Analysis

  • max time kernel
    179s
  • max time network
    183s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    13/06/2024, 10:24

General

  • Target
    a510fbec01ea5dfe69cc8bd329a615b2_JaffaCakes118.apk
  • Size 10.7MB
  • Sample240613-mfdacayekl
  • SHA256 4620b7c0b4056f911064cd7d28f885517954c70f54266495191bc08e4136459d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.a657id60.app
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:5161
  • com.a657id60.app:pushcore
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5208

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cc.db

        • Path /data/data/com.a657id60.app/databases/cc/cc.db
        • Size 36KB
        • SHA256 38f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f
        • MD5 SHA1 SHA512 SSDEEP

        cc.db

        • Path /data/data/com.a657id60.app/databases/cc/cc.db
        • Size 36KB
        • SHA256 abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
        • Size 512B
        • SHA256 57012e679769cf903bb72d01b4d995f1187691b2b220b730346a47a033e05feb
        • MD5 SHA1 SHA512

        cc.db-journal

        • Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 e056aa8007046abcc55f3683d5256c0d85aeb8fde3108079a852bf0f5fbbbfac
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 88bf949e5e1001c65c9375bf19d8c3ded29360dc21613836f61a5a50898704cb
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 7bba4c9177663bccbbe1c9b1872d80a44beb8d5a66e2bfc4c3969fc4d60fc741
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 45ab976bbf4235a5c928b967d9b53be4db148cf9c35e82edec571eab8623c5e6
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
        • Size 12KB
        • SHA256 1abbf30f31a56eef5b60b436e3eb20acaf537dbc983f125725da240c259331b1
        • MD5 SHA1 SHA512 SSDEEP

        okgo_cache.db

        • Path /data/data/com.a657id60.app/databases/okgo_cache.db
        • Size 24KB
        • SHA256 5ae24fb1066c3cce8b38dc14561ef2c0db93cea43736c8547c4405a85d5019e6
        • MD5 SHA1 SHA512 SSDEEP

        okgo_cache.db-journal

        • Path /data/data/com.a657id60.app/databases/okgo_cache.db-journal
        • Size 512B
        • SHA256 bef61f03a6e5b64613d3d0f40a4d1eda2bf1f4d8c6092e5574e8bb1214014111
        • MD5 SHA1 SHA512

        okgo_cache.db-journal

        • Path /data/data/com.a657id60.app/databases/okgo_cache.db-journal
        • Size 8KB
        • SHA256 e3378f61390156d1cd5b06fb11070087cf4a62a291a16ae19b89a39c21fa478c
        • MD5 SHA1 SHA512 SSDEEP

        okgo_cache.db-journal

        • Path /data/data/com.a657id60.app/databases/okgo_cache.db-journal
        • Size 8KB
        • SHA256 d4b4aa1eeb64cda756588a18e7e443eee11fd35d76fbed9771e1957b59966fa0
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/com.a657id60.app/databases/ua.db
        • Size 16KB
        • SHA256 5a8c0f65f0c4ff64615598c3395d1f985132419d9527a892bdce0bf5249d6a16
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/com.a657id60.app/databases/ua.db
        • Size 32KB
        • SHA256 fa5140568beb67357c0a441eb4decc9b64a015c2d7c4ea441d1cdc32057dc6d4
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/com.a657id60.app/databases/ua.db
        • Size 32KB
        • SHA256 6f909ef4c53be01c4c511617483eaaae2b59e87bb6dd352163a017b4b9f8f8a9
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/com.a657id60.app/databases/ua.db-journal
        • Size 8KB
        • SHA256 d32f0c9eec707e308275e2daa1e98e3356edf5b5d454030fc1fa00e1a99d3b33
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/com.a657id60.app/databases/ua.db-journal
        • Size 8KB
        • SHA256 16eed9f79d0eb89f4a0b6eff4385df46b41a5240d44df0d3d08bdb27ba13d0e0
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/com.a657id60.app/databases/ua.db-journal
        • Size 16KB
        • SHA256 fc52ef91a8ee1bbe0985b905d7392dcf216027d4aba6a5e2d35ab0314d4d51c8
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/com.a657id60.app/databases/ua.db-journal
        • Size 8KB
        • SHA256 c94c83da43ff85531916898a58cdf6b07b03a8fa36c96046d322ae600c48b238
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/com.a657id60.app/databases/ua.db-journal
        • Size 12KB
        • SHA256 ddb7518bca748c9f3e74af1b8cc040dda81f2828778bfabf8d84b59ad9be23f5
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/com.a657id60.app/databases/ua.db-journal
        • Size 512B
        • SHA256 3af19f0ebbda8070d88c6348a1194eef9228ee259db0495b6ce063b516a634c5
        • MD5 SHA1 SHA512

        um_cache_1718274389218.env

        • Path /data/data/com.a657id60.app/files/.um/um_cache_1718274389218.env
        • Size 1KB
        • SHA256 d6d114707d7bcc2b37ae62b153bcd395808aa3c90ad308d1728669aff0ba0eed
        • MD5 SHA1 SHA512

        exchangeIdentity.json

        • Path /data/data/com.a657id60.app/files/.umeng/exchangeIdentity.json
        • Size 162B
        • SHA256 4e5659cd96caa991e44fa29bb1453109ce7a07248c22f21ae9805ba730367206
        • MD5 SHA1 SHA512

        exid.dat

        • Path /data/data/com.a657id60.app/files/exid.dat
        • Size 57B
        • SHA256 6423d0ea04594c4ac273d14511c8b1ad75633177e1cff2a2b84252e711f16a3a
        • MD5 SHA1 SHA512

        jpush_stat_cache.json

        • Path /data/data/com.a657id60.app/files/jpush_stat_cache.json
        • Size 126B
        • SHA256 d402e34e53fa4f051c188bb09786cc625ca4c442dd8389347e8846149569eb75
        • MD5 SHA1 SHA512

        umeng_it.cache

        • Path /data/data/com.a657id60.app/files/umeng_it.cache
        • Size 350B
        • SHA256 b269cb803e80f786161285edeb616030455f7e72f228e40d3664cf43ff754b54
        • MD5 SHA1 SHA512

        .push_deviceid

        • Path /storage/emulated/0/data/.push_deviceid
        • Size 32B
        • SHA256 ea9c640711fc8482f098505b86b85a7ee430f58a8d0eb4bb36af943091227ebe
        • MD5 SHA1 SHA512

        .push_deviceid

        • Path /storage/emulated/0/data/.push_deviceid
        • Size 32B
        • SHA256 1ea977071500c00cab516146851df7636e97f13de525296b5718c9a15ad4822e
        • MD5 SHA1 SHA512