Analysis
-
max time kernel
179s -
max time network
178s -
platform
android_x64 -
resource
android-x64-arm64-20240603-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system -
submitted
06-06-2024 01:33
Static task
static1
Behavioral task
behavioral1
Sample
99b7db88471aaf69942819f40f9a4f38_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
99b7db88471aaf69942819f40f9a4f38_JaffaCakes118.apk
Resource
android-x64-20240603-en
General
-
Target
99b7db88471aaf69942819f40f9a4f38_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
99b7db88471aaf69942819f40f9a4f38
-
SHA1
6dd2ade3896b0ce715efcb0348de03398a0a3b81
-
SHA256
a65ce10c3d8db06c2e451c837766ed2c8e517e4b953e940aca5c2e6d1d3faf88
-
SHA512
b84304a072ac842c32064277c63a2dee8250ac0340fd50f0d0860e36e6ebe01242f67aec21cb54dfd0413c838191677a09abe7458ca71b073c10885879f90cee
-
SSDEEP
24576:oncEoL0otaYtXMfSprkM4FqD5Bl0ZHqU+IjXo+B4jtgnq/13tdHbZKm51Ob838:jQ7YthrkruBl0ZHtjrCjtgnq/1XHNKmU
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.dwob.qwlv.wigmcom.dwob.qwlv.wigm:daemonioc pid process /data/user/0/com.dwob.qwlv.wigm/app_mjf/dz.jar 4545 com.dwob.qwlv.wigm /data/user/0/com.dwob.qwlv.wigm/app_mjf/dz.jar 4612 com.dwob.qwlv.wigm:daemon -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
com.dwob.qwlv.wigmdescription ioc process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.dwob.qwlv.wigm -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.dwob.qwlv.wigmdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.dwob.qwlv.wigm -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
Processes:
flow ioc 44 alog.umeng.com 59 alog.umeng.com -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.dwob.qwlv.wigmdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dwob.qwlv.wigm -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.dwob.qwlv.wigmdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dwob.qwlv.wigm -
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
com.dwob.qwlv.wigm1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
-
com.dwob.qwlv.wigm:daemon1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.dwob.qwlv.wigm/app_mjf/ddz.jarFilesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
/data/user/0/com.dwob.qwlv.wigm/app_mjf/dz.jarFilesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
-
/data/user/0/com.dwob.qwlv.wigm/app_mjf/tdz.jarFilesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
/data/user/0/com.dwob.qwlv.wigm/databases/lezzdFilesize
28KB
MD5fdb8a92e5060ce104e8f0faca55a47ce
SHA1270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA256194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
SHA512ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122
-
/data/user/0/com.dwob.qwlv.wigm/databases/lezzd-journalFilesize
8KB
MD5cb29985f92b2d07a00a4f1e68d0c2646
SHA1f1dac09919ff9583e3fe52770e45938be4e32eb9
SHA256770f86b66e4fe241a0099e4ce75bf754009462c3cf6e928a29f5f4db4872b10c
SHA51233dde85b56b1d23379b024cbf61b84a71f860d2a3819895a9bd1dc0d2dff101eaa15d24f131e37c1421127a49a7a68a8fb6b279abacbb5416ab382e839a4067a
-
/data/user/0/com.dwob.qwlv.wigm/databases/lezzd-journalFilesize
512B
MD58d7e871511ac64bf2f34938191a35186
SHA1c42637512340df4ed4d494e5878c592fe07ef79b
SHA2561915edb656cd2dcfeb549e307dea113d55e1139abaf04cdfdb4f60453307d24e
SHA512eab6b38fd879a2f499fdb9620a738ff60508f7cc97201eb9f460573bd69f2d2e115760fcd0ed864a24eb6cd5abc8dcb4ce731e0875d5b09c4f63513ef8db41ef
-
/data/user/0/com.dwob.qwlv.wigm/databases/lezzd-journalFilesize
8KB
MD5c8b2700ba9f221e56a86d63e1fb95119
SHA19ce93e69a2561ebb0608751c881458752187387e
SHA25670ef990a21e2354f6cdb6bfd65c9a74b1a3a5a80d2f57d2a3edcdf1334d889fb
SHA512a0c396998cf28936bd639a5a18039a7dfca2a2d1ac38a216045d394421a1aae13490a4a903db8d3ca473babacca9f6868506a2bdc8df2095b1651c5c8bb764b0
-
/data/user/0/com.dwob.qwlv.wigm/databases/lezzd-journalFilesize
4KB
MD517af5eeb34665972ba9fc0484c34f955
SHA182a308bb83896dc5afda9b4062fe9d284e85c78b
SHA256a11a88969407218334bcb35fed14c01630306fce4b769148ea830ea15d385247
SHA512ab24c4d5e88e0824a19d652bb4096e64069214abf56a2ff08a1ac9aac377ac493352240cb384a796e276712aab9baf5e9112caad682e1ac3fc3a173d0b1fb600
-
/data/user/0/com.dwob.qwlv.wigm/databases/lezzd-journalFilesize
8KB
MD5fb6b8f97501d0744e9a235c1da23a7be
SHA1cd50cbac5f87017586906300b794430c6726b467
SHA256b90de535fdde371bc04cd590d60606634c82b3a1da543e77b3020c0406aee626
SHA512808c439afacc75abdb50ff8ff2e8796c54309e1e30b4c626d90c6556f0366b8017a079e0c24001769e00c591adb40a35760e19e06bc41ba4b4d5f3ebd50f7631
-
/data/user/0/com.dwob.qwlv.wigm/databases/lezzd-journalFilesize
8KB
MD50f0200c3befc9553b12b6658c639a0a5
SHA145742ea58fa7db07c255c09a6457b29102c06973
SHA256af95f90ec8797b94cde2e89d564dcc0e0f7f9d36444308a39e88bd285e86127b
SHA5123688cbb82ec90a72da7185069007796c4d798e2851cd8fd58331b11648fc2815faa4faa03e01f06cd7fc3e25d6491f2fbc5cb094e47273d2460d8d1af7e728dd
-
/data/user/0/com.dwob.qwlv.wigm/files/.um/um_cache_1717637707663.envFilesize
654B
MD5d6b083c09dc7000e0886fceae2f039f7
SHA1e4797e55cc97a7fec65c85820c1e52ef470fb8a3
SHA256e45e03f9edabb0f70e86ca38db68ae6f999b4b929c459f9372e4c8ebc41b3c17
SHA51222de24df43f0ad23d151d1769f7b18426ef282459e362f42a727f58e8718ebafd5aec8d1e96e3d5d1ac7aa19c2486666940593aedc64b7326ee53798c5569ab2
-
/data/user/0/com.dwob.qwlv.wigm/files/.umeng/exchangeIdentity.jsonFilesize
162B
MD539715274a7d9b85d534a96c2a36a013e
SHA1399a9169d2f56af0e1b765a926ab099acae08ef3
SHA2562b559cf03335d57077f0d35cc7861ae134d2c4fe7ad09f53bc4d1159f67b6af8
SHA512819b800955e0c40246d2021bbfd596c6fecae6625a51da33b0bded686c90b5aee797366808f383d01ee6692d87378a4dd77a989b1c8d8f57dd2393f84761dddd
-
/data/user/0/com.dwob.qwlv.wigm/files/mobclick_agent_cached_com.dwob.qwlv.wigm1Filesize
794B
MD5bfabf1a2c6c624cabe477279bb7e773b
SHA1378c6c65c3cafb001a8bf3d66d2ce0363cecdf86
SHA256ddf08026e31e87caf3504305319f97baf9f6d952bf4a54d5cdf1f3b061d68eee
SHA5129fb921b83e8360cd77c523801088257d5c8fbea6776df7d07a3969e755163246ea17d80834ed5e1c501bc50f3c9c93a35d4b9e1abf36047f3fe0d5a652eee24d
-
/data/user/0/com.dwob.qwlv.wigm/files/umeng_it.cacheFilesize
350B
MD525c29748f0af3045874df095f0b42c99
SHA1d3797ec307f60c25a3666ef7b077136173dd6e70
SHA2566548d09be9221f72a700dd3bcc6999ab136e32554c5864d5061e0be1c4b069aa
SHA512b59a67eda54b3c4485cab3f2d4ca2e6c8057f48c4aac48cbb05881b46436a786a033b08470393e09c35c441621c7ee10834fff25b51e8eebf94551c79341c4e3