Overview

overview

8

Static

static

6

a48586b7a0...18.apk

android-9-x86

8

a48586b7a0...18.apk

android-13-x64

8

Analysis

  • max time kernel
    160s
  • max time network
    182s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240611.1-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240611.1-enlocale:en-usos:android-13-x64system
  • submitted
    13/06/2024, 07:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a48586b7a008e8b3946587b4181219e6_JaffaCakes118.apk
  • Size 8.9MB
  • Sample240613-jtetjszerh
  • SHA256 0413c864047b203f508b9c99fd0a6321b5f4b2d0faab6e4aa717e15b10826cfb
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
collectiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 6 IoCs
    evasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 2 IoCs

Processes

  • com.example.jiuzheyang.distributestore
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4261
  • com.example.jiuzheyang.distributestore:channel
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4631

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        libjiagu.so
        • Path /data/user/0/com.example.jiuzheyang.distributestore/.jiagu/libjiagu.so
        • Size 496KB
        • SHA256 5c83817c713f24c66500ec4bac543400d852944977b132f105938637457faac5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libjiagu_64.so
        • Path /data/user/0/com.example.jiuzheyang.distributestore/.jiagu/libjiagu_64.so
        • Size 568KB
        • SHA256 6a71ae0506cbad587e1c3846fffa8bd0aae9fa7b25b9bf63f986cc35fc8d068c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        [email protected]
        • Path /data/user/0/com.example.jiuzheyang.distributestore/[email protected]
        • Size 6.1MB
        • SHA256 5ca075a99678fb7b076c89b67bda059a400c57bd8d7c3f1cf113ac90a8a98dce
        • MD5 SHA1 SHA512 SSDEEP
        Download

        [email protected]!classes2.dex
        • Path /data/user/0/com.example.jiuzheyang.distributestore/[email protected]!classes2.dex
        • Size 3.6MB
        • SHA256 1ed1e67692877612d42ff6efaec8c65d925fcffc90e92fdb5f0c9396acc6d099
        • MD5 SHA1 SHA512 SSDEEP
        Download

        MessageStore.db
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/MessageStore.db
        • Size 36KB
        • SHA256 54c46233aaee1a76ea2d76411d87e8219e35d885eb1c9f12f743e93aec6d9c81
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 134a1d0fac7064da263f2167ca442699094d3b62e4b3b71f1d89a6cdb0affe12
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 164417e2f1d8ef916e233c11bef0f788c27161290fc69a9b8eabc3be58f8ac15
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 02e2f3d8ac02b016543f48fd7a59bdf5a1463d9bb20ee6cc153e025b87ef4447
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/MsgLogStore.db
        • Size 56KB
        • SHA256 6e9e6f531496fd3cb33584bf4a1303845743589d5527bf8e96e27e2264b1e90f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/MsgLogStore.db-journal
        • Size 512B
        • SHA256 9db8554096665c3642d4397e1ab9892b6d02f6855910ce7bf0d2214282241fc6
        • MD5 SHA1 SHA512
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 07683ebe4cd9c9139010a2162a290e908d65339d2af04af0424bc917e711cc53
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 0cbc565fb5975ec50c15aa844032eac9c07da1f5484ae68f04ed0abc2300a7fa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        accs.db
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/accs.db
        • Size 20KB
        • SHA256 51b2b66764ca441ef1a110abc89f5b8251be8522e0a9bda462a9375d18594616
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        accs.db-journal
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/accs.db-journal
        • Size 512B
        • SHA256 0398e82ab7279687a90dcc3e02df5f2cc462c097647e35406eeb647be44bac17
        • MD5 SHA1 SHA512
        Submit Download

        accs.db-journal
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/accs.db-journal
        • Size 8KB
        • SHA256 7b52fdf209a780517e29337bf24790b39fd026bcee3ae8a80f0f90efff176e6c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        accs.db-journal
        • Path /data/user/0/com.example.jiuzheyang.distributestore/databases/accs.db-journal
        • Size 8KB
        • SHA256 424f7a73a37d8448248fe79765af89344333280df46c44d5a9eaf406b6c03807
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .jg.ac
        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/.jglogs/.jg.ac
        • Size 40B
        • SHA256 e49dddb1fc643aba76bf193a349c1d807f8cce4ad87eb179e9048e5d5d28ba4c
        • MD5 SHA1 SHA512
        Submit Download

        .jg.ac
        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/.jglogs/.jg.ac
        • Size 167B
        • SHA256 c992fb940e1b655d4f613c471c8f7d74f5d82bcaee23e6817bcf067de2ad9db6
        • MD5 SHA1 SHA512
        Submit Download

        .jg.di
        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/.jglogs/.jg.di
        • Size 348B
        • SHA256 829a8ea0f2d6f2baabe55f08f20b7c3cb898fbf2cae6c40517e5dc6b368eed58
        • MD5 SHA1 SHA512
        Submit Download

        .jg.di
        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/.jglogs/.jg.di
        • Size 8KB
        • SHA256 ccd6749278025b10d55e0c96ad5c52e65501b45715d8cadec890fa347b35baf8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .jg.ic
        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/.jglogs/.jg.ic
        • Size 36KB
        • SHA256 6463ccfd99b16b53322ddcce4843e88495257c9941f2dae307d7c9c5b2dbd95d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .jg.li
        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/.jglogs/.jg.li
        • Size 85B
        • SHA256 76ffeb1ffa7a2ff954e60a44efc77d37263c91e60a5804d20293b1cbdbc5dd1f
        • MD5 SHA1 SHA512
        Submit Download

        .jg.rd
        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/.jglogs/.jg.rd
        • Size 32B
        • SHA256 870fe5a1b9dee0b6eba49350bff0af9b7e3b6858e3d79b9bf73032f9fa87d608
        • MD5 SHA1 SHA512
        Submit Download

        .jg.ri
        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/.jglogs/.jg.ri
        • Size 314B
        • SHA256 1d45507047c9b36c8c6e45d9e6ea35b4e062c1a8856d9ca84501534d5a8e2ba7
        • MD5 SHA1 SHA512
        Submit Download

        .jiagu.lock
        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/.jiagu.lock
        • Size 27B
        • SHA256 d30aa268d69a3bc7354b512eed2590b6b3ec628eff4652e23039fd89d8c4f222
        • MD5 SHA1 SHA512
        Submit Download

        dW1weF9pbnRlcm5hbF8xNzE4MjY1NDY4NTI5

        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE4MjY1NDY4NTI5
        • Size 1KB
        • SHA256 47d20a2aee18cbaebfde62358ac634424690217f559adf041c4caa1adae9a082
        • MD5 SHA1 SHA512
        Submit Download

        dW1weF9pbnRlcm5hbF8xNzE4MjY1NDk4Nzk3

        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE4MjY1NDk4Nzk3
        • Size 1KB
        • SHA256 dec9060720972a89801cfa31fd424113276274141763705a260633e1036cd1b0
        • MD5 SHA1 SHA512
        Submit Download

        umeng_it.cache
        • Path /data/user/0/com.example.jiuzheyang.distributestore/files/umeng_it.cache
        • Size 433B
        • SHA256 b27f5de1fdc3572f179407446a2521874cf312e72cad7d1d17a6aec573f9d1c7
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 111B
        • SHA256 2659c573b00bc738fcad9101c5f3e937f24a5f620161268ff2a04f3d9378c458
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 213B
        • SHA256 3f13c2cb557fd307fcc0092102778e261e151e973dea8cd06c4558899abe680b
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 111B
        • SHA256 95ea85fcc4b34a8fc929ef56fb7576a6f67c7fe434002cd58e816f4c28574116
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 167B
        • SHA256 76c1be75606faa88778df83c971c27513d7c57f2038f9e55ec0ccd06de6fb719
        • MD5 SHA1 SHA512
        Submit Download

        .deviceId
        • Path /storage/emulated/0/360/.deviceId
        • Size 48B
        • SHA256 36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
        • MD5 SHA1 SHA512
        Submit Download

        .iddata
        • Path /storage/emulated/0/360/.iddata
        • Size 32B
        • SHA256 be1e444f66635962156cfca3bd997d99745984ceacab03d23b708279617a27ad
        • MD5 SHA1 SHA512
        Submit Download