f625d8b979df52b5b915bda31316a5af44120a5498cb82a3fb5c7fbaf34069db

Analysis

max time kernel
161s
max time network
171s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
14/06/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a806c4e2d434c29a9fb81f909c7da6c4_JaffaCakes118.apk
Size 15.2MB
Sample240614-e9jefsyhnr
SHA256 f625d8b979df52b5b915bda31316a5af44120a5498cb82a3fb5c7fbaf34069db
MD5 a806c4e2d434c29a9fb81f909c7da6c4
SHA1 fe6be5b791df2e2f02230a60f450cdf2acb94697
SHA512 cb7fb85b8294a76bf9a38914819164110bd21ba3f242fd7cfbed242ab688f5d4b955a91791ec3c143d089fab93a9b73e412f320b76d3f884d6ed60c49cce965b
SSDEEP 196608:tEMHsA0ankJUnaza7Nh5zoyHijGjZy8fhwWbTw5MM63zGaVBLnMPLM63zGaVBLnw:VNkgR0Yvyiw8SvHaX2IHaXNGTZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery impact

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ms.chebixia.shop
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ms.chebixia.shop:ipc
Framework service call	android.app.IActivityManager.getRunningAppProcesses	io.rong.push

Acquires the wake lock 2 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ms.chebixia.shop
Framework service call	android.os.IPowerManager.acquireWakeLock	io.rong.push

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
32	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ms.chebixia.shop
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.rong.push

Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ms.chebixia.shop:ipc
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ms.chebixia.shop
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	io.rong.push

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ms.chebixia.shop

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ms.chebixia.shop

com.ms.chebixia.shop
1⤵
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4695

com.ms.chebixia.shop:ipc
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
PID:4741

io.rong.push
1⤵
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4803

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/user/0/com.ms.chebixia.shop/cache/uil-images/journal.tmp
Size 20KB
SHA256 35a6f2264a89f19f5d02443f1f1a7bdf71d2a787582d39ad7bafe2e0e5c190d4
MD5 0d350e5298ed4da85adac1e05da80d48
SHA1 1f023b24942bac08e89ee7cf3d48917b73ce7ff2
SHA512 0b7144e5d7003a6f1a8393d4751328a62d228e13a06a478ca68f533215a131598decee4c47ed989a94840d8b3274472e8402b0822dfc4ed5db547c2d099e4881
SSDEEP 96:7Hhd52mUn8kigv0fjz0atYXM///m/mkklm:7HJjUzuUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

rong_version

Path /data/user/0/com.ms.chebixia.shop/databases/rong_version
Size 28KB
SHA256 c8c4a79f48fb9f6f8ccc984621d25b485e5b95578628566f6aafdeb9d0367b68
MD5 d1e1e9e0dc7cc773ae2e325725dbcb1f
SHA1 ad0c4a7dadcecb72762b43e3165702c74307b668
SHA512 47d21f2f0d72d2df5f84110e7570c408990671b7a59b64ec28dbe94c8e19d27a81da40eabe47d4bffcd634dddbbb0a4e714f7a15f8ffb09c2dbaada83403a499
SSDEEP 96:Zn8kigv0fjz0atYXM///m/mkklPl2zYvVun:ZzuU4lGH
MD5 SHA1 SHA512 SSDEEP

Submit Download

rong_version

Path /data/user/0/com.ms.chebixia.shop/databases/rong_version
Size 28KB
SHA256 b8e5749456711bb6d3a317dbaa1a3d0357a439402d90baa825be83a6d2948112
MD5 0a3e9683a5aad1598ce00e11d99f70fd
SHA1 0d7735ad6ae5086cfae17f979af6dcd5b010dd74
SHA512 0cb03d3523738f361171f50beb4d5e376ad247b670bbda3b2cdde1226d41b672e42cb2e9577bbd11d1ad648867e05bff098f78717b8f5e51bc871c54bcc736e8
SSDEEP 48:Togn8kigvjQfjz0atYXIr///m/mkkkSM2zKn:Jn8kigv0fjz0atYXM///m/mkklM2zKn
MD5 SHA1 SHA512 SSDEEP

Submit Download

rong_version-journal

Path /data/user/0/com.ms.chebixia.shop/databases/rong_version-journal
Size 8KB
SHA256 18e6cf066b1c08c8e858716702f0609dd637c97b3a64286405fe814e935b697f
MD5 d2f3a626e1f66845e26e1c16bc680e77
SHA1 7dd169dd546e8e00af0cc5f4322acdd56eb690b7
SHA512 87d82b8894a787fc809c9c99c3b62b466b8ea7157297bbdb8daff0feb0b978ddef0e7dd9060de9de4a2ce59b99276721caab5e73a77746d4381c314bcb18cfbb
SSDEEP 6:7+/l9d0FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKgGt/tn:7+teqLJdeWRmBEyPbrG1t
MD5 SHA1 SHA512 SSDEEP

Submit Download

rong_version-journal

Path /data/user/0/com.ms.chebixia.shop/databases/rong_version-journal
Size 20KB
SHA256 188b604fd68fc7a5577d70cd0af9ed13d9e154f3fbeb8143db82f3a28e301130
MD5 63019116a53429d1bf0e4b91ead0c4c6
SHA1 34cbf0414e8454b3bd33ce30eccd2a233360c19c
SHA512 047877acf283f5180db95fb1603b82bffd04541dc82c4e519be1637e5c329c848c3147c591f5f721bbe824e232d66f3262b9f0b05dec6376456b56d308848ce1
SSDEEP 96:7rhrwIRkn8kigv0fjz0atYXM///m/mkklD:7PkzuUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

rong_version-journal

Path /data/user/0/com.ms.chebixia.shop/databases/rong_version-journal
Size 512B
SHA256 665e1dddaa33c435d257bef469bbe3bbbba82190a0c9198294da7e5a1e906428
MD5 95680ed5d8701d92da75a46a77c07a8f
SHA1 e5b69b5038bd469c6f1708a7dc8f9bda9b905d99
SHA512 1d5b4f18da8d19b456a5b3a1f0b0df8a1522e411e65f31037813ea739c94024b29bf70b492652e7e5aaaf167698ce82df0fcada75891c89189025ff4a699d6d5
MD5 SHA1 SHA512

Submit Download

rong_version-journal

Path /data/user/0/com.ms.chebixia.shop/databases/rong_version-journal
Size 8KB
SHA256 b931724858222dcbce4c04296f13737ec746286cdad50c0c0bc2f36679eb871b
MD5 ac9a0fa65dfc5e9ba8d927c33b3dd42c
SHA1 e19cddda4d77f150145c2fd13201178e6eb00747
SHA512 65ad730a6f4bfb1a35b0396763284b4a412312e27f59c6b08e23420c8aa024a29cf03155728ffd4c4b9f5d94127cf93d45fe7410d3bd83057e40631ca4a03b95
SSDEEP 6:7+/l9vrl4n1tg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK0r:7+tNKqLiuWdYRmBEyPbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/user/0/com.ms.chebixia.shop/files/.imprint
Size 831B
SHA256 cf0f71daa219b0d6b10eb79c6a976ed6e39c02bc562284cc6cab67caca3ebc5b
MD5 9831188b3cbfa927580e9b49228f25a6
SHA1 c267f276e6b728d61109244d4e885b621440420e
SHA512 2cb9841f016d84b004d55e066d568ee94a5bb10845a5a8866b3605fd1cd5b7969f07200424b102bd417615421c85b402bf69937e1ca9dde576ef4ef662f1a84d
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.ms.chebixia.shop/files/umeng_it.cache
Size 328B
SHA256 7246d2e1c670835811ebf614e327ee3b328380d3c2f3b457c760d91a1d97db39
MD5 1bf5bedc7b70aefd24ef76d75ba4c640
SHA1 e808343f08b8af26e0790a1a5298b835bef9be01
SHA512 56389a73f1d977eb4acd8557f730d4fc86fa80d2f941946a18bc294291d4957fc2b324953e9556dcbec3b1f91b5a8a89d8d6222a94f0d2757ca51769c7e36058
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.ms.chebixia.shop/files/umeng_it.cache
Size 167B
SHA256 871f5a7e2954dc3e4bda6a623f5275dbfe03806f6ce6f312bc2031e6798b825a
MD5 85f8be5c248178c973c1262a0aca4e3e
SHA1 9cb558f1b5d66db0f8452c24a85b69d476cdac90
SHA512 2de52eea2218fae764843836635d9dbfdc81f060a62947367dc1608912e22bdbf6549f6fe1687ef655ebd57c61066ea99cf1bd425d04061e5bca19341e950754
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 3c5a4600fafc58f1cda4b394211334a50194a2c7d5cab8691b6b91d21b8b8ef3
MD5 08827831fc7c14f71fde48d5cf152d6d
SHA1 60eb66383244e4a4626273b01901ca5242451782
SHA512 9c3425f76f54dfd469699be1036aef30e0139f0e1862a17874d1911c035e2fc2672da6780b6f74140f3c849832deb2d916e4a2fc779c4116f729cf6ecf2e65b5
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 6e3aa4c9cb390b299a4ea91ec17638bf2e2db5722ce83474161bf452aff5ef66
MD5 2c42bf96ae590e482d3b035af014b75d
SHA1 b53a3207a29c962f141deefff8dd6b19bfa78232
SHA512 313fde29a92edcf84a277313e86a8768f82635fd9631887ea718bf10a2795a2403fce29f6c481562548e9020b41670bddfb417112aaf0d3ac791dfe327c8d013
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 408B
SHA256 ecbf961ce312ee8756bb84a6de14cb10f3a5814069e333b5424610be1af769d9
MD5 046efc91bcc0faf66940fb10d8621354
SHA1 f32fc4f41d9982a2c2d252a15a8379fdbcc469a8
SHA512 3517d1362886471b3a06d42a53027affb0199ed961f9abc6c00e7e639b070defff324948cf98ee91186f1ce2e7d4e6fe5ed9286f8e37705eb4238db1b7dacb5e
MD5 SHA1 SHA512

Submit Download

journal.tmp (deleted)

Path /storage/emulated/0/Android/data/com.ms.chebixia.shop/cache/kit/journal.tmp (deleted)
Size 31B
SHA256 fddce724f39edc9ae1df4f8920e512cfd0fe3a9017b32031f1ca0e9ec06a1150
MD5 8c8bcb7d36cb5a71729c00c4e7f2d330
SHA1 a352667c61dc45f43cae74a7102fa692fba98d3e
SHA512 4589f9c835a12ddaa04617822b93aba809aa85b392dc8596d47368a31648c542a0eb96643ca3a8d21d31aa1a790580a3258afdc3d202d31c5a324a4b591ccb62
MD5 SHA1 SHA512

Submit Download

journal.tmp (deleted)

Path /storage/emulated/0/Android/data/com.ms.chebixia.shop/cache/uil-images/journal.tmp (deleted)
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads