850a4d202c53c604b3f525f2197c9aafab067924528920a9235df9546114b91e

Analysis

max time kernel
180s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
14/06/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aaf36256a481be164522d7d06baa6d12_JaffaCakes118.apk
Size

2.6MB
MD5

aaf36256a481be164522d7d06baa6d12
SHA1

de9340f632db661eb79573985dffe4c825fe4ee4
SHA256

850a4d202c53c604b3f525f2197c9aafab067924528920a9235df9546114b91e
SHA512

2631efb91af6200cf341bd7f0b2ff5388a1f9ecdee3b0ad78ace6a161567d5d9cb7661934b0351a41c9fd316cbe9a54abe699e746134900f3651a7a063a20adf
SSDEEP

49152:t+hLbCobOVt7r5/W7GHWto+k7i9B5YEGu5+cP47E5WmIzhZ2oaBCTe:sbvbOv5/WiHMk7iz5YEz+cQ45WmI9ZJo

Score

7^/10

banker discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.mopote.traffic.surface

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
5	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mopote.traffic.surface

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.mopote.traffic.surface

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mopote.traffic.surface

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mopote.traffic.surface

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.mopote.traffic.surface

com.mopote.traffic.surface
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4265

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.mopote.traffic.surface/cssystem.db

Filesize
16KB

MD5
75be76de47293c144672473921d73b88

SHA1
419d76d3d219680b240143fc5678596314d073a2

SHA256
13899850303e67099d024674d9e31f3f6fcc328c4494422b7646f955a954481c

SHA512
1c490fbe1c6d41e01e2c78c1e9e35677f74fcf561e42f94543de97e32637ae9aaee87399142b269f3e5c4620f3e22291da4f99439deffe552a88664a4c9b50bd

Download Submit
/data/data/com.mopote.traffic.surface/cssystem.db

Filesize
1024B

MD5
476916673bbd6e850b47dfc1c867af60

SHA1
545aa7627b58ac581045b9e30ef21aea7ad3c41f

SHA256
f7fc0485e864388b8bc55c5559cefabd10c20eddc75886f564958ce68e4e9e5b

SHA512
660479650e04968c91a12556f4c8cc4ca48e6886e4e6e71beaf7297eb8f1fa8ecd464a549bd292b21bb693c74253e7612c6488031d8357e7e22aa214015ceffc

Download Submit
/data/data/com.mopote.traffic.surface/cssystem.db-journal

Filesize
1KB

MD5
66ad0dfed55d2f7c07c58e5b66a77ddf

SHA1
841947d35ef8d0931961ea1d903a107b2fbe9d5b

SHA256
2ef0707d4487a70d16cd3ff6f43d52fc8450b8966982169766741c47e10984d9

SHA512
fa930112dfc1f590e43f1c3eb4c467e9a9501bc96973d47cd765bbe14853c28b89ac63d811f15dc0e3e773b1d4e9d4e90a968c9972c19e56586c57593f3d9094

Download Submit
/data/data/com.mopote.traffic.surface/cssystem.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.mopote.traffic.surface/cssystem.db-wal

Filesize
3KB

MD5
269cbf83e38f2ff21175bebda4605d28

SHA1
af622b50fe2912ba31ea68eac40e780473edaa91

SHA256
a95612918becae7577f50ef064cf11e350f767b7f9defb88db096048c4072197

SHA512
5ded0d0e0b216d49ff925a87a44a51272f02fae4881d508834ef542041e08c7907f42d1bf607a0c2ba682b3e9b7f6962a56e9e4d5b92ac4f2bdc635450a21e54

Download Submit
/data/data/com.mopote.traffic.surface/databases/statistics_surface

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.mopote.traffic.surface/databases/statistics_surface-journal

Filesize
512B

MD5
ef460b1e6bb98bd06c384489b038d777

SHA1
7011a9aec2f74d352456df5a6ae4a5773c629f17

SHA256
d608a477d01f2bd05f2293540aad8cefdf1e73986320982323d759e4225317c3

SHA512
ac6ad25e3384962699e61f68c5c13ea1731280357856d415618b53e9a6502a4405a9e473f74c4900e93c774695bb76b8aba53eb2edf46a2fae0d335783e1d19c

Download Submit
/data/data/com.mopote.traffic.surface/databases/statistics_surface-wal

Filesize
297KB

MD5
264a342ee8416d02a3ff4ea446536dc2

SHA1
d3b6cc055a2ea45f5511d9e16f49ac91c74386fc

SHA256
38c1c66856f4dc5f1e96f7a525f08672db2fdc77f855e7edfb5c3f095a872cd3

SHA512
b782b55dfa9788123a48e8885921382618a3a4768f13c3c56874441ae6dc7c3de112b283ba03a49bc51676eb9aea075f7623287d8a84a1ca642cce6fbeec3622

Download Submit
/data/data/com.mopote.traffic.surface/files/mobclick_agent_sealed_com.mopote.traffic.surface

Filesize
566B

MD5
30bc66084c1fd44ea8dc45f5ed3f4cce

SHA1
301d3ea0cdf409aebf07368735826d23119ce553

SHA256
7f4f99596fb3e05fcd89bcb640b6aeddce919c744fbc1f9c94f773c56adaa9b9

SHA512
c4c13c9b82b019decdc9569a0e20ab1d537c1840ebc1136437e7ef85643a5dc8e6f1b9ac8df720c16d7cffb3d5acb5521e51db25e5c9e1305934c887632d3cf5

Download Submit
/data/data/com.mopote.traffic.surface/files/umeng_it.cache

Filesize
211B

MD5
98d4dc93ccdd5fb95cb85995d7db11f2

SHA1
b99acd485fcc9608ab2ffa3fc2357d15de5dca7c

SHA256
f58ef0549f985192d93aabd0291185f4e09a5bdcaf26a4c4fc8c060e4c36ed5e

SHA512
6d7de4b855e13a1ea5e3ff5f9d7fd5c988cf2cf8ddd2b4904524138728e893a0bae59fb7bf3547667f7af87b98d3fe237b8adb329fa4a50ca64c31ec3b024663

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads