4edf2dc78ef28d79f46c9eb8893a214ff8f67db3190441ee2048fe5212fa2894

General

Target
a5761f88fb6db0cb5ea8d11e55be2df1_JaffaCakes118.apk
Size 2.9MB
Sample240613-pbq2rasbrk
SHA256 4edf2dc78ef28d79f46c9eb8893a214ff8f67db3190441ee2048fe5212fa2894
MD5 a5761f88fb6db0cb5ea8d11e55be2df1
SHA1 4e464dea406eaada1a67f2dd4f097f0ca281bc2c
SHA512 ad5245c6ad5bb1cad286144105c9f61ed1d49f06a694c4f7d8ca3a73f2098a8f4e21610e178cfde862f5a584849f0e1915d7d0217fba69189ef99f3bf6749945
SSDEEP 49152:DVwLzP/WvFynytOunE5H2A1ZVolAwKjO19alkVh8bTfPTKcg6ZRpQmh537RrDiyQ:ZUzP8FyniOuaHN1/CJ1arjP3RpQm737u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.xiaobaifile.xbpush

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
4	alog.umeng.com

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.xiaobaifile.xbpush

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xiaobaifile.wx
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xiaobaifile.xbpush

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xiaobaifile.wx
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xiaobaifile.xbpush

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xiaobaifile.xbpush

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xiaobaifile.wx

com.xiaobaifile.wx
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:5009

com.xiaobaifile.xbpush
1⤵
- Queries information about the current nearby Wi-Fi networks
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
PID:5066

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

System Information Discovery

1

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

3

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

.imprint

Path /data/data/com.xiaobaifile.wx/files/.imprint
Size 833B
SHA256 f03715079fec8ef0b1c4729305b03ae526d903d8f2821bb8828d534152e4d29c
MD5 f54f35fc6949178c81b359ed56c8a05c
SHA1 28475cd1d6bd9e835aaf87c571538e7e158cb3c8
SHA512 7cd4f9e2c028c3b3810077af8bd4beb26c24303a1682d0f1bc622063e7b0dbd6d9e2aae603a27dcf879adf06e404c5c8b4a9fc9e2d7b39cd82b092223c91b350
MD5 SHA1 SHA512

Submit Download

4e4688bf76__local_stat_cache.json

Path /data/data/com.xiaobaifile.wx/files/4e4688bf76__local_stat_cache.json
Size 25B
SHA256 c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
MD5 2d805b13f2f28dc3ca9bbcc000f49bb5
SHA1 9eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA512 5db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.xiaobaifile.wx/files/umeng_it.cache
Size 245B
SHA256 59733c700225fe0e832258f8500f1723dfbd57481e52d2df8fe22a67ee385f9b
MD5 230b161a9e12201444451d0caea898ae
SHA1 5e2cdd20c994966ce65f08cc9cf7edf14b9fa69f
SHA512 2871d28c78b6775b62f09dec71705f9636985d7233c5d0d631ee7f24af63a5a25c3a5b7113fc8383093bb8dcc21958b67c784430d06f3ca5ef8672fd789faac1
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.xiaobaifile.wx/files/umeng_it.cache
Size 125B
SHA256 c00ad3f34b59f9a404f5be547f43fb7b083c5533748fbdae9a8fa077aecfd549
MD5 eabbe9c010295c6a7c6d091c9633bec0
SHA1 4a34e68a841ca87b8732be333721ecf35fda0ba2
SHA512 72354876e2f5fe64f17d31a51bf88adc2085d39f34c9b6abd86b69b7d4413ed9cfa36e5162e34fbdd31c4779800a0b9eb07ed9a394be78cd8b179a36cb24a917
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /storage/emulated/0/Android/data/com.xiaobaifile.wx/cache/uil-images/journal.tmp
Size 94B
SHA256 cb49e8ba3753e55f320196d02e388ebe90429fa82626b87c9066455433b6d8da
MD5 8679bf0516317016fa85177e3674fb88
SHA1 ef5deee9a613422b57d927e075b06c814647ed8d
SHA512 256d46d3dc648ab54d20234b2960e26eb380884d024b31ce9c10bff0a6310d596fc69f2a452531d8cba628a66c431d40888c3ab29bd297eb61c6f4bdb4109fff
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads