e9ba800e3f309e864fdf375b6ad7186409c040dd992c3f6c212cdd493fc00b70

Analysis

max time kernel
179s
max time network
182s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
12/06/2024, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a103949c322dd1e5bee8301c364299f9_JaffaCakes118.apk
Size 4.1MB
Sample240612-rzbcbascrl
SHA256 e9ba800e3f309e864fdf375b6ad7186409c040dd992c3f6c212cdd493fc00b70
MD5 a103949c322dd1e5bee8301c364299f9
SHA1 25bedcc4d2d21b3cd3ba8f14b655a9839f9e0ef4
SHA512 0f5979f0493601c030077a81f03c02582671e08de22f29bce670ace60bab5340e27b558a315d182b7f0eccafd7e71b73348a93bccde8e743c93e4748b483708f
SSDEEP 98304:aS+1MEYzqNh8SRio2l34xdRTiJTew7z/jkqoFG54ryojHfRDsevls9:atgzq/8SRioModpiTewzeg4y6s9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.joy7.safari

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.joy7.safari:pushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
14	alog.umeng.com

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.joy7.safari:service3

Queries information about active data network 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.joy7.safari
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.joy7.safari:pushservice
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.joy7.safari:service1

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.joy7.safari

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.joy7.safari

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.joy7.safari

com.joy7.safari
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4418

com.joy7.safari:pushservice
1⤵
- Acquires the wake lock
- Queries information about active data network
PID:4455

com.joy7.safari:service1
1⤵
- Queries information about active data network
PID:4488

com.joy7.safari:service3
1⤵
- Makes use of the framework's foreground persistence service
PID:4516

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

23a12ec898247dad9089bcab6cb53a4e

Path /data/user/0/com.joy7.safari/databases/23a12ec898247dad9089bcab6cb53a4e
Size 44KB
SHA256 7fbcba953ce19ddb024e80d7e2d23349360418fdb989d878cc8964a67ee20344
MD5 31876bae6dcc43f0b77b20fa696792c2
SHA1 a9a7e535c60e669d950021caa88010e73b27bb9c
SHA512 271c6acd0539a7fde2f4dcca723a39257ef0b9481a2787ece54a2e16a7b82d92b4e21d1e786544424bdfabc18d9134873058843ec22048b9f17170b693424e78
SSDEEP 48:TR0xopA/t379y/MSocnLexpaJU9CTZVpKxbW:N0+pYto/tRCqLpKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

23a12ec898247dad9089bcab6cb53a4e-journal

Path /data/user/0/com.joy7.safari/databases/23a12ec898247dad9089bcab6cb53a4e-journal
Size 8KB
SHA256 19f3c858bcad5cac48b181f9adc612bc8859d8c337860bc78636cd3c4fd2c8a6
MD5 99b3b8b91f4d57a4a946a7ef73e19fd9
SHA1 48b4a9712bc4e7b3760db7b2f8604c6e865c1999
SHA512 dece16b2c7f2b04ca12c2b9ead3cb36266bb8b3d907dbf379b063565a45519174fd054f26c03c4ab8eb4c83b84843a17bf9ed4095af01fd301efab35beda5d6f
SSDEEP 6:7+/l9IDulFn1ggWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKsc:7+tdOLqLiuWdYRmBEyPbG
MD5 SHA1 SHA512 SSDEEP

Submit Download

23a12ec898247dad9089bcab6cb53a4e-journal

Path /data/user/0/com.joy7.safari/databases/23a12ec898247dad9089bcab6cb53a4e-journal
Size 8KB
SHA256 12d074cdcc9e807a6701c22508587fefe7d947459e27f34b628e778edd9c9ff6
MD5 f6812ba5078981bb11351a9c3e944aa3
SHA1 db73285cfd273ea74755fa33c00f96887d7f6a9f
SHA512 86d571b9645bf0fc7e1a067207067a1ca033ec6a369b927c633d474da92f9c0bb3c5995d0ad5ff0ede33f259c0609719904bc05b3db3d91b9b26d9a93d6adaba
SSDEEP 24:7+tclBqLVvz0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSPqLiuWpGSFn:7MUBqB0xopA/t379y/MSPqZWsSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

23a12ec898247dad9089bcab6cb53a4e-journal

Path /data/user/0/com.joy7.safari/databases/23a12ec898247dad9089bcab6cb53a4e-journal
Size 8KB
SHA256 88b02c46db50775c18dea9ec8f49e77234b6a71aad064a657d3ee745a4dadc6f
MD5 35c99a18b835296bfe9ac0eb6605d9a1
SHA1 7e3cc82729dfb53d05f898667fd7cb9e32660772
SHA512 40082578437a34398499ee2f290b0e2f02a7a83110413e521db516e5c845d16ed7b0ba43c9db6956aa0bc94e527907439d9c38b9d8fe0ea47f413936d840b9bb
SSDEEP 6:7+/l9OUHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKYh7/Gn:7+tkUvqLJdeWRmBEyPbfZGn
MD5 SHA1 SHA512 SSDEEP

Submit Download

download

Path /data/user/0/com.joy7.safari/databases/download
Size 12KB
SHA256 d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e
MD5 171aedf968e17a2744d2585715606cb9
SHA1 bbeddeb3b89fcf809619c35b4a318a80e7d5b029
SHA512 78a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b
SSDEEP 6:l9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKTqiOw2:TLJdeWRmBEyPbsOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

download-journal

Path /data/user/0/com.joy7.safari/databases/download-journal
Size 512B
SHA256 752ccf02a46c70f214e062a7c1ce0ed13da9c01d373fc1d17643a0c78d399bec
MD5 b2e3460fb48fc61e8026b817ef1d3f38
SHA1 fe48413133677a51b002652a15979486adda4188
SHA512 69dcb537b353f9de37f3977978f25ec607728b5a25d65edc488b1d74387b0d845645d564065cd3f6b9fafedda3d80aee72438f1348d7f27a6ef30eec7fb07213
MD5 SHA1 SHA512

Submit Download

download-journal

Path /data/user/0/com.joy7.safari/databases/download-journal
Size 8KB
SHA256 61cf8f998b2cde6f533160ea6ce19c105112b3f5e3da647b0a9b11409b04d041
MD5 758405084f8a5bb90d902cf883e49be9
SHA1 9ac224452be203ceae3324c77b36a0c8fc3fa42d
SHA512 c27c78ae7b2473c7933b9acee11818278a337db83586c8db97eea2d553673e828ea5431a5ffa77be227e6e57c8130194bec99bc3f3167d8155c0a36f6ddac812
SSDEEP 6:gn1Pg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK2f:KqLiuWdYRmBEyPbHf
MD5 SHA1 SHA512 SSDEEP

Submit Download

download-journal

Path /data/user/0/com.joy7.safari/databases/download-journal
Size 8KB
SHA256 3c3e79aacea1d9c073f6a2814e2a5fbbc5d4cff88be52133c77879f16c302921
MD5 7848fac6c1e2d54fb64ab3ea6c9cba87
SHA1 009ab8d09c5949db0bfcc990eaf652164d41dc08
SHA512 fad8974b38911aa2279c1bf839fc2cc09503c912e17105e06fd865798852658b6eed32b1a17681110ce784f5c76befa78a7b1c7860258d9a10664e843a21a59c
SSDEEP 6:XPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKuCM/:/qLJdeWRmBEyPbt1
MD5 SHA1 SHA512 SSDEEP

Submit Download

galhttprequest_database

Path /data/user/0/com.joy7.safari/databases/galhttprequest_database
Size 12KB
SHA256 d555c3963f8d3b424817113b6bb116fae07f39985e2acbd0c12e7d437377a521
MD5 9559021ee912b82b9f336ccb9b003bc1
SHA1 a1ea34357a923c343c8cac4a79c9cb316c520bba
SHA512 f4884a2f9bed933ffaa0516066bacfbf082fdfbe737f984b6913d53c9ab8fdfd1c629dfdec54e18a049af82bbdbd6f97e8bc7a98e30816d4d57dabfc838ee336
SSDEEP 12:TLyKPk2yNTSFbyai/xhaIroEWcoTDeRmBEyPbsOw2:TLy2q8i/xhLsZj9GSG2
MD5 SHA1 SHA512 SSDEEP

Submit Download

galhttprequest_database-journal

Path /data/user/0/com.joy7.safari/databases/galhttprequest_database-journal
Size 512B
SHA256 b02992295472e5d1c06f2aa69fe6f9ce6614d797b5ee3dc80ea001831cbdaf07
MD5 b972b098de7eb4af24af48ba38a1cfd9
SHA1 278173195807273e2b9b179f142157fa8412b629
SHA512 6f50120bac21369753de9851a2ee0aaa8bc68b72a0b9b34b6ad009cebb13932191b0959a9f76433b768c4511b0a8fcafb567f6e7205b3d717f6b53222d56b3ec
MD5 SHA1 SHA512

Submit Download

galhttprequest_database-journal

Path /data/user/0/com.joy7.safari/databases/galhttprequest_database-journal
Size 8KB
SHA256 00bc92d88a85e614766f134ca475f8b21589c6b834972a379f3387b086e260f2
MD5 4d1039c39a5e16d11dc1713439e15487
SHA1 1d10575cb246d5a323c9a59fa8057ebb3911eec0
SHA512 9d4683abc5eac3a52c9dbe18f3fd934ebff17c8da30d6932d9eee0e9dc437aa6675359e848eb27ebb40a165b67c84c976fcf285ebcb91f38ff8b9e6b656617fa
SSDEEP 12:lFiOwrqLmak2yNTSFbyai/xhaIroEWcoTDeRmBEyPb+:ArqLXq8i/xhLsZj9GS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

jqIqJYOT3JpT

Path /data/user/0/com.joy7.safari/databases/jqIqJYOT3JpT
Size 24KB
SHA256 d4974fcb8fd7f47acb431f83c3a86c8f3f97d29f5e68ef37b2998d58151213dc
MD5 06e580cfb08c7f330735d978fffd2922
SHA1 69745e9a4a23dbcbadac6e1e55eebb6a028a91ce
SHA512 6ebdb46abea04255e8b2094ae7dcc6ce15620fd4826c0334427e8b2574ff1f3b54faf728a15597f37809dbedb6f2af9587588cd57d6c0842b1472de8a5e964ae
SSDEEP 6:7+/l9RAxPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK9//J1bOwI:7+tWqLJdeWRmBEyPb+JZOwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

jqIqJYOT3JpT-journal

Path /data/user/0/com.joy7.safari/databases/jqIqJYOT3JpT-journal
Size 12KB
SHA256 103e46f3f72c1d62415f26ac9a4fcfe2c21aaef011c39a1a51dcb4703926858f
MD5 93eae34b0fb99a9655ee39decf015436
SHA1 b50451a0b922f3a020ee0bc2e174a32fb4862c4e
SHA512 956fc29c02ef3a5a6c0bed796ea731a47aa1256408700bc79985da16a9389b9f1097810e3dba4bd51368e72d8db09c8b3a929676c269bdd07b4d49cdc2291873
SSDEEP 6:7+/l9qzNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKTqY//bOw2:7+tqmqKRmBEyPbubOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

jqIqJYOT3JpT-journal

Path /data/user/0/com.joy7.safari/databases/jqIqJYOT3JpT-journal
Size 8KB
SHA256 5f3047aaa5a837179af4909ddef54f2354ee0cfd0b1f53a27a79f2eaf0492fcd
MD5 8a3cdd9487b9830bb93d7bc64a40c1b3
SHA1 6fef21425181453458288eae008e52c88cefeecc
SHA512 c5f1502afc95cf3fc228ee4e2abb9eb78feab974094374d32bcda8251852a0ced4bc3e2e3a7d288fc1dd36d29f96a79d2a35ae8998068d4a70e716e085af8a57
SSDEEP 24:7+thz0pqLYvW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGS/:7MhApqR0xopA/t379y/MS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jqIqJYOT3JpT-journal

Path /data/user/0/com.joy7.safari/databases/jqIqJYOT3JpT-journal
Size 12KB
SHA256 c00439ab36acc25dbf463ac058b210a9c80128efb80605028b96ac333c35646a
MD5 96335bbe39cd7882519f73506d313c11
SHA1 043f1927a50ded0b972a9e707b9b287c55c5758c
SHA512 82d18b6fcc3b49d9e810757cc278fa098ab435904d6f4ce61d230efeccb43c6296ec8cc1dffd9c852803dba39f02fc51f929a949486bee11410ea29bb0dd06f9
SSDEEP 48:7MELq3R0xopA/t379y/MS6qx0xopA/t379y/MSE:7dcR0+pYto/t680+pYto/tE
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsUL1uCdKvjD

Path /data/user/0/com.joy7.safari/databases/wsUL1uCdKvjD
Size 24KB
SHA256 0f76a9ccbfd5c1ead7caad5059bc8e019f65d4de05a449bd494c9bcc89e1043b
MD5 ee404ee50b0a8b608431c827eb7412d5
SHA1 2fcd5f95d113dc1ec7cef52833d0d86d31a7c183
SHA512 e33289ba9977eef8ff85098786b523cd2e1e7799af8cdbea36961f870ad717b63947c4dd7829b1219616b2ce0858fff2a181d8e4e52213f5ffd6894270741e0a
SSDEEP 12:TLG+oWt+lTSF7V9NoXoxq+oTk6X8UOvorpoTVZo5RmBEyPbD3OwI:TLBt+l54gPsU7riMqGSzI
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsUL1uCdKvjD-journal

Path /data/user/0/com.joy7.safari/databases/wsUL1uCdKvjD-journal
Size 512B
SHA256 e068fe68008c1a38080a17392bba4338a04b78208b176f51f46ca0f43b5cd015
MD5 acd8dbc991933c9ef4ed014ec824c3ec
SHA1 4a3f67548507ed5ff3c2d170badc7c4820f183cb
SHA512 b57378adf3726875e970c5d1be26c457b4f0d718c03bfc4dd6117ff58f1a9ab46d5a179ff5085c1a9382331142d8c831f0a5552e0d3d26ce8b7d223227c31be3
MD5 SHA1 SHA512

Submit Download

wsUL1uCdKvjD-journal

Path /data/user/0/com.joy7.safari/databases/wsUL1uCdKvjD-journal
Size 8KB
SHA256 73ef55b97c78224ee4fbae3bbf132a89b13288d09235622a482c5403250b0027
MD5 59291ddea96a25636a7461d204d3ff7e
SHA1 ff5fb433dc63ec8d4dc94f369b8c8043ff2dce20
SHA512 97235fd06835ae7778137b8bb38e0a1c361f4744cd26f5924129da53058da736e9fd71880363e99c6f1b1362856a18f3710a097b995d0170fc606cd7e384e752
SSDEEP 6:7+/l9Ran1Hg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKa9:7+toqLiuWdYRmBEyPbP
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsUL1uCdKvjD-journal

Path /data/user/0/com.joy7.safari/databases/wsUL1uCdKvjD-journal
Size 8KB
SHA256 199ee16ec78bdbd491d513f821e7dd0f5f178fe64fc9040c764332df9219e254
MD5 df443b5f358b0f74e182c07f62fb6c3e
SHA1 11e1fd7d84b9935fdfa2c6085db6e0101cf20e58
SHA512 6c1169856c8ba2b37b96bf12b9031b124ba27837f8eacdb2d22df8d14035ca0c8ad9d91c5b19cf1b3ecc36b79e6fba9b572b88d5b575f3e47c620eaf0032eb84
SSDEEP 6:7+/l9OHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKJH//:7+tuqLJdeWRmBEyPbA3
MD5 SHA1 SHA512 SSDEEP

Submit Download

exchangeIdentity.json

Path /data/user/0/com.joy7.safari/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 365a84d9ec59eced5fcebb12b4baaa0f93d7940ff3cc2e4ef52b2e41b3cced31
MD5 4187fc04725ed7999b9453f14e1078a0
SHA1 d600eb73c65d760f25dcbdc8944900c50af11720
SHA512 a9e5ff46d42637896452905122223bc21a4a46412eeffbf9efc0c2453eefe338fba41f5a988b5f1fd43d852f8f82b0f873ff85cc3a05bb29f8210374c5e0bef5
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.joy7.safari/files/umeng_it.cache
Size 245B
SHA256 e85dda50f622f7cc9d056f985af8d38374bd05b39279d70a23f2002cd1ab67af
MD5 911a1e7163d0617b65b82d845db182d6
SHA1 6c1e0af4ab883dbca65c588fe9f731e6a2efb2ee
SHA512 6c452673f90a6a0b12912bf97ba22616c394086b9ee4fc669b3ed2d468d8319652636c056a0f726d6f3f06fc724bd13ebe2c4f8dd3a4db32aa8efd35a85f0baa
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads