Analysis
- max time kernel
179s - max time network
183s - platform
android_x64 - resource
android-x64-20240611.1-en - resource tags
androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system - submitted
13/06/2024, 10:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a510fbec01ea5dfe69cc8bd329a615b2_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a510fbec01ea5dfe69cc8bd329a615b2_JaffaCakes118.apk
Resource
android-x64-20240611.1-en
8 signatures
150 seconds
General
- Target a510fbec01ea5dfe69cc8bd329a615b2_JaffaCakes118.apk
- Size 10.7MB
- Sample240613-mfdacayekl
- SHA256 4620b7c0b4056f911064cd7d28f885517954c70f54266495191bc08e4136459d
- MD5 a510fbec01ea5dfe69cc8bd329a615b2
- SHA1 5d8afebab1ade64e1b9f15867b160af959311311
- SHA512 ac4aaaff570e56f7a7c6522ba59ef4e41d66f29971fba2745c79798238164af9425ab4777ea7110d73befd4c7af999db6dafbcfd14285c4134aaf78d9ae06f1a
- SSDEEP 196608:iIfuoLiU815CM4m7XryUY1BFJTVR/SqOsI1AMvQ+4g1AEh1sQya4dk6bEEkxhVUK:iAuoLhuN4m771EBF1VR/S9sIXQ+4g1tV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.a657id60.app Framework service call android.app.IActivityManager.getRunningAppProcesses com.a657id60.app:pushcore - Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
flow ioc 15 alog.umeng.com - Queries information about active data network 1 TTPs 2 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.a657id60.app Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.a657id60.app:pushcore - Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.a657id60.app:pushcore Framework service call android.app.IActivityManager.registerReceiver com.a657id60.app - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.a657id60.app - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.a657id60.app
Processes
-
com.a657id60.app1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:5161
-
com.a657id60.app:pushcore1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5208
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.a657id60.app/databases/cc/cc.db
- Size 36KB
- SHA256 38f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f
- MD5 0908e924aa236931dc7166fef6e00862
- SHA1 7782648d6d8f6e835bd47058d4852932c096a467
- SHA512 3c16fbc5172aed04cd206e776c46d26e911732c6e3631536410a71f1d217449475727ac9b3175e827c5ce645a1da9e05900258ee6ca27c936a9060f241361dee
- SSDEEP 12:TL/sP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQ:TLd7sL7yot3BVrHotGGSgGQQQ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/cc/cc.db
- Size 36KB
- SHA256 abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40
- MD5 67c12933d1e0e63d9801a6aa43092ce7
- SHA1 b6936908554e4a1986b8eb08289e2d3545e8ff74
- SHA512 db8b818daa3ff4ec7678645f84bf8b45c809bcbb758ea78b28982d071572655bba2d20e6f1ca4f0d057ab34fa655c5bc40457dc65050180351a2fc04a47175dd
- SSDEEP 12:TLgRP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TLt7sL7yot3BVrHotGGSP/WQQ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
- Size 512B
- SHA256 57012e679769cf903bb72d01b4d995f1187691b2b220b730346a47a033e05feb
- MD5 16f36d5102be1a095ed4c9dad055636f
- SHA1 5af43490bdfaa6dada12d1c4f9c5d0ec91098bc3
- SHA512 612c60036aa6686800b967e058663a5159dcb6de12aadedba229b850dcb3e2d4fc56f9a7a3f8388ab62b34198dac6d2fbeb76f5e5225b9411e43727f010551e3
- MD5 SHA1 SHA512
- Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
- Size 8KB
- SHA256 e056aa8007046abcc55f3683d5256c0d85aeb8fde3108079a852bf0f5fbbbfac
- MD5 7eb49ef278aa0fbc75129c8ce162a72a
- SHA1 e8faf9e3a3856b697181996bead61d858cf75370
- SHA512 14a74ec5e298828cc52c0b63cdff3398cbf0d002fdeddbd15dd140e90ffe7253888b4e2a290d35a62dd874c3a0fb4ee327bc138d9be53185366d7b492413e32e
- SSDEEP 6:7+/l9zgn1zllng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKE:7+tspqLiuWdwRmBEyPb/
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
- Size 8KB
- SHA256 88bf949e5e1001c65c9375bf19d8c3ded29360dc21613836f61a5a50898704cb
- MD5 114bac93be0c2d49ef635b22893556f0
- SHA1 c1c1b17b0fc1ad075eb68ee0a8d06967394c44e2
- SHA512 722832dfbe628ebbed22bc96e25aae2c5e0a0d3466369dca38d7f707d71917f3e29bf5d7c920d23e24a0fbc654a32a8e7be25a2f0ea16965315740c10a9d3614
- SSDEEP 6:7+/l9agPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKiens//W:7+tvqLJdTRmBEyPbF4sXW
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
- Size 8KB
- SHA256 7bba4c9177663bccbbe1c9b1872d80a44beb8d5a66e2bfc4c3969fc4d60fc741
- MD5 0d6fdbc356067c8ac44963ea4bba08f8
- SHA1 2ef3b190f531498f54d746b4036a1467d4023a56
- SHA512 0f11abb117aee58461ba9ec62a7da7ddbb15c98506b72530fe3c7679c296f14a0158733e8033ca578b1100b2bbc80c50b226d9f780e205c278ed9a08a2686a5d
- SSDEEP 12:7+teDqL/sP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbm:7+teDqLd7sL7yot3BVrHotGGSm
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
- Size 8KB
- SHA256 45ab976bbf4235a5c928b967d9b53be4db148cf9c35e82edec571eab8623c5e6
- MD5 42e3639fc23d743b3cdf8c5f9d96065f
- SHA1 5345d480f054227765c5697874b0f8d625cb0c6a
- SHA512 97f4cd98514b2e5c302bbe320e0df69262f9a9c1ef410761ee7aa77537a79f410ac0f3fb4023bbb0cdc5e4486ee91aad88bf99316a335a499469b20b235a7104
- SSDEEP 12:7+tC4qL+/E6P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyu:7+tC4qLpr7sL7yot3BVrHotGGS6
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/cc/cc.db-journal
- Size 12KB
- SHA256 1abbf30f31a56eef5b60b436e3eb20acaf537dbc983f125725da240c259331b1
- MD5 e32779d28f2f96ba2573ca91724fa1b6
- SHA1 a8d133bce9b29a0370ed742b03bf0df4c738e5f5
- SHA512 76f77f6615f9ef0de7e1dfa4fb4665989e200882cb7664e5d255236227239f967de16484cc7d63f02b27560136ca1bcaf2e109c13718b7a617f56cd658b6cc96
- SSDEEP 12:7+tzImEwmRqLWEOVP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5B:7+tzIbqLEe7sL7yot3BVrHotGGSin
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/okgo_cache.db
- Size 24KB
- SHA256 5ae24fb1066c3cce8b38dc14561ef2c0db93cea43736c8547c4405a85d5019e6
- MD5 11ee249acccfdc43d6e5b6062cfa9c72
- SHA1 e9b758bf7735a76d1f93e1b9f5c65bcf351c89ea
- SHA512 2e86b7f843f38d782107b599743794517bd523b4b6e0aab2f065c3f3e8471ef6475a55de59f0b372c43ff65b7dc98391ba192f3e4c0f770d3506d80a5035f699
- SSDEEP 12:TLxKAsmLGN9aEWTSFbyeODV4VEasMl9hygvRmBEyPbD3OwG:TLxXsmyN9aEWMOxaEjSREGSzG
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/okgo_cache.db-journal
- Size 512B
- SHA256 bef61f03a6e5b64613d3d0f40a4d1eda2bf1f4d8c6092e5574e8bb1214014111
- MD5 5c442a0de36cb32b7c33fe4475c50531
- SHA1 b82ed8ec5fcce90b39beae2ddfc0390b495a2f7f
- SHA512 70430ff4863d9d5fb226806d8c967740d9a6a8af3dbb35c7008c679dbe679a83b7dd76d3d819737e2765eb3d81a376b66ea2808f1a37d43e3731ac6631335490
- MD5 SHA1 SHA512
- Path /data/data/com.a657id60.app/databases/okgo_cache.db-journal
- Size 8KB
- SHA256 e3378f61390156d1cd5b06fb11070087cf4a62a291a16ae19b89a39c21fa478c
- MD5 8d283eac03b2fb510ba137cd8f4796dd
- SHA1 042f982f014d6c239c47d5a6fcf7fde33b5da5e7
- SHA512 7a9b83f741543acc609ec72fee25892c45e0c6781a5a9e8039bc51f90cefb83bdf7b3a67bb8bad70cd0cf2cd5b482f38e68bbbc38bbf194aea125d229fb4307e
- SSDEEP 6:7+/l9DXSFn1xl/ng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKGT:7+thuqLiuWdwRmBEyPbTT
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/okgo_cache.db-journal
- Size 8KB
- SHA256 d4b4aa1eeb64cda756588a18e7e443eee11fd35d76fbed9771e1957b59966fa0
- MD5 1867c60208d83b9b8b4067c840fc6a8a
- SHA1 9dffad5932f646748753d257536da0b11df25907
- SHA512 c0c20fb6c6ad25cf8e689592bcd4c1003948ebaaa9f04f23de225950c2a24e8e02b705190483a060645321f270fa808d2991eb5fc59fb1cf2a82edd4cf784f35
- SSDEEP 6:7+/l9uOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKHC/2n:7+tbqLJdTRmBEyPbAS2
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/ua.db
- Size 16KB
- SHA256 5a8c0f65f0c4ff64615598c3395d1f985132419d9527a892bdce0bf5249d6a16
- MD5 5a673040280b2eaa564e872b20c2b201
- SHA1 4e4979b39af32c09a81b3e1db6fd6d6dc71b1510
- SHA512 9b99153250687815bff05dcda7c790ee1aba9091729cb32fcb0ba3a68bb12ce8af5468a7c93c2a57b68eb219697f323ae75b455d8511ffe0558a9cb85a9ec8a8
- SSDEEP 24:TLr4PPvP/BlmqygGSP/buOceW5nCNIHkaNbi2D:Tsvf8SP/buzv5CaH9hL
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/ua.db
- Size 32KB
- SHA256 fa5140568beb67357c0a441eb4decc9b64a015c2d7c4ea441d1cdc32057dc6d4
- MD5 d4aa9ece6328579081b1e15d1987d3fd
- SHA1 a2b5afe9c0ee7967336d55116f5d23335c453878
- SHA512 e018c93d36712de842cdd381fc58fd16acf8e975e89338080fae903b67a2224a8081e77318a89d906e9a5f3b3c596d66c9824ec4f5f169e8eaa52fa74d587a97
- SSDEEP 12:TLgiuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbP/WQ:TLb4PPvP/BlmqygGSP/WQ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/ua.db
- Size 32KB
- SHA256 6f909ef4c53be01c4c511617483eaaae2b59e87bb6dd352163a017b4b9f8f8a9
- MD5 650c21feceeec6c69692ce8ae9e25809
- SHA1 8e5f3a64cc36fb388abc3024d8a9fe09f72f7405
- SHA512 621585a57f2ad8cfbce7641f235c65223d54d9f2229c32054074d377bee2a4232812736e8cc77556ff1a72ede5f7f9b96b0f523a34e8daa9f8d64f1badd41f86
- SSDEEP 12:TLZEsuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbV/OwQo+p48zLOz6PP:TL6K4PPvP/BlmqygGSZQo63O4P
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/ua.db-journal
- Size 8KB
- SHA256 d32f0c9eec707e308275e2daa1e98e3356edf5b5d454030fc1fa00e1a99d3b33
- MD5 44da20f84792535915e0f75b5e08a1b0
- SHA1 df44ca682fbe37e1bf3953a04b90d3eb40e4a02f
- SHA512 883ee138a1d630d20b43cffabec733ee18d4dce773d7130ba1357c634b0857e23b8c109e334c50f55b11f73f8919ce8cf9c1ba80e9479188cf803740649e594a
- SSDEEP 6:7+/l9d4n1mSpg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKa:7+tkpqLiuWdwRmBEyPbp
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/ua.db-journal
- Size 8KB
- SHA256 16eed9f79d0eb89f4a0b6eff4385df46b41a5240d44df0d3d08bdb27ba13d0e0
- MD5 88f536e2e91960988875ff2db03b66fe
- SHA1 bb3ad6f6251a22d4ce40f7b650d1e93e4600dddb
- SHA512 fc1675fef178aa54b79030b96b5fab57f8021ddf07e9e0c33bffc59c3eaaa16bf83c84a553b86d6fed2096f5c06c630b3d690ca328e930bfe5dc6f69acba0763
- SSDEEP 6:7+/l9jZGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK45i/N:7+tBcqLJdTRmBEyPbTyN
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/ua.db-journal
- Size 16KB
- SHA256 fc52ef91a8ee1bbe0985b905d7392dcf216027d4aba6a5e2d35ab0314d4d51c8
- MD5 0eb654b58cbdebfaf0f54d72531eb824
- SHA1 822bac416104ffdd6b7d5671eca7fdfdc82beace
- SHA512 dc270bbdf5cdf602ff4a2009fc3b861419904e861e45e85a96728e26f67a7b0bac61a5d9b943537ce46e9d58d97a42c337439a4169c5dcdbc1faf84cf10b820a
- SSDEEP 12:7+t7JOqLseuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPb1:7+tMqLb4PPvP/BlmqygGS1
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/ua.db-journal
- Size 8KB
- SHA256 c94c83da43ff85531916898a58cdf6b07b03a8fa36c96046d322ae600c48b238
- MD5 bef641bddde3d232f538f948400aadc1
- SHA1 0d2d7e405d5accbb524cdea34471894cbfa27b5b
- SHA512 3f7a9c6b80fd5a422e03b1124710a71fec1efc2b56db47fa69e3c79a7fe56df53860c1b4fca05b78bbee1682e17d3b12b604a9c89e5e1f6fadfcdff0c3b4720d
- SSDEEP 12:7+t1xo+p48fpqLZEsuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPbz:7+tLo6fpqL6K4PPvP/BlmqygGSz
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/ua.db-journal
- Size 12KB
- SHA256 ddb7518bca748c9f3e74af1b8cc040dda81f2828778bfabf8d84b59ad9be23f5
- MD5 777f0acdf07bef673d897e8ad30e113d
- SHA1 14a8313f8bfbfa935d5e44206c161c251ad3cf27
- SHA512 94892a37582e7a7f8a6168613c2808b78dea932f8fe037654e15ff20291c5b2052af8ad205943fd943e1ac649929afb4b4a6da3566eb89d6762054c4485aea3d
- SSDEEP 12:7+tKYxRRqLzNuOIo4PPTN5PPJhBlTSF7VfqwtI7MJPRmBEyPb3:7+tK8qLr4PPvP/BlmqygGS3
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.a657id60.app/databases/ua.db-journal
- Size 512B
- SHA256 3af19f0ebbda8070d88c6348a1194eef9228ee259db0495b6ce063b516a634c5
- MD5 d3f3d76f62929c9785885f4c8f90671e
- SHA1 bd79ba1ea841101dd513c9d23f29c89484f8033f
- SHA512 c98c5d2d2dd92114a1887a0303014f028c7c7293c47c1cef8ee70c13c312c177c0b5f758a786aa71766f4bae9aa8e4c1062cafb8da0f3eedea6b231160f843d7
- MD5 SHA1 SHA512
- Path /data/data/com.a657id60.app/files/.um/um_cache_1718274389218.env
- Size 1KB
- SHA256 d6d114707d7bcc2b37ae62b153bcd395808aa3c90ad308d1728669aff0ba0eed
- MD5 08e2621d5c6a6cc2dc2add9f90d34a0c
- SHA1 7a1979d4b929009195335f016a31bf559a1da695
- SHA512 d45310d3d03bc39179120b20985f20b99643a36d3271f3edcd830c327c1ce9a5297ef583618f81d2d545a31a1579a0641d8aaf56f8217c774e13f283c230ce17
- MD5 SHA1 SHA512
- Path /data/data/com.a657id60.app/files/.umeng/exchangeIdentity.json
- Size 162B
- SHA256 4e5659cd96caa991e44fa29bb1453109ce7a07248c22f21ae9805ba730367206
- MD5 1d72fde777773e2a88f2b401e7c90672
- SHA1 e411c3063a842d08b5fc5abf7358cd030c9e0b7f
- SHA512 50cb5e710775a51bcf51f3ce340901f73fe04fcb28aa6a3163ad8ac0fdeb0f71eefe6c39163e5901b9d76856d5674f13a075ce605669c2943660ec7373dbca4e
- MD5 SHA1 SHA512
- Path /data/data/com.a657id60.app/files/exid.dat
- Size 57B
- SHA256 6423d0ea04594c4ac273d14511c8b1ad75633177e1cff2a2b84252e711f16a3a
- MD5 27e398fd39b567ad0b00ea750929b85e
- SHA1 d51f55540f00a0199d246a4e585c71c97b8048e6
- SHA512 371147248ca2b71408416792fc72800915d97bec549bc5e276e42e3ec572664fe18ad4bd58cdca65276207b6b2eaee12e786f00801357417adabc4bbde1ea552
- MD5 SHA1 SHA512
- Path /data/data/com.a657id60.app/files/jpush_stat_cache.json
- Size 126B
- SHA256 d402e34e53fa4f051c188bb09786cc625ca4c442dd8389347e8846149569eb75
- MD5 6aaf388e9f95aa5ded5b33a779ad82f1
- SHA1 078f2f20fe0f2c9c2e516c71134d66f60f834402
- SHA512 c0f73e8a1c3c9e8d2737bd434f1d6f12145b4b017fb9bedd0314d141a8843ebcb56a0dd4b383898b622466ef90c772d79a99673a33f4c8a63c80acda2271f330
- MD5 SHA1 SHA512
- Path /data/data/com.a657id60.app/files/umeng_it.cache
- Size 350B
- SHA256 b269cb803e80f786161285edeb616030455f7e72f228e40d3664cf43ff754b54
- MD5 ec9164321c009b0770b6cf0377a52481
- SHA1 7cb6ebf592438c2468cf670e1958a5539df02884
- SHA512 0ab274bff2447e131b95a41a8af0887393c674eaf2880c1062b5edf334de1a6dd2d80de7c9a9e0834cb8602595aaee5fd9a6a412d41a3e64ff9fa20d303a295b
- MD5 SHA1 SHA512
- Path /storage/emulated/0/data/.push_deviceid
- Size 32B
- SHA256 ea9c640711fc8482f098505b86b85a7ee430f58a8d0eb4bb36af943091227ebe
- MD5 b5e43ba99184da13d74c5b1769094f07
- SHA1 bc89b7021f7d76f00c464d6174ae20cc3c39a4a7
- SHA512 cbca6729f8627f2a66ca9391879cb541a29402bc4359ac410ef152d1bc77453721f6dd51ef7f519375aab64bf6dc412bf1dc186ffd089fddc094b254377466f7
- MD5 SHA1 SHA512
- Path /storage/emulated/0/data/.push_deviceid
- Size 32B
- SHA256 1ea977071500c00cab516146851df7636e97f13de525296b5718c9a15ad4822e
- MD5 d4e541249091206c2e7d0d7cedb8f9c4
- SHA1 0ab6f36a6b987cad6c35dc776dbec8e0a5c63a01
- SHA512 6e52555ac33109f7854253f49c46c02311abbeba5449421c2c6383f0bb7fb72d0388bd7c82724cba3092c60f7027ca1dc9953535b9d5f308d4cc19230e0411f3
- MD5 SHA1 SHA512