Analysis

  • max time kernel
    161s
  • max time network
    178s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    15-06-2024 04:47

General

  • Target

    acecf5177b57bff4ecc14cb69dffaf15_JaffaCakes118.apk

  • Size

    8.3MB

  • MD5

    acecf5177b57bff4ecc14cb69dffaf15

  • SHA1

    addbbb798508e8798609a84aff8612489468ad15

  • SHA256

    0417dacab91d18157c9d5c488a722666b4667efe4bb2859cc5102f37d67043f2

  • SHA512

    d2376b7bf0a5fa0210f5d0fdddc77ab817412bacbd15e9acf07f9be8895fe4649834e937a3064c8fc6a853ee338e15c8dff509e61b0e359cf7e68efd65d4cc15

  • SSDEEP

    196608:/9ufdtPBHazEAASO/bVgC7cxOH2IVpFKTHyujDNCiH1cc:1IP9KtABq1AHwHyusiHKc

Malware Config

Signatures

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Acquires the wake lock 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 3 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.ekuater.labelchat
    1⤵
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Checks CPU information
    PID:4235
  • com.ekuater.labelchat:core
    1⤵
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4306
  • io.rong.push
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    PID:4363

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ekuater.labelchat/databases/follow_users.db-journal

    Filesize

    512B

    MD5

    cc2b787bcd3a9fec5a3ea34556e80147

    SHA1

    884422c6c082f30c1648f7819af81b8b1c509c48

    SHA256

    b7ef74461afdd921529ff1c658c352baa78290d2e8912f9bf2c36baa6bb424ca

    SHA512

    98823ff9f7b19a4ab12a9654df8bdebf919f2aae1e005c7b62dcb71826382da593c0db9e3ae01799dbcee35f4bc12e3b6720bafc8e7eb29652771da0129ffdd9

  • /data/data/com.ekuater.labelchat/databases/follow_users.db-wal

    Filesize

    48KB

    MD5

    496b06f98870911b62d7922f8779bf32

    SHA1

    f58d66c814fb8bfcc2de69f4c092b24e534a4b91

    SHA256

    68859168b2e074e26e861bac67c0ec74745df9673621cd1965d8c058b723a2d2

    SHA512

    d8e3a7bfd82d897af9b51653a4227a86e015854fc74ac250acf32b5a4c1663ca8155acc69359207ab0b70e5cb23f83751cf62a3a8060f44c45c1714e5b9a0c42

  • /data/data/com.ekuater.labelchat/databases/litestrangers.db-journal

    Filesize

    512B

    MD5

    5d74b21efba501e13c24e8a007506154

    SHA1

    b8f5b0c7af10bdfe005d15bad327d079e0f82092

    SHA256

    9ac86f3a5e417e23edc8e99c84a3198d8442f0d3c6d1cb11d4597b41545b7a61

    SHA512

    3e46e686d4f584768a0431bb4a112c5d474cbf0d6ac6aa2f7f341108cd8deb16a67af855e76cb53dbd029a9ecc0a13a88e44938de769efb7711a03b07a4f4530

  • /data/data/com.ekuater.labelchat/databases/litestrangers.db-wal

    Filesize

    36KB

    MD5

    8da788c8611adca7508f7068ad4696b3

    SHA1

    ab5bc03941a9ac3a924194935c273d492ffaa38e

    SHA256

    395790d8095fae1949f5a5aa5c47bc63ce282769578ac4d9bc153bfaded442e3

    SHA512

    bb3b76f759ce76b3866d83bf724fd0189a3f4c0347c374d9f29f205269e4a9e01907fffd8402b59a3c18feda074a8c4d4359b43d3425e3fa318436700f4c48cf

  • /data/data/com.ekuater.labelchat/databases/pending_chat.db-journal

    Filesize

    512B

    MD5

    8fdcb96391b356a86d1b467491cdb4dc

    SHA1

    528d2c4986e5ce745ab63d6689ea9a12bdfbcefc

    SHA256

    90c5fc6f3bbeadf9f778493bcbf12f4daad66f862870e47c3c1c18e4ac3b2538

    SHA512

    55856e16f4344d563b851a2c8814454db582e057e20791b843742deccafc11cd76738ad91a819ac9a091176868c2ffce0ca7b31beb32447cb523437e54d70fdf

  • /data/data/com.ekuater.labelchat/databases/pending_chat.db-wal

    Filesize

    28KB

    MD5

    4036f6eaec0c42d3fa7844442ad169ce

    SHA1

    13623f28a08850819f4632d05411e6e259db6149

    SHA256

    5db79d1be4e376380b40b71791148b7aa1d73f6beaac5c1e5f12487573097a76

    SHA512

    edeebf06400e7ecb55eac6281dd3110b6b25adc65286e1ba885fd5e0562e15b6ff64d7612162350a879f2468b0f32bf2af7e3bf6f72701b7a00dccf5cc73c54c

  • /data/data/com.ekuater.labelchat/databases/rong_version

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.ekuater.labelchat/databases/rong_version-journal

    Filesize

    512B

    MD5

    0a7c9b811111a966814109e6d44537c9

    SHA1

    8f2eabe9f56d1dc31ea71a4871fa95bfc8402a47

    SHA256

    2619e5b7c98409a0b39dcd110f1656d93f44e45b0cdf81fb9378c33a6db61a16

    SHA512

    0267532a11e444365b535e3026a22488fd586fe2a9adfbf642aee1f4d2b860bb282c939ee7113f66e3af38c1e03c6148615e4d0fbe8a10658def36856453af32

  • /data/data/com.ekuater.labelchat/databases/rong_version-wal

    Filesize

    56KB

    MD5

    2940ba710b1bb21e912c86a63b0faca2

    SHA1

    fb430d1014e57708bc75702751c2b26f30696b70

    SHA256

    ebdbba07edfcb8901e5445fe81a8d06753f072b1ee83cdb6ac3a4b00c026b906

    SHA512

    eb217114fa8f381283058d14a2e19330101bb61b9f21ad48073b724e511d4981e3762f40b5941057b76e2a59e858e671f8229765d114eef82cda3b3ec44eeeae

  • /data/data/com.ekuater.labelchat/databases/settings.db

    Filesize

    4KB

    MD5

    4ae4c6a3fe048407bc2e7ef047448fd9

    SHA1

    2cafeb53dc3f302d52346505f9243aff4964df67

    SHA256

    45db83ebf9b4c8d0afc438aff4a27a13afd8a0897c2a41b8ce4981fe335904d0

    SHA512

    ebbe58d34ad6404d825b5a56c57d580652113b633986a578b271fe13e6153faf36c05e6ec16f16f2112efaa8d9e4cadcbdf8324a6071407b396722d939707e47

  • /data/data/com.ekuater.labelchat/databases/settings.db-journal

    Filesize

    104KB

    MD5

    1494493137146bc1da8e7b80ad9b5b72

    SHA1

    5b055baaa923375c456c41d58afe425065321c27

    SHA256

    843425482ab070834cec70a5587026f3a63cea98fd28c9658b9f3663f22ef504

    SHA512

    56cf435d2295c6cb7584b5d2bc4df844fc0cfe7a6cd177980b67b28c2b571a27b551bf39d39920375020eb39c89809bf0cdeaa2b38cdc33b331301e5221564d9

  • /data/data/com.ekuater.labelchat/databases/settings.db-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.ekuater.labelchat/databases/settings.db-wal

    Filesize

    96KB

    MD5

    743048e5c1db85acb112fe971bafa762

    SHA1

    6e5e2e8f9db3347a41819b6cda19889d6c76239f

    SHA256

    f88d401fc81b535ad24df359ed2e6dfd142f9bffb6c4164661bbc4ab7b8dc1dd

    SHA512

    d53f1e58f0f24aaac409c480dd646ec6e2b41f9e45019867ec525ff891b7b15d264f7962b4ef122f2a4311486b50dd6225a5e1a9e2e84405d3b51a51b7a4ccc3

  • /data/data/com.ekuater.labelchat/databases/strangers.db-journal

    Filesize

    512B

    MD5

    e11040e673d0a6d20d885d77d61d6d56

    SHA1

    da5bc929efcffc31cf2cdf990cbe3d92cb56b04e

    SHA256

    80b084e54de80b81c5fa890d268b148ddaaf7860fb72260a9926b1b4055e6a52

    SHA512

    fbed703c771748d35346d1ccc94474276d8d14b3a0728540da4aabc5e4369a284dfb6c19517eec177781bc726f8cfad0787806a28048fcd694b05527503a368b

  • /data/data/com.ekuater.labelchat/databases/strangers.db-wal

    Filesize

    36KB

    MD5

    9dd386a89deb914b2cae19495aaa2a96

    SHA1

    eefde7d854cd86f33318c0e5f0ff47787af3facd

    SHA256

    09d53400bb32c0374cfe6f433c4610af4a814ba9fb2316018d3fd5fe0643906b

    SHA512

    ba31f078a640e8576e2eec9c2d09e308dee1668f9142778465738b27631bcc374f01d8b2a7f61d13e83b3f8982f8d68d3c32dcc6e4260c928f8d2df0420535c8

  • /storage/emulated/0/Android/data/com.ekuater.labelchat/cache/locationCache/journal.tmp

    Filesize

    31B

    MD5

    8c92de9ce46d41a22f3b20f77404cc1d

    SHA1

    8671a6dca00edb72be47363a7071be65cf270373

    SHA256

    68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

    SHA512

    30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56