92e43fcf489ca85c97d541e064f53abb08243db60054e1b377bb21b07fe5e5d5

Analysis

max time kernel
33s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
15/06/2024, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b03840931ad63a7a622c283dcc39943a_JaffaCakes118.apk
Size

5.5MB
MD5

b03840931ad63a7a622c283dcc39943a
SHA1

ce684e555ac5907ad522136e579cefee329d8470
SHA256

92e43fcf489ca85c97d541e064f53abb08243db60054e1b377bb21b07fe5e5d5
SHA512

cc272f999db7d6befbd8aba39d58068c7fb0ee7b0f58a7926e610d57b641c1d8ce2bfd877b4a14cbde467bd861fe74a232f5b5024049fdb6b968673b8e30df15
SSDEEP

98304:nTUgtIsm5pzJMpLMHCglAaKzl5UDl/IN81eiVmGN3rI63vVWobZFse:nIQCR6mH3+aKzl52/IN8ErGJIA9WsR

Score

6^/10

discovery impact

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
18	f.appjiagu.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.shidawei.monitornew

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	net.shidawei.monitornew

net.shidawei.monitornew
1⤵
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4478

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact