8b80dd45b40a8cd292f28e08c2e091a39c6403fb596b8cde989f9bf9bbfdba64

Analysis

max time kernel
178s
max time network
185s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
12/06/2024, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1afe220999ebf0e3c8b648515ad6345_JaffaCakes118.apk
Size

8.0MB
MD5

a1afe220999ebf0e3c8b648515ad6345
SHA1

c8735b2dc7b80d5c3bbf39cf28e02c3f55ad4925
SHA256

8b80dd45b40a8cd292f28e08c2e091a39c6403fb596b8cde989f9bf9bbfdba64
SHA512

7b0776e131f94c1ae2e31df197f22975728df7927ab25a55cbadb69b1c083cfa4138b7aec8ae257a37ffe58e4847d1c0c3f78712ae9a418ccd24efbfef08069c
SSDEEP

196608:+xKRYsQAIEnQ5KfbGQzOZaVe1KZRep2PRL9QHndT9M0:+xtEpf+SeCG2FN0

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.llspace.pupu
/sbin/su	/system/bin/sh -c type su

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.llspace.pupu

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
11	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.llspace.pupu

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.llspace.pupu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.llspace.pupu

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.llspace.pupu

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.llspace.pupu

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.llspace.pupu

com.llspace.pupu
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4263
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4311

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.llspace.pupu/databases/bugly_db-journal

Filesize
512B

MD5
9695b015ca966fc148678bae04cddc1c

SHA1
d133fa834cf42eaa90edf044bf27bb64c9250ce5

SHA256
89d7dbeaf9af5ec540127b1938a16b4c9444eb48e45dc6fbbf0b74e59052a2c7

SHA512
c1d471632eec0fd7393aabfa7c64061d10876dea02111632e28431f62fd1bdf50efe3c31ebb7129ee030f1b69c20839f657d4294cfbfa853d425886e0c7d3c11

Download Submit
/data/data/com.llspace.pupu/databases/bugly_db-wal

Filesize
48KB

MD5
ff80521b4f9e7600be3bfc9bf24631f1

SHA1
83f9ed08fdf56f04b16a87c4c41b9e3246d0bd94

SHA256
e6281fa7296d1bf929f8768e863c09e53abe6309144072ec848f0013fb68d30a

SHA512
9eb6706fffa10b2659430cbdd4f9a6959dee7b1173bc2909bad7e0a566ec1ae0dde721cd047a3d22ff05594d8a7b0e667a385d2e5f02a3795fadb7c80cdfb141

Download Submit
/data/data/com.llspace.pupu/databases/db_default_job_manager-journal

Filesize
512B

MD5
5ec4fde4cf8a1e31c8be9ab5f37cfb0a

SHA1
32f87fe9b785611c9d726bd5ed165464991244f6

SHA256
790a8f00502ecf25c58bf1dcdf860554cae118c21d2cdef9db86d3a2ea51df17

SHA512
d3ff8b923e6b78259b4f891dfced480e5dc4897d61249d783c7578ace853caf19c7f2cb2e9422a96884502b015e363fe9c47010c3b48d0a2de0130d002b55890

Download Submit
/data/data/com.llspace.pupu/databases/db_default_job_manager-wal

Filesize
32KB

MD5
794777865ed25fa92867af98457fd46b

SHA1
751eff5b6c5185ac49e6e8683e9e46e77d5c14c1

SHA256
38e2c8804eace1f49be1ee0df87d51f604ccd43cb9d2949704d7397759de67a3

SHA512
684d460fbc7b9572bd4bb13df5d3e5328b02c3d61daef59b8c141bdbcb1fde64dcfd17855f95fef0734e5089d0340bf8b5d0a9a728fd60c3ab34c5ef675192c9

Download Submit
/data/data/com.llspace.pupu/databases/pupupu.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.llspace.pupu/databases/pupupu.db-journal

Filesize
512B

MD5
fd0489d15e953cd8e1861150fb323bcc

SHA1
e2152a486c139b2b6522e8b3376a8291b4861dfb

SHA256
490b7de76960ac2fd71e352faebe00f837d81a0385c0a436d8afc9880a28efcb

SHA512
c22244581a73487970189e2e7375a37777d9415bf804c526178e0e2e48ecea68847242e3f2c5adced90402e59d1a4178db83c363cb9420bbecc7f13c46121ed4

Download Submit
/data/data/com.llspace.pupu/databases/pupupu.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.llspace.pupu/databases/pupupu.db-wal

Filesize
140KB

MD5
c25928d4f543f79b9be4513786231d79

SHA1
d7829330d67cbf45c57f3cc8278d6dfea873b10b

SHA256
e9b58d41d3ac0c2eb1da53752b7f702497e44aba8554806903b08dd5adc5820e

SHA512
a7e1883cda323b006fb342f8a4ca2a589165bb1d2ed4d45b7013a68d265a54ca28464f451c45b40b2280ac07a53aca3dfeb17b7d7abc9fa7c7e5920d809f3860

Download Submit
/data/data/com.llspace.pupu/databases/rep.db-journal

Filesize
512B

MD5
22d34cce1f945287e6502d9d5b695319

SHA1
b977c0eac5f2d7654722a251993ae61dc2e1a5ac

SHA256
3c33364140d2acc053defc4a0c26ce706b1efc38f5f1fb654a936f05339027c1

SHA512
d991435e2c7626a0669defbbeffd4baa7401175b928d8924c7d0b7624b4728c2d04fd88756e040882c8e02080fef124b5fa46bfcee9cf6f4dbe715f86955b0ea

Download Submit
/data/data/com.llspace.pupu/databases/rep.db-wal

Filesize
36KB

MD5
30d01054a619ca2a5ece5785f7e290a7

SHA1
fe19a1b71b21a723b371a2ad95420e99746778fd

SHA256
f16fe8bca71100bbc7d4d5652b15abaa6c23f68035bf95a83665299fe7a7fafd

SHA512
f2e835fa8ae4dd3d7078e219d2be79d1c38b4ce18bf3efe05dcea02c253ff3017fe24ed37fd35a88b1b3877d2f11efd805b2269d1df5c6b9507df03a02b2267e

Download Submit
/data/data/com.llspace.pupu/files/.um/um_cache_1718216121084.env

Filesize
579B

MD5
71a7493ed0cb1737c0b15ef0cadb0b8d

SHA1
63a4fbe573dd0b292fd9fecf356f20056805005a

SHA256
2fe33551d2685692da89cd65c6e47f39bbfec99538ea7b2757a7d6c5521e7e9f

SHA512
ae1080ea9990e8ad297270c6d058f791c15a86bf0a1a7d77bf7b4564bc5fb5d37ed4d3d6e2fcfc98f20046d4fd86cb93eaee4960a2b513319f4bd3eeabe38c7b

Download Submit
/data/data/com.llspace.pupu/files/umeng_it.cache

Filesize
310B

MD5
aab1a79121790d98e858294377dde8b7

SHA1
5e05cf3db1d591f09a2491a74cee089f44bd5774

SHA256
f574b4af1a4cf33fd9834941afc93dabd665a3aebe0f322bb2e2996f3a194b07

SHA512
a2e37f3eb492540fdf427517d87983a10c4d27ab8ae9df38bcf76ed7d795adc7e0b97be24135f90666e0001d335da70f8b382059a02e35ec9fae168a52c25f73

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads