27a1fd6878e821ad2e7aef31f5316a07dcb1e1af6d0bae1128f67d653fb71e4e

Analysis

max time kernel
179s
max time network
186s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
15/06/2024, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b04cbba6c4dcdca75c84838dc0131fd8_JaffaCakes118.apk
Size 11.1MB
Sample240615-1vh12azepl
SHA256 27a1fd6878e821ad2e7aef31f5316a07dcb1e1af6d0bae1128f67d653fb71e4e
MD5 b04cbba6c4dcdca75c84838dc0131fd8
SHA1 7a36da9873e4944d077606ebc985ce1a8f1eb56c
SHA512 da5fab2524f47ee1d5da1a5392fc92e84d050135e525d549b223b654877682b658229ed395d61e1111d83650c2e65872c0738319edf4d12120eaad0c376ec3aa
SSDEEP 196608:nfUdHFJPspm3bqCkh6w9FSrYsTZpcZgKQPhoy/p+p/X2JYEJt0xsstBM49vCkY/T:fgXPHqCISMsTIZpwhbpM/mRK9n4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.xhd.toefl

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xhd.toefl

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
31	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xhd.toefl
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xhd.toefl:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xhd.toefl

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xhd.toefl
Framework API call	javax.crypto.Cipher.doFinal	com.xhd.toefl:pushservice

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xhd.toefl

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xhd.toefl

com.xhd.toefl
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4546

com.xhd.toefl:pushservice
1⤵
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4703

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/com.xhd.toefl/databases/cc/cc.db
Size 36KB
SHA256 50484dcdc6b9c2801773018386a8143a52a5153eb2eeeaf5be8bbe46a49ca90c
MD5 86752a4be6564d8370f2f0e403995003
SHA1 29f7d50675f6e59f3b808eb6dcc8619384412115
SHA512 79c9435c1e0d41a3f97784be3e5a3cd8c0bd2d32ecdf326808bacb00c76d876d0447617d6e72ef04cd4b996c92eda4eb7bb200987ae7928ce2e0e7c8e807a5ec
SSDEEP 12:TLg5P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TLF7sL7yot3BVrHotGGSP/WQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.xhd.toefl/databases/cc/cc.db
Size 36KB
SHA256 f94692b524e482562e7a2f8c696fbb11ddd94c7b4577abeff7aacb8676222c8c
MD5 72e6c33e4da9fa7e1f3fc1ccf426462f
SHA1 0fe0df1607d8369eb980266e3fa75b14b7bd3d03
SHA512 3f6e7082581b26c6dfbdaab55f820600011e2074b49fdbd76850e93065e76422494125f591b01c2fa603ff3a7171efb11358280bb272952baf849eab6b186665
SSDEEP 24:7+tfqL9T7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSHAGQQQ:7MfqRT7/W0xopA/t379y/MSH
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.xhd.toefl/databases/cc/cc.db-journal
Size 8KB
SHA256 a60f9e4f3a0f78e50e78fa793383fac2748a0cbb37b7cf2de559c067a7a339fa
MD5 f9ef0f809a2dd10bdcb4eb648d32dcdd
SHA1 05907e851230514eec22baa3166885653f84a18e
SHA512 06d3fe25ef39e7815ab14c1a6ffaa83e64ff71c8a2ff11ebc46614acd8ae37a50482e3b33fba5ac7c76b8dd1cb825b12f5e7260fa242067b17a0b0e6741b3bce
SSDEEP 6:7+/l/hfg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKi6U/c:7+t/hfqLJdeWRmBEyPbTfc
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.xhd.toefl/databases/cc/cc.db-journal
Size 8KB
SHA256 96bc15040a6538df8c3da6915aaca5e8748715ff3492329bbea16eea4020d914
MD5 8670afe18225b2e1c54e8bc0a0560f4a
SHA1 2fbbe874b7d79598bac48f123545744cacc7212d
SHA512 6c9b8021fb91e7463fa5d3bba484b80097ce7a52276c76d00f77f483adb4e55638dfbca95167887367191c57db018b97b0e365a5aabb7b61c1eb5113209b5bc9
SSDEEP 12:7+t/KqL/0P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb9:7+t/KqLV7sL7yot3BVrHotGGS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.xhd.toefl/databases/cc/cc.db-journal
Size 8KB
SHA256 56480f95e68c867de0379de63411a493052fef6e00480605654cfb6325165d33
MD5 4c05a4379c12e2a4450ca12ceec2de50
SHA1 b814425a899fd1f0f01bd161cda9de47e104dcd7
SHA512 bb6ab0908f502c2a4f7d31dbca1a0e5b7d4cfc54eed0f3bb4fda70d8b5b3cb6d14914ee8a986b9e4203b406b9005f04889ed25b5bd5d4b5eff625ab0fbc21829
SSDEEP 6:7+/l92gPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK1LM/q:7+tQ4qLJdeWRmBEyPbIsq
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.xhd.toefl/databases/cc/cc.db-journal
Size 12KB
SHA256 1fef411032b19ed1a083ed60dc609cd6119d25c80ad150c81b6453c084a59a78
MD5 6bccab89ece81cf646fddae33a983f10
SHA1 ad7efa2ec6fbfaaaa25f34fa2b2e93db497c1f39
SHA512 5704cefdce23b27b614ead72663c45eecb9de37f8ba7b04f6d92880044bb24d97e0692c1c883c3c340297367f35559a735e52a67a81f872220ac28684519bd99
SSDEEP 12:UsdODqO3XAqLWEmlP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5K:1powqLsO7sL7yot3BVrHotGGSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.xhd.toefl/databases/cc/cc.db-journal
Size 8KB
SHA256 e0c90a8a3b4b2a30945bbdaa84310d717881811d811d469f7be6d96e8ada6340
MD5 96475526f6492448f97d4ec334ebf536
SHA1 46ee2c0ebe5f68dcf169cb4c2474137205b54588
SHA512 0c8985ca8f94eb0d8a34d586819e13512150b8627d09337729f6331f65ef1c9c2cc01dff26e1e7658bb74a0569dddf6e16a401a57e834b59f88282330bc1cc1b
SSDEEP 24:DUMCTlUL/fqL7Z7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSc:DTv7qXZ7/W0xopA/t379y/MSc
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.xhd.toefl/databases/cc/cc.db-journal
Size 32KB
SHA256 68e74e1834626a2628475bdacd431d79fe7fef164ec7792bbfaf6b8e36c39865
MD5 ea51c21514b5233712a6924e14bff0eb
SHA1 a0b1edf3f35ef8711fd672029659ce13ab1db022
SHA512 35d9d7c79c5753175b5e698675bbe5d06d503b3a8a4acb6de909e5344f2a40f297304e082bfb61aecf1336e51e6f80a192572dfa4a04d4669ca8a2f8fd2d9e28
SSDEEP 24:TLC2uVdC4oj8yiXy10nu4nmVuGSZGQQbrS:Tu2yg45u1SJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

test_app

Path /data/data/com.xhd.toefl/shared_prefs_ext/test_app
Size 8KB
SHA256 330decd25f7ea1a8816a9b09362510a980b2b50d08c515550176c9b84489191d
MD5 fce60290b5bd15075e77e7e957d83f0b
SHA1 170f3f7cb0825fc954e5ec63ce5db7395ad938f4
SHA512 5d043716220f70553508eaeaf3d1eaca074623724648756f4e8d82e2c91f89173ce4d112abb96dd13990b40d891f69d47f268f2a22e6954a36aa4a1418655e9a
SSDEEP 6:7+/l9KPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKea/Tn:7+tkqLJdeWRmBEyPbhqTn
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushg.db-journal

Path /data/user/0/com.xhd.toefl/databases/pushg.db-journal
Size 8KB
SHA256 9be459cb5d7add8dcec593fba7e406ab0594d2a5be1831a9519d13d471e26c88
MD5 30346c5b3b3de33a8e2e9c2c41e61df4
SHA1 18cf1adb198a8cd41942222ce57d8faeea9b103d
SHA512 234150f16987b3a41ef0e0a3ec643a422b4b28b6cd0c61a2fee8bc8403e99bb5a5e64a3f4ff41d2d54b4d26d94735df7cec834295760e43fcaa4ddad5b01b519
SSDEEP 48:HJNcCVgtmPE9SbrqWhRqAW4HwyUmfoUlSJ:rcCatqb5XC4wMWJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db

Path /data/user/0/com.xhd.toefl/databases/pushsdk.db
Size 48KB
SHA256 e4a2bb1dc3d9fe4ad4fa50a29705aabcd89de0cfa7339e966c0bbbbb38d5a3be
MD5 00d821e3f7fccc8a14c89a8caa4e4f1f
SHA1 9e0ef8a27fdb7af9e9b7418c45408c4204fcc6c2
SHA512 470600e5ce93842e792f5aecc396046754c86ebcaa9657cc3bff3872c964c2106982bb339f58fac05ac4093db49f69f61c6b94dc45b9defd079fcce79ae8ba92
SSDEEP 24:TL8bm7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSFCU9RCTlUL/HQQF:TIbm7/W0xopA/t379y/MSYMRv
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/com.xhd.toefl/databases/pushsdk.db-journal
Size 8KB
SHA256 1c660103088d4f2d0e809679d474091fb894385115dc94eb58936a056396a8d0
MD5 fedf1bd68c404df42b17bd3ef1c45e5c
SHA1 08ad9f258bdf55f2e8d8e343fe36ceab8ee43b90
SHA512 626b9a7bcb759259e2ee8aef6ae6d1ba7483a3b2c9c8d7715fe0ff24f6f585d8afeeb1e40a385540867785eeb90bcedbd9ec62de50f0fa84a397f0c37fba3a9d
SSDEEP 6:7+/l9SHn1YWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKg:7+tURqLiuWdYRmBEyPbv
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imei.txt

Path /data/user/0/com.xhd.toefl/files/.imei.txt
Size 512B
SHA256 586f409c88a9bb2b742b054f38ebff5a2bb0a97421313eb75046dff6fa5ca5fc
MD5 8259f5352f1374f407d4148a42c2a04e
SHA1 f4a4b06f3b6f85006be3b779429cc55f2c4241ed
SHA512 9678bd37dd4d5665b0a6ccf31c3374de6023431521ef6ea4ee61a384e46f48bf518205dc38fdd8f8789895eff927b3933c1bbc3e2d3cf734b9ae24985c0c8239
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.xhd.toefl/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 e4026b94b21d706e1d7ec270eba1fe521f5893747b402d4448c7fcc5b8ac90da
MD5 d32ba8923baa0718c5f4c2cd85622d60
SHA1 9db351eb6aec22c1a01de0a39e44a92ffce6c185
SHA512 55151b8d694fe405cb315a86f4f902e2153575426a0a5482084acb761f97bd554156469a5d5c444641366670d5f2de7f64cd619c1f9537fcae6d33d7dfc5b81c
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.xhd.toefl/files/umeng_it.cache
Size 8KB
SHA256 672e0701eeda75223171ef771bd65ad827ca678bb6563efbc9ec270093b51d30
MD5 90b0e4628bb6449cd859a1cf35f07a8d
SHA1 b996cb252ba4e7735bc18a9a219452e9b4b36216
SHA512 f54196fe1e0422b09097c96531afcebeee1201cfb8df5ca920bb8a20139189e3f8016dbb7d37319e0aa34d474d73ca0e9be2b20e895fc48ccd4a564deb8c4e7c
SSDEEP 6:7+/l9Zs0n1Cfg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKP:7+tMfqLiuWdYRmBEyPbU
MD5 SHA1 SHA512 SSDEEP

Submit Download

umeng_it.cache

Path /data/user/0/com.xhd.toefl/files/umeng_it.cache
Size 8KB
SHA256 2a100c6456b9b17e3bbbbf9964ad00210be1edc1966e19d5db331a0430dbf885
MD5 826e6a1852f3075a84d8c5c330e830d5
SHA1 3908361a06133142e91adf15874e7356e743e171
SHA512 26d6868befcdc2feee628138d89c3dcf7f732cd5123ff5cc8a6f3d4406211b388f8927f7f2f596904dc0b6c823e5d8d49b81fefaf019ebed77f45c57e4c09f3f
SSDEEP 24:7+tfWrSMqLFYVdC4oj8yiXy10nu4nmVuGS2:7M8qxMg45u1S2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 8KB
SHA256 c3900927539f2878c3c75c6f29ee7309dc7e886423cc663fd835bb7841ab03f8
MD5 e26aaf6e02073c83943c7a070b6015f1
SHA1 0b9c9e1bb811788bebf63f571b14e1a2dc3bfdd1
SHA512 dbb3f4f56c4ee968d8ce37f327dcdc154e170cd109a9a6ad989a6203a7a846212546e1eda5f756d93ea29a829d62f5a33a8b43991367842ce1524c656333320d
SSDEEP 12:7+tnIqLwdQwd3wVz4D0NWgUhM8xEVazXKwo17RDmTSFbyJHOOhKM2ZEm5DRmBEy8:7+tIqLwdVdC4oj8yiXy10nu4nmVuGS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 28KB
SHA256 dc2e25ae125c89ea4cc11917a92efcbc8ca7eb8a68d4e71aa4bd24af6737ace0
MD5 310817b3b7859996f2adf539c7d35c06
SHA1 0d89938dad953f6b2f875773ed97253ecf04b2b5
SHA512 c016c05de3cb54338809bf373fa7bd4a1aaa0a520904af0c4033db4fafeccf5cc4810c023ce870dc0ce93733a21d4032169d1a866a4e39c81e99a1a89f7bd7be
SSDEEP 12:TLEqTuO/EUxm1pFJJNQ4D0+wsysANkqmDQeoEH3zsUD0IfRmBEyPbGtOwhnEoQ:TLECEW4o+wyo7m0/EHIUoVGSiFQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 8KB
SHA256 4328a3a80f57176a37cf4056e732d0d261142341d1109ff0e99d10626bb04d2b
MD5 7a02f4f16a5415c67a27b825d800b01f
SHA1 3570cf8d33eb81b26178b6c8107327eb5d1dcd96
SHA512 b4182c50b6ff9301cacb68125393112cf370b02bf5d4ca131d281027776bf00f6c979ca2e1c5d675b7d3efbf130798e86a1e9635dbf826883742d6653a80adb4
SSDEEP 6:7+/l95lFn1yWWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK3n:7+tvl+qLiuWdYRmBEyPbE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 8KB
SHA256 d370cd8f7a6d98a78d4a811714ad3d7f2e1b8841ba9de002cf3ab7aec70f6e10
MD5 d59edae5e1694283e8289b32d3ee8384
SHA1 723a60e1d3d465f5c9b15d9029f9041857378973
SHA512 ed897c479d2f2874bd70ff5cb207ac57de60a1a7de28970884718b4ed7f44ec481a5b13f421150d07a1f121b2490acc625f094034e4c4de467aea4bf4ee4906e
SSDEEP 6:7+/l9dGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKoC/q8:7+t76qLJdeWRmBEyPbO9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 512B
SHA256 85c67e0d413be639e17335e0df520955f370f8a71494edad4a83f8c8284ab2c2
MD5 8eef3313d5db891320c98e5dff9a543f
SHA1 e65237af62785b8614b7b078bfed178c6c5b2bab
SHA512 54c2035a2ad835dd8da59f989ef0272895da5a55b2bbee3aa87d0920642404afa81f005586367377cec841c75fb01f4da0c7aa0ce6d6d01394ad2f6239b1e20d
MD5 SHA1 SHA512

Submit Download

.imei.txt

Path /storage/emulated/0/.imei.txt
Size 32B
SHA256 832a52a55eaa891bdc0e042fd9ab3f5db0d3e6349a2a77b611212a87c5a58d37
MD5 4b76bf89a43d9cbf82f9b4bd4153520f
SHA1 74760004f76316649966dc0bc6707e2d3a6eea7b
SHA512 92a3aa36c7b5b0f6eb0ca44b6a3293e20be9d442da2b493ec8c8302c32d427802338a9a28059a21b976f701d7f9b574930a1195db4e6cc04f99d0d109e561c85
MD5 SHA1 SHA512

Submit Download

eje3cnc (deleted)

Path /storage/emulated/0/Android/data/com.xhd.toefl/cnc3ejE6/eje3cnc (deleted)
Size 4KB
SHA256 61e9274d64274cf16d0e8609b57baed38882eccd574cbc4dbeb30c3c81b68a93
MD5 9fd122cd41f40f889af3ce57fb065ce9
SHA1 149a7b39a6346591f670520994080495a62f02ac
SHA512 fd6fbe0480ddf9b9c37409ee17f41a09cb62ca9c34a9d20cd083affe876be1ce902a36559002dbcef92b357d08f1e9aa5813d37a7a58dd7f876639d58e7e7f0c
SSDEEP 24:7+t3qLqG7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGS1:7M3qGG7/W0xopA/t379y/MS1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads