f6034e75b17cce56db6148cb478f6dd86c834fec34c4fd034c24c73074e84ec7

Analysis

max time kernel
157s
max time network
169s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
05/06/2024, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98905c07a5fd12c9fadb1d06d5f68f0d_JaffaCakes118.apk
Size 29.3MB
Sample240605-tgtr2scc34
SHA256 f6034e75b17cce56db6148cb478f6dd86c834fec34c4fd034c24c73074e84ec7
MD5 98905c07a5fd12c9fadb1d06d5f68f0d
SHA1 c72c4cb5fcae3a12c8e773f8eaeff55ee0f1937e
SHA512 5dd930ed3620e1003580cbaba815567d7bab4a4fe6675bb703392ac96bbcee6fabc61659591f7c710e9102f9a1d0d0115b97c3d42e1b7caf58cc243061f864a8
SSDEEP 786432:eyudJthlitVdKPlHmd+O1l+eXkuBQ181jvb+A9mtD:et7QV8dXe8OFvbPmtD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wandafilm.app
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wandafilm.app:pushservice

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.wandafilm.app

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.wandafilm.app

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
13	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wandafilm.app
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wandafilm.app:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wandafilm.app

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wandafilm.app
Framework service call	android.app.IActivityManager.registerReceiver	com.wandafilm.app:pushservice

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.wandafilm.app
Framework API call	javax.crypto.Cipher.doFinal	com.wandafilm.app:pushservice

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wandafilm.app

com.wandafilm.app
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4232

com.wandafilm.app:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4282

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/com.wandafilm.app/databases/cc/cc.db
Size 36KB
SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
MD5 ce6135aa1b1fe4f2c2db2a546d2a5558
SHA1 79b59582154017aadab783dc266fcb158c252940
SHA512 2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4
SSDEEP 3:o1Xll41Xll41Xllv1Xll:oQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.wandafilm.app/databases/cc/cc.db
Size 36KB
SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
MD5 5d7ea1a23af19b4340cc8d90f28297d5
SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b
SSDEEP 12:TCFP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQn:Tz7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.wandafilm.app/databases/cc/cc.db-journal
Size 512B
SHA256 72349061f332b3b2ab53fa6b4b7756e7f3b9e5a322413f2245bd3c85a7704150
MD5 ac1b607d125de783531e9df18501b2c9
SHA1 63a398b05886b1e2429eb08a952cd470d631ca8a
SHA512 93dde96b04a3c23143252bae89f12c6a8cb956b0456e7e3fcb45d3bc008484d0a255fbff2a9f5153d0f3a6e0a00a68b5668105998ca7c6060caebda578d03fd4
MD5 SHA1 SHA512

Submit Download

cc.db-wal

Path /data/data/com.wandafilm.app/databases/cc/cc.db-wal
Size 16KB
SHA256 eb5a9cd7a81e8b5ff48f5080b73dfb4301ed9ce2a6e8ed0b9e567cd608e9edf3
MD5 af61fc478b6b84869c36059ebb8a2688
SHA1 a054bae68dcd61582c67717fb47b5c991f1b3bee
SHA512 c1632a7293a6216f0fa2a48c9e12b4546c0e0760a9ab86da4912e0116c6e471dc52f15a91273f718fb8bf9370bcafa5dea96d625b9f18645c48a5800d241caf2
SSDEEP 3:OlH/lR+/17BUQlieYcWzN71ll8+cWI1Ae4llvXllnlu179o0XYZ4l1XllRjW7qt3:KipLYcwS+cdR4H4pXeo1p
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-wal

Path /data/data/com.wandafilm.app/databases/cc/cc.db-wal
Size 48KB
SHA256 434dac5766d75e95066b19364564c4783a64f8353e3e08e7f341247ef47a0321
MD5 10c0c4d4e0aa0e9367bc98163dcafd13
SHA1 9a42a84bd1429295b5e81d1f48c17f0a60d79082
SHA512 4130b7c7151a860b1c04b2a7a3be13b05c6fc10140d95998ef8b91ddc7566e40186b431a0fa49f135cfdb97c64acdc905676dc437219caad461b4a8e14402ab2
SSDEEP 24:KBR8zyGSP/cDjXlhB1z7sL7yot3BVrHotGGSP/cBF:SKzNSP/6TXshBWfSP/qF
MD5 SHA1 SHA512 SSDEEP

Submit Download

wandafilm.db

Path /data/data/com.wandafilm.app/databases/wandafilm.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

wandafilm.db-journal

Path /data/data/com.wandafilm.app/databases/wandafilm.db-journal
Size 512B
SHA256 ab381a241567737ee5fdf005b7b926b90aa98e8e7e11811b7a3ce20d80069491
MD5 18c8a14e46cdc2266c5248ba418c515d
SHA1 56ec5a7e0fec54af90f87cbfc9399bc0b5bb3bba
SHA512 e2bc83ec304b0de77dd532a18a0f9c8372349db8aa6a92ce0ba18e710f1f25190953a13b2224bdab9ffd53085752172b8997a3b0a624bd4a00d0e229b872db59
MD5 SHA1 SHA512

Submit Download

wandafilm.db-shm

Path /data/data/com.wandafilm.app/databases/wandafilm.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

wandafilm.db-wal

Path /data/data/com.wandafilm.app/databases/wandafilm.db-wal
Size 386KB
SHA256 48533770efa0363f9c52f35d715ce1715ff4d930d594017a6c272797695ac03d
MD5 52669401dfe24247aab2507c38ccfaf4
SHA1 25f15634e828c68e7cd0a122031a349336c72734
SHA512 6f13e7318d97200cbc787621cdae1a453fc1f277a10066caf3ee22baa79814263a8359f4b8d38440c642e122292584dda80103fd1c2acbfd5a62119e68f1e25e
SSDEEP 1536:kZmYtNKQroyzPWxRuhOdzcoyzPvI/SSyOdrbdVuVg/:kMdV
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1717603468852.env

Path /data/data/com.wandafilm.app/files/.um/um_cache_1717603468852.env
Size 1KB
SHA256 a0ad9308ed231c997567f4d383438fdfb69d03aace05ed6d00d47d36d60a8824
MD5 2585d7a9ca4c0097547c3497a93cb4ca
SHA1 4154fe51b989f2183d0f9a3f267db4d936b61aa2
SHA512 11b67db159e352eec16ab9532ad6f9e58f9ae066f70a51cc3a92c988c2a7c4c6e28db6d2b6bf66d64e9249eee6210f961ae2372af0cd1b1a3cc1568a87cfcf94
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.wandafilm.app/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 8592832411680d3ae1ebd80d25f7a9254406b95ea4248d8a3072c1380be6b81d
MD5 c2bc4dcd8be0c470e33954e47dd5d6c9
SHA1 32ca2d27f747ffe404c65876620c334e01e2dbd4
SHA512 098bf552f6a8f014d7cef77a3db16bee44bed0c8292669319f02a69e204f10833837a9be1495c8e249aca60cd2a441f167629e701ee0f4c0bb3a911f1ac08a89
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.wandafilm.app4610

Path /data/data/com.wandafilm.app/files/mobclick_agent_cached_com.wandafilm.app4610
Size 2KB
SHA256 d99ef8c4bd6e0996e0d938959b1d4bc9c9ccb508d0498f85b9f5616612b63ec1
MD5 a49148786168f0733e36ebd576545fb0
SHA1 bd5330c78ed1a4d0885d57b6fd9d08749dbef38c
SHA512 b162be1caad4a1174191889d8edd0922e86400a34eb1d39b91033e6b695843c46d869fa77f0d2c7b2e9a479c9a1fced44d1d4017d9d256d7e54bbb07538ee9c0
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.wandafilm.app/files/umeng_it.cache
Size 498B
SHA256 50b6e2f9008d0da8330a800c2334f60e15f7a9bd0e26450b0c89be2f01780fa7
MD5 d30390fe272837af3cf83ff270ef71d7
SHA1 bfa9751e8839b75c0e102e1fcdb2b128ae026f54
SHA512 b44b302f5e8f294fdde9a3612364a3fe8bc6fa92b068ec61d0ee3a774bd4a30e4803fb77c1b26e363a25f3435c0d1a41c15684f232911b69082917df0cbcdaa9
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 74f5123aa64670eaadc085bf5185ceee4704e5d8e0689f7427c8dce5f4b47a16
MD5 92e1c69dc41b3db5dce4b441a8050782
SHA1 ac5fc9bdb724961be080780fe48e7bf0c0234495
SHA512 e2fe25346af26359792742ba375aef1db3355eb1882f8afd8b9818144304bdab44767af67255425e5ee9f5cb23919cc889107f2d552c75966c546e61e0d801fe
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 76c172e91efdac6b16f12ab253c0a7623aff4c5e7a19fa53fd57a2e4db4c972b
MD5 43043bc5228acfe030e62f699c86adf7
SHA1 9f68ccb4c5497113437237eec08dcfdd674df372
SHA512 0d12485e31386150c513d3bb7d3d5aef9bdf2dbe21cd664a64b7af9eb5d0efabb57cb45bcb0ce2a3de47a0a136a7bec0b4ff4cb8078282b248b39782fc724355
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 167B
SHA256 2ebb50ba7e0d04f56eb7ea29c685efb6366cc537c83cfe3ba2ca7385dd776e74
MD5 fa0f1903c38b830f4334a7526f09a3c6
SHA1 d901c53bad2bc605b49c4f4b88fcb890acee770e
SHA512 671bf522046c70e9873dbc6bca690f4fe98f646843b447ebb33ae8956c118dfe5288baaa3da85ebe84232b39be0d059c6430cffab8b3e2260918bd58b7d79c75
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /storage/emulated/0/Android/data/com.wandafilm.app/cache/locationCache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.wandafilm.app/files/MiPushLog/log1.txt
Size 227B
SHA256 3783ebd00144aa5c3ca2799115966af3a6cb4b205599740885e7ba36d6838e7e
MD5 5654e12c6fa73250840e1d77edbf2a5a
SHA1 fd8df6a6085b99d45ec7e79fd4d52e66bc91098c
SHA512 28a9861ce550542ef272dcacdb1ea4f86e06c6921defbd02e300760002cf1d4b5ee45029829844af7846d2f4ef93366d7bc02a07cda0510f42c0968fb931548c
MD5 SHA1 SHA512

Submit Download

1717603551

Path /storage/emulated/0/Android/data/com.wandafilm.app/files/carrierdata/1717603551
Size 403B
SHA256 d1684e2a34a8ca7dd1c6fdf1ab1569a362df6ba617d8e90c516a7266180368e4
MD5 45daf6b688333e571e627d2ecb006bfb
SHA1 ab79b707f6d4ad6fe5879a429999862db9b002f0
SHA512 4767febc931f3817ddfaa135c874de2393cd2eb526a1d8e0002fbd248f3e0793aafa9a1e45c05c329ce3386ef69328473d55aa7cc6dbdde37c338b6c1b84c10e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads