Analysis

  • max time kernel
    123s
  • max time network
    138s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    15-06-2024 00:30

General

  • Target

    ac3ac9cc7970a5668c9516d38afe51a4_JaffaCakes118.apk

  • Size

    6.7MB

  • MD5

    ac3ac9cc7970a5668c9516d38afe51a4

  • SHA1

    549206418966d7ab78d2bf9bfc1a471f06df24a9

  • SHA256

    b5f3947e12df86e739ecbb2250c8c354701a75cebe29544640048ecc145f519c

  • SHA512

    1b58f58b6faf2ea10f04ef7088b190bf65e37c4b0fccd1f1f211a7e9befdc1b4ed1773a67e4f9e145735cf4fe152fbafcfb881db285eec19043fc5ff539574fc

  • SSDEEP

    98304:nzBhjR1VbnmbFZAqW8J//x/WXu0dmUIbfu6IA4beVJoH16PiSuN78FDj9wDX9NcM:nz/jRXqi81/5tebWJIAkEguu18dUT/2o

Malware Config

Signatures

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.quizman.footballstar01
    1⤵
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4175

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.quizman.footballstar01/files/eula.zip
    Filesize

    63KB

    MD5

    1a6d49d2adb9303a161a950db2de3927

    SHA1

    3f9a3ff691d967a4bc3bdffe6327cfab0c416ef4

    SHA256

    2eec668519c3ac15ba5e1c7bb8d83abb9bf935a32bde220e42a7047d66c824d2

    SHA512

    6459e8004f34945396fcec424bc37e34c7f86483a63a74a9bca2e9c70791cb0fda0ccb23b72944167693c7c71b418db41acd08dc83f2bf55594a02c5725fa4cb

  • /data/data/com.quizman.footballstar01/files/mobclick_agent_cached_com.quizman.footballstar01
    Filesize

    120B

    MD5

    fd91e786bb850bfb3c51a769b46af657

    SHA1

    e4f15c678bada9857a1229a3a6b62e0a25641684

    SHA256

    6efba4638b8624b74aae7c9afa5c38812f5fc5b219f552cae7bfc647a9c2cbdd

    SHA512

    f3fa29283e1263c8e62774880f8576d9578b05488dfe555efc93c9df4694d156f301a9d3f028763681d5582b19852001a34c56c7c83ab0b43381f791065bfd94

  • /data/data/com.quizman.footballstar01/files/mobclick_agent_cached_com.quizman.footballstar01
    Filesize

    380B

    MD5

    abdbeaedd9678051ffd9a6a8067e99b7

    SHA1

    63e5a7d61897991735578e6b2edf1a10b0f2ca5b

    SHA256

    20315c6eb3666b2f59064c7d9775c725b5cb7e4eba8c025eb2e7de5415936ed5

    SHA512

    3e81e809663ef77a60fc1028e8357d042a1016aad1c6dac8f1a40dd3c9608bd68c2efee310f54dbeae6915cd75faecb118119b12968bebcd425a967c5e308fac

  • /data/data/com.quizman.footballstar01/files/offline_eula_body.html
    Filesize

    18KB

    MD5

    7813643485a5318f68291e87315a6fca

    SHA1

    207f1059f5ea34b0fc4011848fa4682608d26443

    SHA256

    c0487218c63d176ff68c0c6bc91866222ad9ae6420ea6fdf06790ff01a1db918

    SHA512

    e571984238e162b5d2c61973fa62645950f69b2a75a0c7b11d6854c9b89ab0164475c96515b7c48c8d60926c90f439e7c172d5df00b11413bd6584b0d0b3f19c

  • /data/data/com.quizman.footballstar01/files/offline_eula_footer.html
    Filesize

    13KB

    MD5

    9818dabc2eb86d5f4f071e9d67334570

    SHA1

    117e7978c9293d86ea5492b90a4999cc24225dbb

    SHA256

    1f075332b57fdfbb9417718f3c0d9f27ffbb2c135b3291aca4b9f2911d7e9e3b

    SHA512

    79937390d4b02688abb0e24cef356024c3dbd3cd59d85ea3300556af59f0648293ed24fb5db740a4329fdddccf43af3b7679135555397a3adedd3eeccf5423a0