Analysis
-
max time kernel
161s -
max time network
178s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system -
submitted
15-06-2024 04:47
Static task
static1
Behavioral task
behavioral1
Sample
acecf5177b57bff4ecc14cb69dffaf15_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
General
-
Target
acecf5177b57bff4ecc14cb69dffaf15_JaffaCakes118.apk
-
Size
8.3MB
-
MD5
acecf5177b57bff4ecc14cb69dffaf15
-
SHA1
addbbb798508e8798609a84aff8612489468ad15
-
SHA256
0417dacab91d18157c9d5c488a722666b4667efe4bb2859cc5102f37d67043f2
-
SHA512
d2376b7bf0a5fa0210f5d0fdddc77ab817412bacbd15e9acf07f9be8895fe4649834e937a3064c8fc6a853ee338e15c8dff509e61b0e359cf7e68efd65d4cc15
-
SSDEEP
196608:/9ufdtPBHazEAASO/bVgC7cxOH2IVpFKTHyujDNCiH1cc:1IP9KtABq1AHwHyusiHKc
Malware Config
Signatures
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
com.ekuater.labelchat:coredescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults com.ekuater.labelchat:core -
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.ekuater.labelchat:coredescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.ekuater.labelchat:core -
Acquires the wake lock 1 IoCs
Processes:
io.rong.pushdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock io.rong.push -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
Processes:
flow ioc 7 alog.umeng.com -
Queries information about active data network 1 TTPs 3 IoCs
Processes:
io.rong.pushcom.ekuater.labelchat:corecom.ekuater.labelchatdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo io.rong.push Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ekuater.labelchat:core Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ekuater.labelchat -
Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.ekuater.labelchatcom.ekuater.labelchat:coredescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.ekuater.labelchat Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.ekuater.labelchat:core -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.ekuater.labelchat:coredescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.ekuater.labelchat:core -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.ekuater.labelchat:coredescription ioc process Framework API call javax.crypto.Cipher.doFinal com.ekuater.labelchat:core -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.ekuater.labelchatdescription ioc process File opened for read /proc/cpuinfo com.ekuater.labelchat
Processes
-
com.ekuater.labelchat1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4235
-
com.ekuater.labelchat:core1⤵
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4306
-
io.rong.push1⤵
- Acquires the wake lock
- Queries information about active data network
PID:4363
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5cc2b787bcd3a9fec5a3ea34556e80147
SHA1884422c6c082f30c1648f7819af81b8b1c509c48
SHA256b7ef74461afdd921529ff1c658c352baa78290d2e8912f9bf2c36baa6bb424ca
SHA51298823ff9f7b19a4ab12a9654df8bdebf919f2aae1e005c7b62dcb71826382da593c0db9e3ae01799dbcee35f4bc12e3b6720bafc8e7eb29652771da0129ffdd9
-
Filesize
48KB
MD5496b06f98870911b62d7922f8779bf32
SHA1f58d66c814fb8bfcc2de69f4c092b24e534a4b91
SHA25668859168b2e074e26e861bac67c0ec74745df9673621cd1965d8c058b723a2d2
SHA512d8e3a7bfd82d897af9b51653a4227a86e015854fc74ac250acf32b5a4c1663ca8155acc69359207ab0b70e5cb23f83751cf62a3a8060f44c45c1714e5b9a0c42
-
Filesize
512B
MD55d74b21efba501e13c24e8a007506154
SHA1b8f5b0c7af10bdfe005d15bad327d079e0f82092
SHA2569ac86f3a5e417e23edc8e99c84a3198d8442f0d3c6d1cb11d4597b41545b7a61
SHA5123e46e686d4f584768a0431bb4a112c5d474cbf0d6ac6aa2f7f341108cd8deb16a67af855e76cb53dbd029a9ecc0a13a88e44938de769efb7711a03b07a4f4530
-
Filesize
36KB
MD58da788c8611adca7508f7068ad4696b3
SHA1ab5bc03941a9ac3a924194935c273d492ffaa38e
SHA256395790d8095fae1949f5a5aa5c47bc63ce282769578ac4d9bc153bfaded442e3
SHA512bb3b76f759ce76b3866d83bf724fd0189a3f4c0347c374d9f29f205269e4a9e01907fffd8402b59a3c18feda074a8c4d4359b43d3425e3fa318436700f4c48cf
-
Filesize
512B
MD58fdcb96391b356a86d1b467491cdb4dc
SHA1528d2c4986e5ce745ab63d6689ea9a12bdfbcefc
SHA25690c5fc6f3bbeadf9f778493bcbf12f4daad66f862870e47c3c1c18e4ac3b2538
SHA51255856e16f4344d563b851a2c8814454db582e057e20791b843742deccafc11cd76738ad91a819ac9a091176868c2ffce0ca7b31beb32447cb523437e54d70fdf
-
Filesize
28KB
MD54036f6eaec0c42d3fa7844442ad169ce
SHA113623f28a08850819f4632d05411e6e259db6149
SHA2565db79d1be4e376380b40b71791148b7aa1d73f6beaac5c1e5f12487573097a76
SHA512edeebf06400e7ecb55eac6281dd3110b6b25adc65286e1ba885fd5e0562e15b6ff64d7612162350a879f2468b0f32bf2af7e3bf6f72701b7a00dccf5cc73c54c
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50a7c9b811111a966814109e6d44537c9
SHA18f2eabe9f56d1dc31ea71a4871fa95bfc8402a47
SHA2562619e5b7c98409a0b39dcd110f1656d93f44e45b0cdf81fb9378c33a6db61a16
SHA5120267532a11e444365b535e3026a22488fd586fe2a9adfbf642aee1f4d2b860bb282c939ee7113f66e3af38c1e03c6148615e4d0fbe8a10658def36856453af32
-
Filesize
56KB
MD52940ba710b1bb21e912c86a63b0faca2
SHA1fb430d1014e57708bc75702751c2b26f30696b70
SHA256ebdbba07edfcb8901e5445fe81a8d06753f072b1ee83cdb6ac3a4b00c026b906
SHA512eb217114fa8f381283058d14a2e19330101bb61b9f21ad48073b724e511d4981e3762f40b5941057b76e2a59e858e671f8229765d114eef82cda3b3ec44eeeae
-
Filesize
4KB
MD54ae4c6a3fe048407bc2e7ef047448fd9
SHA12cafeb53dc3f302d52346505f9243aff4964df67
SHA25645db83ebf9b4c8d0afc438aff4a27a13afd8a0897c2a41b8ce4981fe335904d0
SHA512ebbe58d34ad6404d825b5a56c57d580652113b633986a578b271fe13e6153faf36c05e6ec16f16f2112efaa8d9e4cadcbdf8324a6071407b396722d939707e47
-
Filesize
104KB
MD51494493137146bc1da8e7b80ad9b5b72
SHA15b055baaa923375c456c41d58afe425065321c27
SHA256843425482ab070834cec70a5587026f3a63cea98fd28c9658b9f3663f22ef504
SHA51256cf435d2295c6cb7584b5d2bc4df844fc0cfe7a6cd177980b67b28c2b571a27b551bf39d39920375020eb39c89809bf0cdeaa2b38cdc33b331301e5221564d9
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
96KB
MD5743048e5c1db85acb112fe971bafa762
SHA16e5e2e8f9db3347a41819b6cda19889d6c76239f
SHA256f88d401fc81b535ad24df359ed2e6dfd142f9bffb6c4164661bbc4ab7b8dc1dd
SHA512d53f1e58f0f24aaac409c480dd646ec6e2b41f9e45019867ec525ff891b7b15d264f7962b4ef122f2a4311486b50dd6225a5e1a9e2e84405d3b51a51b7a4ccc3
-
Filesize
512B
MD5e11040e673d0a6d20d885d77d61d6d56
SHA1da5bc929efcffc31cf2cdf990cbe3d92cb56b04e
SHA25680b084e54de80b81c5fa890d268b148ddaaf7860fb72260a9926b1b4055e6a52
SHA512fbed703c771748d35346d1ccc94474276d8d14b3a0728540da4aabc5e4369a284dfb6c19517eec177781bc726f8cfad0787806a28048fcd694b05527503a368b
-
Filesize
36KB
MD59dd386a89deb914b2cae19495aaa2a96
SHA1eefde7d854cd86f33318c0e5f0ff47787af3facd
SHA25609d53400bb32c0374cfe6f433c4610af4a814ba9fb2316018d3fd5fe0643906b
SHA512ba31f078a640e8576e2eec9c2d09e308dee1668f9142778465738b27631bcc374f01d8b2a7f61d13e83b3f8982f8d68d3c32dcc6e4260c928f8d2df0420535c8
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56