbYjfBjsXYq/1XHNKI

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.afjc.onen.jfjx
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Checks CPU information
    PID:4559
  • com.afjc.onen.jfjx:daemon
    1⤵
    • Loads dropped Dex/Jar
    PID:4619

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.afjc.onen.jfjx/app_mjf/ddz.jar
    Filesize

    105KB

    MD5

    23ba0b249042b7ba33e92c0199b0ea4a

    SHA1

    99b13ee9f7307316c2337953fceed87e9942b794

    SHA256

    1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

    SHA512

    0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

  • /data/user/0/com.afjc.onen.jfjx/app_mjf/dz.jar
    Filesize

    248KB

    MD5

    a54a18b58c6720991c021f433dfb2a46

    SHA1

    d2ffa07919f92b6e04914e39843f08fdb2a75b68

    SHA256

    3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

    SHA512

    e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

  • /data/user/0/com.afjc.onen.jfjx/app_mjf/tdz.jar
    Filesize

    105KB

    MD5

    293ea5f01e27975bed5179ba79d80eac

    SHA1

    c5b0806a537fd1cb753e11f1a9684933317716b8

    SHA256

    8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

    SHA512

    c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

  • /data/user/0/com.afjc.onen.jfjx/databases/lezzd
    Filesize

    28KB

    MD5

    fdb8a92e5060ce104e8f0faca55a47ce

    SHA1

    270d7ca30673e18cec1d2b9add71cba96dc426fe

    SHA256

    194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a

    SHA512

    ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

  • /data/user/0/com.afjc.onen.jfjx/databases/lezzd-journal
    Filesize

    8KB

    MD5

    c1451194eae8431a7bf407eb92525795

    SHA1

    ccf7ae67ec41d0ff4798e233d776de624c6520b2

    SHA256

    74e0f1f99af9fa44e7cff5b4c14cc5ccea49cd28862fb6e4510f0ee37f3fe176

    SHA512

    93c77eff520a7266eef0629d14d63cf6b45a27bde0e5926b69c343320e87005c11b962b25402e0c73b9599ccd71271c3964d4f7414499af3b7dbd35bb1ac3a20

  • /data/user/0/com.afjc.onen.jfjx/databases/lezzd-journal
    Filesize

    512B

    MD5

    aff5961e770efd36adc727d5516355f5

    SHA1

    3b13cdc22543ff8e835fafb6f8b71cf0aba0e54e

    SHA256

    9748d30b490b03b52fdb503009f95c52120a97368bb7fca3d9d7ac1daf3ff7e3

    SHA512

    24a35c71e5017b1f96f9117bf6ebdfee163cc27109113159c4d8ee9d752ef18760e8b381f88217aec973100cb7f396b71af64f8983b36c7e58ebb9e2de6a673e

  • /data/user/0/com.afjc.onen.jfjx/databases/lezzd-journal
    Filesize

    8KB

    MD5

    dcf8be1ae1670d14649982a6cfcd6f52

    SHA1

    3600c015ac03828117b1657f04c23ed9dd11c382

    SHA256

    37451b21652f6a181b6096c7b5fd7fe8ce271ddfa611f1a56ec422e91b2fe4f6

    SHA512

    17b2e34919ba21d093f01b94dbb349259bf6842adef984ee0f3aab8ca124097926841d34e73b1fe0adf11184d34ddc683bc37c5c3ef9804c52740be3ded93068

  • /data/user/0/com.afjc.onen.jfjx/databases/lezzd-journal
    Filesize

    4KB

    MD5

    1384c12e8e4c413c89777d811a7a7259

    SHA1

    0eb9d54ac71dc10a62efaa974bdcfe4644e3821e

    SHA256

    10d26cf123313be36e5417c6b405761608266fad28c3602e51c738b00c893a49

    SHA512

    b59c46d70112d514cddcbfd96ac90c58af832138fab2f157d6c9f108d21f35b58cd440f7725ef685cbcad719e10b1c002f00cf376cd0f172c9cc8416a7291b16

  • /data/user/0/com.afjc.onen.jfjx/databases/lezzd-journal
    Filesize

    8KB

    MD5

    003b097e4eef9385979b680f8ede30c4

    SHA1

    8200dc7c8092d0876c92b772a0935e72eaa33b6b

    SHA256

    ffaa2093e336e107b15a8e8677842c981a64d031dc7fb15759a154f281b64773

    SHA512

    53b71b843dd64fb08bacad2a84476796134f7f3a79c490c39f25943cee7ac15866d36cd1cf2bf5c287b0f44230afb6a9e4237b1265c940c701cd82a9fc90d571

  • /data/user/0/com.afjc.onen.jfjx/databases/lezzd-journal
    Filesize

    8KB

    MD5

    c81b689460f72cc5f3d6d0a4b363dfad

    SHA1

    4b48d2999e8f0c692f9e120fd6dac7f540bf90b8

    SHA256

    e0ed2e8bd255d5334edb9dbcce5e0290bc6e304d43da1585404013c519f9b49a

    SHA512

    dd841793cfede2a7426022018034bef16e9c906efb010aeb78a8bec75efc2b6c2b2d1f4584b95031491da997a6d2f9eb804fd6bb136353dc884856277d4b2b7e

  • /data/user/0/com.afjc.onen.jfjx/files/.imprint
    Filesize

    943B

    MD5

    01583ef8294ca77c8ce72032e3273df2

    SHA1

    493646dbee5f68d51557216baa351729c8122d10

    SHA256

    b132298254fdcf41089854d224a52b64f481b06491ec9e86804073d703f3c57b

    SHA512

    74c40c84a1ad27f8a6206a14dde1f353e65534ab4839203b9cea17d0522f2220b8eee749bc6c5f858721a1a33fc0c046faee1d82d081379fd98319eb96303219

  • /data/user/0/com.afjc.onen.jfjx/files/.um/um_cache_1717590569643.env
    Filesize

    1KB

    MD5

    ff7cd7d08d2865d82abc8448ad230cb3

    SHA1

    bb670d9ec52dd5881ef03b53a7caf52674ef1f3c

    SHA256

    64c703246dbbb960cc18e599e23068d9147eb22916fc8fa118195086f33a5ac4

    SHA512

    98a719cea1a0563948fcceb987faee85465a71649f72604b4da91b8051864e1e07076460355c91e7a070071d60701ab5e6bd266da79c1ba4ba5e4c3695f17f99

  • /data/user/0/com.afjc.onen.jfjx/files/.umeng/exchangeIdentity.json
    Filesize

    162B

    MD5

    b43c5ffc90f02cb534e077bbebfe9378

    SHA1

    f3e3d65a0fcaf55d56e51a2310c0a07aa15e8e7d

    SHA256

    9747c37c5daecd8286a10da5bfd6373f5df74448a83d142e45fa2e208813cc37

    SHA512

    965f5644efbf44e0ea950bc92448be336bbc0bb3e865f9afb27d858f51232d84aa71b714ba115153b3d10185303be647eae00f32799f9421c1c0045e1ea1d3f6

  • /data/user/0/com.afjc.onen.jfjx/files/.umeng/exchangeIdentity.json
    Filesize

    203B

    MD5

    45fe42a85271947843b2b4e15cad8325

    SHA1

    1a074baf8069704655d3eed06b2a365720a8762c

    SHA256

    d57009741915d7d5cdd98bae6502c5789b09e1348b852da06b224b1417883115

    SHA512

    a87457dd14500ac48c49cca3f8f275791936b69390fafba7bdf20689661d0a68a822e2420cc889d2417d17a905a981ea5f29c858e0dfb8b710a0e5fc08af790b

  • /data/user/0/com.afjc.onen.jfjx/files/umeng_it.cache
    Filesize

    350B

    MD5

    190db91a019442515080745a87a6605a

    SHA1

    767410635d829511bcd618f0fdf4501d00041b6f

    SHA256

    b8c2334ea93d6606ef1666a5c1c9f4166f7f659bbc31cb5bb3422ad40aff2f76

    SHA512

    0727873016e3aa18f95af178b0c2f4db932c7906338267497ba4b9d8b9165efdd097f0ff091298eb396e017e2e621d80e7f15c50957be402a1f0e81d492b1472

  • /data/user/0/com.afjc.onen.jfjx/files/umeng_it.cache
    Filesize

    178B

    MD5

    eded87424ed5b3a76cd405bc9b20124f

    SHA1

    3038c475eac4b498e64be04c5c23bfbfc216ea89

    SHA256

    206a3e5f7f53afd45cf311638acb134e601289ba0f847a9e64bfe1a97caa93e1

    SHA512

    871fb6b08dd0195837b79d2fa564731ba71d0a85db0ff97e6061f2bdfaceda1718d65c08828cb5e870bfc9bc4cf0d0028d3a4e8fb9fbaa3950c6b139a4fd2f0a