f17e3f37628fcf6d1806d27f3dac8f3c5811dfb54293be48b17ba1b002476e73

Analysis

max time kernel
161s
max time network
131s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
14/06/2024, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7e40451a755498dad0ef38c3b9bbcb8_JaffaCakes118.apk
Size 2.8MB
Sample240614-d9j6batfpf
SHA256 f17e3f37628fcf6d1806d27f3dac8f3c5811dfb54293be48b17ba1b002476e73
MD5 a7e40451a755498dad0ef38c3b9bbcb8
SHA1 e8e9d33869a339304150cd405c1dab07ae3ade09
SHA512 3e63decea0cc2a92c005762a96d0c1aba551a6f4bcad3e3697000d94a777a3302cf83a248e12ca3fb0598d51707afd63a4aab7140f703ff2b2f9cde0bfdfb551
SSDEEP 49152:vUo5r6Ka5Nhcv3ocuW4XLbmYZlsCtF1dI4t5U0m33X5vlZFAIQ6s:8Wmlcv4c33Czft5URHfZFAIRs
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.chanyouji.birth:push

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
11	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.chanyouji.birth
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.chanyouji.birth:push

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.chanyouji.birth
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.chanyouji.birth:push

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.chanyouji.birth

com.chanyouji.birth
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:5015

com.chanyouji.birth:push
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:5125

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.imprint

Path /data/data/com.chanyouji.birth/files/.imprint
Size 842B
SHA256 7a3f777cd6617bed6b5fa07c41313a70c06ef0a192453d0abf506c38f9ebfe6c
MD5 6f993ae3a54e4634336f3a99f7a2703d
SHA1 cb28d5d3a912ea79a33724248077f00a654622e7
SHA512 101a5adb01d5f1cddf0f637b025698bc28e19e08c462545dad49dbd5ac80bc932b7f3ff4dff9f4cbb850a4db90327af5854264c4b414468b8a4c13b094747915
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.chanyouji.birth/files/umeng_it.cache
Size 167B
SHA256 f769de8db96e94533b79f595f798df6d76db11254f5d6717a6b9e691de00c9e2
MD5 c4af8e3f35d64d8c8c1aa228dbdcdf26
SHA1 be1335784eb0b40e33688ca21a2e0bddd5139fae
SHA512 570d194e68d390cd842ba88c8454c7de1cec77b9d404ad45e9728e6b02603013003ebeea1f6ff3d939cb19b4c88ace21ebe68c31f5351cb99cc523f4b0fc2862
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.chanyouji.birth/files/umeng_it.cache
Size 328B
SHA256 da31282f567fc1cc4af169f9b16630bf50430fe4ae7c406a113ff1b7bb26cc0f
MD5 d84930c4509534e2b3130e1c0847054d
SHA1 eb305cc14cb8fc70c44ef01c72b915821507cedf
SHA512 aa4b0329686e91dc0e798b58a798aedb028829a10c246933b14e706015ba7c3b22f3b7260c24fc1a06ba03d6b1f3cac2cfbbf4dcabaa03fe614d5a99c3e48b5e
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 ed87e6ce5fee860fc3102aeec0ba10e299d2f6d7473dbcbaf40d05ca0dc3aea2
MD5 fbfbf6b48c67584225bb163731241e6e
SHA1 34f0aa5171f5084de5136f7af70a348e4d9256d8
SHA512 32077df63ab57d4e68263f4c430f1044c230f64a15574abbd5ecba27de2174490890b908dc6fafe9fd764dfc1881499f2ce64ab453ad35b62c86e70144b192bf
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 408B
SHA256 4ab07da243c32c87daa620bbc194fa2d4f456125c64f25ca33bcee7878cd9787
MD5 bcee244ffcbbbd79615c96f6615737ee
SHA1 5f2677eeda1e4e3feab073abd3c6b4aed0479670
SHA512 d2e8666f8c9b9ab20b463f9963dd44ba00a323185fb1b9ebda7c3989364d9ac6bf78a3c75c6ccb9aaa6f596800aa0e5be0fc35f425daed3fd431fe2968b7ee54
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 1KB
SHA256 6f60e3089de05bf75778ad79913e8b87fd404d5dcfd83c98a81a4612de65a12f
MD5 808e7c6cacab98d654c10bfde042d416
SHA1 06321de8ccdb476f0287b615e0bbbb4d797ea9a6
SHA512 dc46d1d02d37fe5306ee570e9eebec2b618b42c146cd2cdfa259fe5d9f67c7fccfe30a385ee6222028e8240e0a1a23e6657f868a686e1fca5aee7e4da368a580
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 408B
SHA256 0e1f0c4eeadca056b606af619444ad81d7517019c8dce1958491df840a1323a1
MD5 b8bf03c4030814602c49bd107414bd4f
SHA1 3f673fc42431bc09d5f8a8a324681a482e82f142
SHA512 aad8e936a82e11b24325aac1885fffb81e95ec674a51b0bff98e8baca11d35bf494dd432e2e93fde8267eaa31adc4efa3886d608c4552c3d43867a6491442c37
MD5 SHA1 SHA512

Submit Download

-20771730451899283772

Path /storage/emulated/0/com.chanyouji.birth/volley/-20771730451899283772
Size 15KB
SHA256 80fda7be949eaf9c7802fc149579a6beb8aa2156c2707273d74696918baf2092
MD5 f0cc958f38263d89c1feb4abfd6b1252
SHA1 da498df8a3f61265ad780740dd079aa1dc1bf3c9
SHA512 b93de460a9f89424362059e4329ee56344a708955a08a0af6885763be072387410dda9e4ea82caefabff9f6ae1a0ca4d3c52133f3c7e23b6a84c43274571c687
SSDEEP 384:M0iaiKYoHF4Rnd8pcC9S6vNB0S2A26EHeDCtkGarTuUIX9w9o/pik1SvyDJ:M0iaiQq/cwuEHSCtkGarTuUIb/wk1Sve
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads