93e4b0e295b5a395a2802e9c8126d500ecfa08a243138db79c77fa4fed5945fe

Analysis

max time kernel
125s
max time network
141s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
12/06/2024, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a02082a33a00fa5e9eb54511e24a08f6_JaffaCakes118.apk
Size 1.6MB
Sample240612-k1622sxane
SHA256 93e4b0e295b5a395a2802e9c8126d500ecfa08a243138db79c77fa4fed5945fe
MD5 a02082a33a00fa5e9eb54511e24a08f6
SHA1 4aafc0570aa311f78523632ddd31bc46c9d9ad72
SHA512 f4f7b973bd5bf2fc40dd85264efaafc3534cf4a0147582b9abf1d633f027b79ac289f776419f118d1979b0329cfb7bf5aeaa174b773d0a653d0953348005b89e
SSDEEP 24576:MMvs+UNX2AgyxOf21JsxSd0k0QlJvKUvBIeEwj1aDt4f0ekPowwQ+a:dv7UNPxxY212IdT0QlJvNCCf0ekQSR
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery impact

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
15	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.haiodheohh.jioajdoew

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.haiodheohh.jioajdoew

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.haiodheohh.jioajdoew

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.haiodheohh.jioajdoew

com.haiodheohh.jioajdoew
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4473

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/com.haiodheohh.jioajdoew/databases/cc/cc.db
Size 36KB
SHA256 c422190539b6414072fc3950da19a17985c0c4c2172740b2f74682b520af5231
MD5 4cfe777c9f6e7859f5efe2197401d8e5
SHA1 bb3774e8879ad5f6db0c37f151c3d6bc7b4b207a
SHA512 6be469864edaf8eaa110f618f8abd27962da92e20945dcd38073ade2b60b10f00552d54d5db9d9f75ca133213031030e71e2e30113ff033e5ef507a28fe0b1de
SSDEEP 12:TL/0P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQ:TLV7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.haiodheohh.jioajdoew/databases/cc/cc.db
Size 36KB
SHA256 50484dcdc6b9c2801773018386a8143a52a5153eb2eeeaf5be8bbe46a49ca90c
MD5 86752a4be6564d8370f2f0e403995003
SHA1 29f7d50675f6e59f3b808eb6dcc8619384412115
SHA512 79c9435c1e0d41a3f97784be3e5a3cd8c0bd2d32ecdf326808bacb00c76d876d0447617d6e72ef04cd4b996c92eda4eb7bb200987ae7928ce2e0e7c8e807a5ec
SSDEEP 12:TLg5P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TLF7sL7yot3BVrHotGGSP/WQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.haiodheohh.jioajdoew/databases/cc/cc.db-journal
Size 8KB
SHA256 be21c3393ca5cfcfbd087e0e5c4abe489888750d3cacfb5678ae8c7fc6ff0c42
MD5 c39904a3bdf0c6d5b69dffb1b3673d52
SHA1 62d4b306641c1bb57abe8d2f51816da14b084f99
SHA512 620a438bbd3b18dc75c19cd28878d4d793a003941bb6c0cb67efc7d44efdb436edb7c05c1508ef9f064d56cb9d542412cc6492bd38109b50d535319d45b23f18
SSDEEP 12:7+t8F6FFqL+/3P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBJ:7+t8UFFqLl7sL7yot3BVrHotGGSz
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.haiodheohh.jioajdoew/databases/cc/cc.db-journal
Size 12KB
SHA256 c90e4e1a6672d06f0195206dbc027b5e8d8cfb42bef8bd07c189a9161bac5ab9
MD5 d0fbcc74429b035a0750c561d75bcda0
SHA1 f00d2777bb86ec2822c578f2705c65e14a4bcda5
SHA512 2b6e60872df9bd067010dbdbe5e8b2f2f498ac67584761c840835e71629b0d5e6d8ca65b4a38fa5166bb6fa1a11f297b91b57d2248df802cdc8cad063631dfec
SSDEEP 12:7+tWFmZiqLWEmlP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmX:7+tWF7qLsO7sL7yot3BVrHotGGSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.haiodheohh.jioajdoew/databases/cc/cc.db-journal
Size 512B
SHA256 f992ad6cdcbd24515f05086f61f26e8f8cf6865426e1e19d412aeb2e057d2ddc
MD5 a03ec8aa765acaff3c1f68446b7bfcdc
SHA1 2557026b5688e4b86526200a98e6568f054ce9a3
SHA512 f344f86958e3613a204843199dd4a9dcde7991a5832e11df5e26c97d494a470418ef65a1b1472244ab1301f8db08baa21edd6e7db2fd5089dc64d0d36a48da3a
MD5 SHA1 SHA512

Submit Download

cc.db-journal

Path /data/data/com.haiodheohh.jioajdoew/databases/cc/cc.db-journal
Size 8KB
SHA256 6928094fe92c8e5440a538e3d3027331bffb799e86079fe9c948ed841decc79a
MD5 7e62eb76b773cbbd5ba120ad4b95f086
SHA1 97af4c6c985aef246aa4fdf47a830f48cb8067e9
SHA512 2328511d473442e9155b4edf6d6167d452dd4517710ceafae81ea6fd90bec53c339eaab73377bfd0d6d7132585e1b844e3283c7c035a050515ad7e399eeab7ae
SSDEEP 6:7+/l9E/gn1sng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK5X:7+tq/VnqLiuWdYRmBEyPbm
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.haiodheohh.jioajdoew/databases/cc/cc.db-journal
Size 8KB
SHA256 95d10f9acb9571d9da6ce8f267324f4e6b736114692e2905dae8537c7f3fc966
MD5 35cc8880e64dfc3a7389663ef5bef1a4
SHA1 92f60301959f7d24cb4618ded3a6bfb23cb018ec
SHA512 14400dcd6f9881ad6bbe55ae90efc1da8ee3c46a677b3328ec19abb31e5f9321e09e819123fd3c782d45b602787381b6070493672cb90293a36291c6581206c3
SSDEEP 6:7+/l9NCPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKyDU/p:7+tuqLJdeWRmBEyPbGp
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.haiodheohh.jioajdoew/databases/cc/cc.db-journal
Size 8KB
SHA256 ab2917384bda1c2dc6fef9dfacabb447a3089176363fce69e1bed7f6b164b9e2
MD5 fcf1eff082f36df21dbd51f678e5c90e
SHA1 11506096da3ab8a9bc92c6bed778c9eec264f25b
SHA512 5ddb3b1a6932cd3a7a75c5f3c4ff9793388b71691c42127d14f5ce1554fcaa3940642f02c02613a28bd6ea5e1d68f9e99e9cb73255f0facbf1fe851b8815c7c6
SSDEEP 12:7+t81fqL/0P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyP2:7+t8BqLV7sL7yot3BVrHotGGSC
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1718183238528.env

Path /data/user/0/com.haiodheohh.jioajdoew/files/.um/um_cache_1718183238528.env
Size 1KB
SHA256 121524e71ddf220787c3afe0fe8462fe1cebed908132afa495668d4ddf36ddc0
MD5 457671f5c8d3d48245b988fa05440173
SHA1 f09407e90cdcd9c11e868e009f144bbd4413005f
SHA512 8e67ec1383c1e9008fc5fa3d5c1d5463d4c7525abe7ff2c37345e6ae938af2f9c48d8ecfcd6ba6b87665f931f98ba6759f1ffd90c0e12d8f396dcc881fc18776
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.haiodheohh.jioajdoew/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 f690ccd67935da4461d5b039508d4b3f52a93647074629dd2b3359415a91c3ce
MD5 e851673c89d3b39aae4602167ddc822b
SHA1 6b595f3d2e8b032de2a97b60362e71ba60aff22b
SHA512 1e6b5361a2762e7c1043e33e839cb27fe1b07cdbfc222fd2c1df7f99a6c5b69c2192fa6f986c708ea541ce585e2f7ac0e17bff3c87e3a9a56619209298725f84
MD5 SHA1 SHA512

Submit Download

exid.dat

Path /data/user/0/com.haiodheohh.jioajdoew/files/exid.dat
Size 54B
SHA256 372741e3b26d786a40bdfd440c66e9e76a6f7ca8c1764942a65599ff3a079f63
MD5 ea45be120280bfcef5e8d4af9f39d9d8
SHA1 67c6d290b3c54d439656e26d332e2ef1190d8cd4
SHA512 dcb1abddb4dd8c1076a53d3d52e34e900311345d840b46dcc48baf07ae8b5b12188b6e94f85e5926f4baea931f135b6a6f2bd3109149b960bb7963a26f852c03
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.haiodheohh.jioajdoew891

Path /data/user/0/com.haiodheohh.jioajdoew/files/mobclick_agent_cached_com.haiodheohh.jioajdoew891
Size 1KB
SHA256 27a2ab5e8e89dc673bee4e03a8edaee0b8bcbd5aa6c34bd0d57ec6889979960f
MD5 04ef54a078d39a228edef3e94b72c3d1
SHA1 7be617e5a97306fdb9cb0c1d66eb6b6f6c7f9604
SHA512 9db2911408357d11b8b308e2ad68a5c083be99c60269fb7bceef9af287dfff928a050ef43101ba324d8b33a1acc552020f3c9be0c83bed0b1c8aa87cea49f259
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.haiodheohh.jioajdoew/files/umeng_it.cache
Size 350B
SHA256 ef6ad4104bf8501e4d86705cafd4cf6d88bd9d40e3444a810113d5e3787b39f1
MD5 ef1e191f39d800ad47c5c3727e7bd66a
SHA1 a6996ee920cb108e118f78fbca5c0a3688776702
SHA512 543e5803ee9095c6aa32af2f581fd2ed4df0b7609cd0fe37b3036e16bface3d52ffc0f1cbbcd533e472f88abdc7a5ad15cce3136e2a66ddae86a0ee5840e3285
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads