7f09cf0c2937db58fcf91d1d7bcae7d18aa8807a43f5e9bd721f45435a560e6a

Analysis

max time kernel
12s
max time network
188s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
14/06/2024, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a87ec6a33d2d0bd534eb7c4c66d1c4e8_JaffaCakes118.apk
Size 2.8MB
Sample240614-h57g9stdnp
SHA256 7f09cf0c2937db58fcf91d1d7bcae7d18aa8807a43f5e9bd721f45435a560e6a
MD5 a87ec6a33d2d0bd534eb7c4c66d1c4e8
SHA1 582b456c2a43a6c1ca8b0bfbf79dae581ead277a
SHA512 b09bc2618cf178ffe01484093b4c432305ebd0d990d45f30d96601274162b478c2350b6d0d0448d10881baef68db614f48f7bcef9956a4f694f8a1ec94788a63
SSDEEP 49152:hIiE7wWpZc08dwbVMjAKG+6V2F71C5bCZaqOEMYLmeM4CDKhPuykxyJWiNuCk61:67we/RVEXG+6k1C54aRVYLBjCWhPuzy1
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery impact

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
21	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.east2d.everyimage

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.east2d.everyimage

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.east2d.everyimage

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.east2d.everyimage

com.east2d.everyimage
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4566

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

__local_except_cache.json

Path /data/user/0/com.east2d.everyimage/files/__local_except_cache.json
Size 408B
SHA256 4174bbaaae1a5016ad667e375212cfb71205284be7e6864e85ae766e99557626
MD5 3c401a4a60c3223e01ca2e997c938912
SHA1 7bb8dba9d9ed3013388d3ec41f106d707b7dfa71
SHA512 e15627453acd974177b4b20cf0e78741aa054d47ab142c229806356469125491b9c6a969a0cd1a9b8ec1e30f237db137018a7a4cf75117a4841d65ae9f72eb01
MD5 SHA1 SHA512

Submit Download

__local_last_session.json

Path /data/user/0/com.east2d.everyimage/files/__local_last_session.json
Size 107B
SHA256 f129ffd9e9bfc15c6a201e14eeb8ce44d6b7cde95b1e0791694d409e05c808bc
MD5 4fcaf853e2af4e21b34777797ef08d95
SHA1 c2bd62ab086229c3fad237bc7fcd3886916b1c67
SHA512 deb094ea72e0db28150e89da77ab4e415bc8221b75cee9592c682febfb1ccb84ad216a87f1d4e6f87060ec8fb95491aff120f05f68741c79d542d67ec58990e8
MD5 SHA1 SHA512

Submit Download

__local_stat_cache.json

Path /data/user/0/com.east2d.everyimage/files/__local_stat_cache.json
Size 25B
SHA256 c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
MD5 2d805b13f2f28dc3ca9bbcc000f49bb5
SHA1 9eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA512 5db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.east2d.everyimage/files/umeng_it.cache
Size 83B
SHA256 117c609c6f5e0a1a3a23438440b1701917378c6de1e6392e38c7c2e3cecbe062
MD5 448b448f68c39891a066504991f6ef08
SHA1 2b21b37b3626f77d774ad45ea49e9aa93fe47f02
SHA512 4dbfbc97dfc41e20714c937bf71c8b05dfd30f114aaa17f20c8ebcef3182d278f7487d1b1fd91e9355778b8fa2cc8ff01d4a03be572a47e1418ec917d3ef156d
MD5 SHA1 SHA512

Submit Download

crash-2024-06-14-07-20-35-1718349635238.log

Path /storage/emulated/0/crash/crash-2024-06-14-07-20-35-1718349635238.log
Size 1KB
SHA256 923d2604eb95976a459139c4f55b15d6b7341100fb241850fc9ce66f8b6f475e
MD5 3653fcdb6c3f242c166a3f8fe53f6469
SHA1 b1c515318bf2292029a0469ab234cdc6a2ae4428
SHA512 21444049f19d8ae585b79fd85ef019d4808d1b4019d2fc0914ffbf3cdd04eef9deafb7a46b30a8a2156ea74c16f446e6a0b6c98371b4ca2672d318f6c4cd8a39
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads