061fdfb94ff22f5582ac1a9a0df137ed06a1371f00e3598a2bd0891cadcac33f

Analysis

max time kernel
175s
max time network
185s
platform
android_x64
resource
android-33-x64-arm64-20240611.1-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240611.1-enlocale:en-usos:android-13-x64system
submitted
15/06/2024, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac8f0aeca0a584f4559b8601120d1aac_JaffaCakes118.apk
Size 12.8MB
Sample240615-cn9cmszbrp
SHA256 061fdfb94ff22f5582ac1a9a0df137ed06a1371f00e3598a2bd0891cadcac33f
MD5 ac8f0aeca0a584f4559b8601120d1aac
SHA1 173c6dcbf2eb702a476a68591f596f07a5e0d704
SHA512 a02e9a44e3b1217556f9834a2cc73ea6ba0b335575511d9ad529118dfff2ec34e9afb4cda8243a846c946e76a913add9e3f02f541eecb0c56df7fb6be323501a
SSDEEP 393216:SaiA/6ZN+25ANZhZLK+/QqnhGwBQTPah5j:tGNNANZhZP/PAwBEPan
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery impact

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 4 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	org.unionapp.zgfzyr
Framework service call	android.app.IActivityManager.getRunningAppProcesses	org.unionapp.zgfzyr:ipc
Framework service call	android.app.IActivityManager.getRunningAppProcesses	io.rong.push
Framework service call	android.app.IActivityManager.getRunningAppProcesses	org.unionapp.zgfzyr:ipc

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
25	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.unionapp.zgfzyr
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.rong.push

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	org.unionapp.zgfzyr

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	org.unionapp.zgfzyr

org.unionapp.zgfzyr
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4311

org.unionapp.zgfzyr:ipc
1⤵
- Queries information about running processes on the device
PID:4360

io.rong.push
1⤵
- Queries information about running processes on the device
- Queries information about active data network
PID:4392

org.unionapp.zgfzyr:ipc
1⤵
- Queries information about running processes on the device
PID:4476

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/org.unionapp.zgfzyr/databases/cc/cc.db
Size 36KB
SHA256 66c83ae35e997c33eaffe9c0557d98ee31931c18b99585a64eb6cc8f63d303e3
MD5 1b77217d803a7c04af9466680b92d104
SHA1 0cb959f4773c6730e8aed5746706c0f3ecb35c1f
SHA512 39ea189895ca93855bb71b4a5447815e9373ffd39b50611ac172ae321ee7716fd4af5f86c1fd0d17e12b771f4016a86184620a7c5d07f57b88f017c4ce8312ec
SSDEEP 12:TLg0FP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TLdu7sL7yot3BVrHotGGSP/WQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/org.unionapp.zgfzyr/databases/cc/cc.db
Size 36KB
SHA256 6945d75275af161fa082eab8b348f4cdccbab03854963f5e861fde210447e058
MD5 b986a138e325f9ed31653e246087baa6
SHA1 1cda06c101efbf7c89305f44b552e38282225064
SHA512 5894180006885af44962dcd92c6f33a640d6080060a51a38ee4e348ee2dafe9abdcf2a931cfad4c395ebe20e08b96f810ca54b5b1f584fa232cdabc76be0740d
SSDEEP 12:TL/1FP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOw9:TLtu7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/org.unionapp.zgfzyr/databases/cc/cc.db-journal
Size 8KB
SHA256 050e4d99716b070bce819cd9c1977da9e01231882b87c7bb6bc4e6bab6cf154d
MD5 be42b35526569cae331a0ec93eceb07c
SHA1 1fea444c36608522569ae7e159967e5bdde5bc63
SHA512 618cd1f69b623e0f469e028b390b4d114ab36d0def0907c4baba61d785a81b44e5fefa24c970c453dc520bf4571ea8758787af666a4ca52f6c0bfcbba0ad0568
SSDEEP 12:7+ttfW7RqL/1FP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBS:7+txWdqLtu7sL7yot3BVrHotGGSsn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/org.unionapp.zgfzyr/databases/cc/cc.db-journal
Size 8KB
SHA256 1e2dbab6445603e3df2fb6e8e62f5e6fc8d7dfcfa64d4b8c03d02e6cd163d284
MD5 4645e64e2c91b32b3358b4c2766a991b
SHA1 8ca2d8fe56fa3b29f806cf1bd4be798edfd0ead8
SHA512 267210cf3cad1c22fb05621a1045c164ca53ab5a3dbbfc0323507e80e4e5b359aa5f4cc8de16f47ce1d2398d2bb9911c24ed83d770db7052a2f592be70931838
SSDEEP 12:7+tgDeqL+/+FP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEQ:7+tgDeqL9u7sL7yot3BVrHotGGS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/org.unionapp.zgfzyr/databases/cc/cc.db-journal
Size 12KB
SHA256 a1fce04d7c017d1d1fdb50f32c009309b48ae9b44d847e89a5020469ee713744
MD5 0550b8cd5acbd9a09891c8797828affe
SHA1 4d5917b61c1c8160715c0c37fc1b985f96296414
SHA512 df14ea7658a3720942a1826efa8176ba7b49f087ca44e3c5c9422575da7a80956de66fcb6e964bda78d262e4d874684cb97e9687aaca335f252905da868bb1d4
SSDEEP 12:7+tPWmau0nqLWEB5FP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtbw:7+tPWlRnqLD5u7sL7yot3BVrHotGGSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/org.unionapp.zgfzyr/databases/cc/cc.db-journal
Size 512B
SHA256 6a1bc37bd0d723941fece27719ca11275b8579270108a67d22d59ae055525ed2
MD5 e82a2d3005e1da38ad8b300415bb9fdc
SHA1 d745578e47734f0f8b901ec166d6c128f64a5161
SHA512 5bc212bc47b2e7d1731e085fb914efb4bc74a5313775df99f5ca76a07e07b9e82c2138834c9a0a2318bb22ea0da0300f4d34426c19cfd45e3aa571fb6235d71f
MD5 SHA1 SHA512

Submit Download

cc.db-journal

Path /data/data/org.unionapp.zgfzyr/databases/cc/cc.db-journal
Size 8KB
SHA256 88b5fabd83b92ccdf0be7ba6f69b39cc7cc0cb4032764ac705f12282c50f4b44
MD5 a427b36439d739c8623f6519764ac731
SHA1 f8f2f99b4d1efeb8aa90364bcab4c3b813e867f2
SHA512 09360ed47ebdfa3024df2420200a51dadea79d4eb5938614679976f7b1415fe5652ef5c1a1c33be42338de1ab0e56c196933dd55dde6dc948cd1adfb898e41aa
SSDEEP 6:7+/l9/f/gn1m2ng9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKkF:7+td3WnqLiuWd7RmBEyPbr
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/org.unionapp.zgfzyr/databases/cc/cc.db-journal
Size 8KB
SHA256 e9889f593cfe0af4bd0b31a341d157e98d4e8643d22aa7a22fcd7cdcd780329d
MD5 8cbd427520056659d850a0b4c4fd0f6f
SHA1 e21cfc2cb3540e7350ddd9ff8071e6abd30fd5c1
SHA512 8998e7e83319d8cad8c6fc86fe707c9b157319ade237a30335e877c88c12427eb1d3262416e3b2f8a3c7f813ae37d3bd38517388e5598c3c9d56d1ff8cad3d74
SSDEEP 6:7+/l9KNIPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKmF/ON:7+tAqqLJdKBRmBEyPbXNON
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1718417817323.env

Path /data/user/0/org.unionapp.zgfzyr/files/.um/um_cache_1718417817323.env
Size 1KB
SHA256 e612bba11a4134560498eb8c9c80f997d994dfbbf082163c566ea39829490b49
MD5 96354bec0e57025750800a370e1ba534
SHA1 1e680f9c74e024f14ca9738309370e15d71a67a7
SHA512 1acbfab8a4c17f597297e3fa437f847869320e1d988db592e806de1db302c34408c8a5ff6db72f5b312f53435545a2f4063df671d9a2587e7a85d37f7ad79ad3
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/org.unionapp.zgfzyr/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 cd649bcec097b99364a6985900e98f3ad47d1abd3942b66742029b1d4178654a
MD5 f17f68b2daa919ab3e68430ec39796c1
SHA1 0232f2ed68974770f78275797e2f2b58db1b99c3
SHA512 404d924e77aba170a8d0d7a665fb01b8ee3c3b12ebd341b32f00a009e1b4d09745100c1e66181dc5504fb57f2a02f52a87bfe3adadec06b74535f73da281f8be
MD5 SHA1 SHA512

Submit Download

exid.dat

Path /data/user/0/org.unionapp.zgfzyr/files/exid.dat
Size 57B
SHA256 2d2e19e4a9183d14542ddb9ea06239e88015542f1790df67e30e53ae95c60424
MD5 695f216a9730f9d61d5418f3724b1905
SHA1 e25e02675a22318861bd407ae9af5c1ecf663e2f
SHA512 2e07c0c87a4df27b82cebf3548496ca6b86c35a36aa3da6903901725d419808a93a938c4f7bafb16c5520ab9c22a6bb81fec71ac7cf479a41917f118ed9bdb74
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/org.unionapp.zgfzyr/files/umeng_it.cache
Size 433B
SHA256 a4a58d749e18c4f84fe68e6ba4af90c2072699528a88f4d8e8287cde59fff767
MD5 4f915da2dc1a3a058cd304841f30773d
SHA1 e85daaa66cfb5fc0b122d3ffaee95e37e5ff37f3
SHA512 6901482e24d554cea6469da61326c9b9f68940cafe0cd4686b9ab9c23fde98a1b224875eb154448c040c04779082eb44d86ab78888e7cda1401e1849ce64f5e8
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 45779c0b1d589e503c41cd1ed7a96aff4b81f4e3e16d2f65f83d1a9addf8656e
MD5 d014747abfa381ebb7d986e8916745bc
SHA1 46567e5ce490e7bfaeb3c9da375e1b2bd6f20b07
SHA512 3feabf6894f8efd933fcb061b45cce5b8afb92f28c86b37f4a50d75ab4b52cd024d2cd0358eeb79d21b90480fa73d20265762d5ecbdfb29be5c8b914ecff6349
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 213B
SHA256 1f789bb33c9d369dc6a18638a86e8e3a17a08e9ace8b2fbd4f7c1bf4015860f1
MD5 33d881fe7d2054c9f1074fe817155e39
SHA1 aefc64e87bd8002aa54f13fea887f9320f3789f1
SHA512 86132f21735ee8df89f4ce90d1b99bcb018bbb4d9580b34a5f25af884a31df4471ed6cb6e4704a1905bf8317800ea0e46be10a121c1677a4330e5d94a6767297
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 167B
SHA256 41cfc2d5c03fc76ffe3022ad0d023ecf4d601ceadb6ca83a031ba88fd32db37b
MD5 bd25b8c97e82798bcedd706465e8086d
SHA1 4c60e1bc907ca924959b53c2361e5d9eb84e2855
SHA512 d0374dd1a56aa29eaa73d49ab0e2c65c9db404524792a8457fad611e4d0373bf852581d78fbe2dcba68929791b2549508e55dd063772dc426253c19267455b57
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 fb8cb88a4dd399a66e3a1f0a8cb8e614c4fb7308d98470a83a5cfe91443a0823
MD5 6e49c27a3d9f616f1a3fc40b1cd73143
SHA1 14603cb225b1b56797661497c91f3bdd93b15ecd
SHA512 1901504d50a0c460da0d17b1670fe1940800a27a6e4157c61db2cf85e395a044a3ad447c94e51d4780ed6d3be09028dfcdb0c46a673b384eba1c60430023909c
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /storage/emulated/0/org.unionapp.zgfzyr/cache/image/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads