Overview

overview

7

Static

static

6

a73fc71559...18.apk

android-9-x86

7

Analysis

  • max time kernel
    179s
  • max time network
    159s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    14-06-2024 00:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a73fc71559231d3250a4cfbbc8404879_JaffaCakes118.apk

  • Size

    1.3MB

  • MD5

    a73fc71559231d3250a4cfbbc8404879

  • SHA1

    18f30de62419913eea04c0e9e5d273acd83d6f3b

  • SHA256

    a0d3f353e6cf1abfdfbb6ec9c743ecb5a333830878274ce77bf0668006966cf1

  • SHA512

    7620235360821de0699fcc7f0adb5c23c772266726f3b6eddbacdbd85024e359057fd17e5ed43d97d2b8b291223c24b5b25f5c8389a463d64a376d61dd64619a

  • SSDEEP

    24576:ZcdXNudGXwzyFxOWF3WOpFiiOpF5OpFziPtu92MQ77tQEgMPbfNOnYykuc6L:OddudUsNOpFjOpF5OpFzidVgMPblOnO0

Score
7/10
discoveryevasionimpactpersistence

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.adeskring.music
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4298
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.adeskring.music/app_qzn/classes.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.adeskring.music/app_qzn/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4338

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.adeskring.music/app_qzn/classes.jar
    Filesize

    71KB

    MD5

    e00216c55d3ad107df8229aa1c503d3c

    SHA1

    9214285f38be233ae64748acb0e7dc71f5a17b5f

    SHA256

    7f3c75c75fb2a5e2357b70ea435f186289ca710582e2356a6b3ae58962cd4e17

    SHA512

    62e8c09f423585d6801b019adb84f8d25e7d827b01802fee222647afb4ad7ea835e20013d67e12f89d12ec856cd63221077308af66ee7d0c8012c0383bea38d2

    Download Submit
  • /data/data/com.adeskring.music/app_qzn/oat/classes.jar.cur.prof
    Filesize

    240B

    MD5

    d0bc196a4daf1c62d4242d0cc8d443bf

    SHA1

    0453af42680aef2cdb8805ad42e10eb5083d3fc1

    SHA256

    ffb1607c85b60548ddea3413bdef8b063c0ae77f635c3ab5789f49a83a1a3ef8

    SHA512

    9135c0cc92f5983eb7573e40e6e08dae9f021bc3153202a7b76a368f8138e7bbd6e722e7578fa556dfe0c0ea257a5c3521e532e249866624abda41a081f0f5f5

    Download Submit
  • /data/data/com.adeskring.music/databases/dbkhq
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit
  • /data/data/com.adeskring.music/databases/dbkhq-journal
    Filesize

    512B

    MD5

    f1e9e79de55bbf4cab83bfd04039abc6

    SHA1

    cef3b4e4b161edc997f462e346405418bd180809

    SHA256

    ea15b86a4ac37615cccf3730fc84e2ff1769a5920b751afbcdffc5c64cb3ab3f

    SHA512

    fb568ce3d773db8e0d078a86fa368e64d6ea6a5096932b3228584eab83ceab832350961441813596696a577e365c5be14c2049fe7f120f38e6d652051493eef9

    Download Submit
  • /data/data/com.adeskring.music/databases/dbkhq-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit
  • /data/data/com.adeskring.music/databases/dbkhq-wal
    Filesize

    185KB

    MD5

    e15c8bfd9cfedeb5d5027931c1f9ee82

    SHA1

    cb18c64079183cea9aa4298c25e3b9494f07d33f

    SHA256

    6ea346ae1013439a5d768c15406a3b46aecdf1d843dcd59705e42fe596a2f543

    SHA512

    92d7c181e8b76dcd7c0e6ccd96c1bd5adb6d1b07d2a1994d0c8f70899de4811fb6a0be6019047026bf2170296e1ae6f1378045f9f11da55423b267ebe47ce7e3

    Download Submit
  • /data/data/com.adeskring.music/files/mobclick_agent_cached_com.adeskring.music
    Filesize

    196B

    MD5

    95dcb9104de77665f9c52217957f948d

    SHA1

    4c07d41bb21a2c374ebb1bcc4bb9286a9abdd824

    SHA256

    2d21bf949cfc5ae01c163be952327f5ac79078b18b5e022b7a096847ccb6c2a0

    SHA512

    0ee789b3c741e8b96521e3d1514f88baa44cf5bcc0023254a89c40d1c75e4bdb78dc8ee21af486533328f70fcf5582ff2e6f5c2cfc0def6cef61d3100de9541c

    Download Submit
  • /data/user/0/com.adeskring.music/app_qzn/classes.jar
    Filesize

    167KB

    MD5

    eb7488268bb1aed418f246e0129c68e6

    SHA1

    961ed5baaf5062ca6f326b7fe869085f5031897c

    SHA256

    bcbb9af6914ac534d5025e0ecb1f8540949e9b29ce42490d88982d0a9681f02c

    SHA512

    55ee61bbb02b19f9b6c14e27b3c1a4ece1bbd5f88301905abe0ee013ece3357c2596f87005f2092ffc52946e87fc9be18386fdc3bfcc119fc3ddbf334f1a6e72

    Download Submit
  • /data/user/0/com.adeskring.music/app_qzn/classes.jar
    Filesize

    167KB

    MD5

    3bc76749438e0d16cbb1534249f043f7

    SHA1

    f8792c1fdf7de0291b6f45861350e4359cd40b65

    SHA256

    f2a4f45a4ad20d2dea423c82bf5202d242620ce24d9a443dfd615df6668258f1

    SHA512

    2693907cfb8f711897ccbb265279b70bf0625eaa9fefc896e03fac964a93f5cf7014274e7023d51ef4c72e770f1326f3d8d8c1954537fc93ce0bfb54f6198e96

    Download Submit
  • /storage/emulated/0/adesk-rings/.cache/journal.tmp
    Filesize

    31B

    MD5

    8c92de9ce46d41a22f3b20f77404cc1d

    SHA1

    8671a6dca00edb72be47363a7071be65cf270373

    SHA256

    68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

    SHA512

    30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

    Download Submit