Overview

overview

8

Static

static

6

a04f111d7b...18.apk

android-9-x86

7

a04f111d7b...18.apk

android-11-x64

8

Analysis

  • max time kernel
    165s
  • max time network
    187s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    12/06/2024, 10:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a04f111d7bf1aae4f631a46bfa07b7ac_JaffaCakes118.apk
  • Size 16.0MB
  • Sample240612-mfczksvcpr
  • SHA256 d72ae1fd0e29933d696e3fdd0e7e80ed07e181b754534cc7e04a51c54edec8bc
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
collectiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
    evasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 2 IoCs

Processes

  • com.vod.infantis
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4450
  • com.vod.infantis:channel
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4822

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        libsgmain_312768000000.zip
        • Path /data/user/0/com.vod.infantis/app_SGLib/app_1718187852/libsgmain_312768000000.zip
        • Size 65KB
        • SHA256 8a7bdd15bed9839a642b029044e42897d9060925c7598d02f954eb5572573081
        • MD5 SHA1 SHA512 SSDEEP
        Download

        libsgmain_312768000000.zip.tmp.4450
        • Path /data/user/0/com.vod.infantis/app_SGLib/app_1718187852/libsgmain_312768000000.zip.tmp.4450
        • Size 381KB
        • SHA256 68f360f5597645bd4b906b1b28617d08ea8a267d79ef57da4000f4404452fefc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db
        • Path /data/user/0/com.vod.infantis/databases/MessageStore.db
        • Size 36KB
        • SHA256 2f1ebd494ac88342932fad54042e34856688af8849f0719c6833946875a5184c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.vod.infantis/databases/MessageStore.db-journal
        • Size 12KB
        • SHA256 3a775e74de0a61affe59936fe0eb5066977780b48d0cdff8878b52f81e982713
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.vod.infantis/databases/MessageStore.db-journal
        • Size 512B
        • SHA256 27645fef680dca12b94f746bb79f164d71ff2ab9705eb388be4bc49a073532c3
        • MD5 SHA1 SHA512
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.vod.infantis/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 6e41adfbf8643f987d17b3b5c2e8a4c493517bdb280482905dc0fac9fea94277
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.vod.infantis/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 16b25f7296f0f6102380cc7dad7070246cb2b140d67539a42e9c25a8d4005542
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db
        • Path /data/user/0/com.vod.infantis/databases/MsgLogStore.db
        • Size 691KB
        • SHA256 d72e232383167362c542ead685ab9ced49c41b857c4fe305f76779ce54634d0e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.vod.infantis/databases/MsgLogStore.db-journal
        • Size 512B
        • SHA256 13864f969acbb2a986f40f1cf93b68ad945bd16a83a6fa12ad51dbf15c87b936
        • MD5 SHA1 SHA512
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.vod.infantis/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 a8300dea9fbd362ef788f4274a162bf8d173b70503ed3cedd4f4d56ac2a4d5be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.vod.infantis/databases/MsgLogStore.db-journal
        • Size 36KB
        • SHA256 f2434b69ad5ddbdeb3796b9e34fa428cf6fc31bf987dee42c12816e3632a128b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        accs.db
        • Path /data/user/0/com.vod.infantis/databases/accs.db
        • Size 20KB
        • SHA256 b4ef8a71919ac4b6ef9a895a991b527f5c3316fd6204eb815366c9614dc71f00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        accs.db-journal
        • Path /data/user/0/com.vod.infantis/databases/accs.db-journal
        • Size 512B
        • SHA256 06d1689c123b422af80815754e0797ee2e03380a4eaefc7c5a686f084ac13460
        • MD5 SHA1 SHA512
        Submit Download

        accs.db-journal
        • Path /data/user/0/com.vod.infantis/databases/accs.db-journal
        • Size 8KB
        • SHA256 0bfb6d61d0d512744db2cac1817bbd6cf236a3d39b3dc2375c0d7af164091452
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        accs.db-journal
        • Path /data/user/0/com.vod.infantis/databases/accs.db-journal
        • Size 8KB
        • SHA256 6cf5f6e46f6b3419911f6767ccec9239c18cb5f71111c84660b018a347886ec2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        i==1.2.0&&5.13.6_1718187862502_envelope.log
        • Path /data/user/0/com.vod.infantis/files/.envelope/i==1.2.0&&5.13.6_1718187862502_envelope.log
        • Size 2KB
        • SHA256 9227450a947bb70c90fa7c926ad2cb3f54c2ae4e1d8c2bd169565b60d8850396
        • MD5 SHA1 SHA512
        Submit Download

        exchangeIdentity.json
        • Path /data/user/0/com.vod.infantis/files/.umeng/exchangeIdentity.json
        • Size 162B
        • SHA256 fc9ca17eba68e8606186c59700b68df9c06228a05b01bd39ad5040aec62c0a03
        • MD5 SHA1 SHA512
        Submit Download

        exid.dat
        • Path /data/user/0/com.vod.infantis/files/exid.dat
        • Size 55B
        • SHA256 f6c9421750a425a4a989c84c6cc5a19a096dc0470000acccae8a6b539e3e2504
        • MD5 SHA1 SHA512
        Submit Download

        dW1weF9pbnRlcm5hbF8xNzE4MTg3ODYxNjAx

        • Path /data/user/0/com.vod.infantis/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE4MTg3ODYxNjAx
        • Size 1KB
        • SHA256 329687c4e5364ca82adce23a74f0ac0a26ed536d1540263a0337be0decb56f20
        • MD5 SHA1 SHA512
        Submit Download

        umeng_it.cache
        • Path /data/user/0/com.vod.infantis/files/umeng_it.cache
        • Size 435B
        • SHA256 bdd5b7b52a2bc87fce3e70cea92a183b26db2bb87ffa49513637bc73efb353f1
        • MD5 SHA1 SHA512
        Submit Download

        umeng_it.cache
        • Path /data/user/0/com.vod.infantis/files/umeng_it.cache
        • Size 245B
        • SHA256 7648afa950715f16e661683f05f2a3274556189e1efaef57990eec2a6d1a4539
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 111B
        • SHA256 e0e5530e88f58ad1b1dedb53af7a5ae2c32049ce27a1d1586065e9c0dec5cf66
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 213B
        • SHA256 8780903a381eb4baa120b4d9c323459b11b05d6afdc6b9bf4513cf04b93c7351
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 8KB
        • SHA256 96fa74f4a98c8a9576d4993b25b102c2107519020fc1fac3a90fe29f1678052c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 167B
        • SHA256 416abb00eaac05c38fe14a47b4e3f1b11f78bc0a8b2cc418976ffabd11cc4136
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 512B
        • SHA256 69f3915bf7cd8eb8dfa5fdac9b935829e0e308cb96ede118f76d82c36f2759d0
        • MD5 SHA1 SHA512
        Submit Download