Analysis

  • max time kernel
    46s
  • max time network
    160s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    15-06-2024 05:04

General

  • Target

    acf7b82c588732c171fe8920ad812887_JaffaCakes118.apk

  • Size

    13.7MB

  • MD5

    acf7b82c588732c171fe8920ad812887

  • SHA1

    0d6a2b0fa9974debd8e71957e11b5ea0b9d0f138

  • SHA256

    52d488c072923b9d02483ab1d3108e28a0ce7f6f27be680dd3ac0cb7cf542f82

  • SHA512

    3eeace09a93a975f393c31ffd55f5723c03ce11e73630a06cddd089da77a9e04f1507e226219e5b0f09f62ee2dd06d276cfe42bf3b4d0acfea9874186a47727b

  • SSDEEP

    393216:2f/jQdeDMFXcqKBRMHOV5RYlM13wXm1jLLNQ5K:iSeDsXcLrMHOV5UMOW1/LSA

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.moji.mjweather
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4292
    • getprop ro.miui.ui.version.name
      2⤵
        PID:4335
      • /system/bin/sh -c getprop ro.board.platform
        2⤵
          PID:4354
        • getprop ro.board.platform
          2⤵
            PID:4354
          • /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
            2⤵
              PID:4383
            • /system/bin/sh -c type su
              2⤵
              • Checks if the Android device is rooted.
              PID:4402
            • getprop ro.miui.ui.version.name
              2⤵
                PID:4424
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:4449
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:4549
                  • getprop ro.miui.ui.version.name
                    2⤵
                      PID:4568

                  Network

                  MITRE ATT&CK Mobile v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • /data/data/com.moji.mjweather/databases/alarms.db

                    Filesize

                    4KB

                    MD5

                    f2b4b0190b9f384ca885f0c8c9b14700

                    SHA1

                    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

                    SHA256

                    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

                    SHA512

                    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

                  • /data/data/com.moji.mjweather/databases/alarms.db-journal

                    Filesize

                    512B

                    MD5

                    2d0ca2e5252e6532e3f246435f6bda04

                    SHA1

                    10b7797f155d044ed7b8aeead59397b978629ea6

                    SHA256

                    ba8fe3bde6252b98c2a83647072b902c00c3789d5a6a49c0be7bbfbb8bf54d99

                    SHA512

                    a40c21bfacadbd61cc7951e0e61885b48ef635a383218806e93adb2cfe82fc6d145630e6f04d96670e2ee30354da3f7311492bb1926cabfc72372168f0c8f244

                  • /data/data/com.moji.mjweather/databases/alarms.db-shm

                    Filesize

                    32KB

                    MD5

                    bb7df04e1b0a2570657527a7e108ae23

                    SHA1

                    5188431849b4613152fd7bdba6a3ff0a4fd6424b

                    SHA256

                    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

                    SHA512

                    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

                  • /data/data/com.moji.mjweather/databases/alarms.db-wal

                    Filesize

                    32KB

                    MD5

                    7fde38812378bffcfefc5537ab9240c6

                    SHA1

                    76e758f4a65f29118b4a87c9594a1ee90f8066eb

                    SHA256

                    4cf98ce7aa402e25a492f7fe486e05e6629709c3857bb3a92f0a9f477eca4335

                    SHA512

                    48cf20439cfff841e7bcf45bb441b3c513dba5448b553105bdbb26175db770e295f3f3b87121a940d9384bfbf36bb3205ffb00a2a3cf1ea675561acf40c3c438

                  • /data/data/com.moji.mjweather/databases/bugly_db_-journal

                    Filesize

                    512B

                    MD5

                    9def84e9ba2cd078cb5a5bd22868ab58

                    SHA1

                    34c12771a6b43fa58c1f1d0dffb3b38a21298f79

                    SHA256

                    2e9c2ee601368df6519c4ebc0736ee6e87bed58c5b2baef57338b5d0ef570b70

                    SHA512

                    794e918117469d2bac2a3447eb779a47529cd7f004296b7c9f373035b46922b1eddab572d02194f86a443bac837ed4b701997ea14268610ef15951f7c262694c

                  • /data/data/com.moji.mjweather/databases/bugly_db_-wal

                    Filesize

                    92KB

                    MD5

                    2588f8f5835f47390cb36ff7f70d448c

                    SHA1

                    1e1375c6d2511a8a6af0269c4481e8aa5d140333

                    SHA256

                    9f565cb6547fb8c3ab110ce740e90a060e2fbb0ed31216f99c98fd955f8fefa3

                    SHA512

                    7b4524a261326f3fdb19544a8b51092029b7e75abdc1bf45b652c950ce839b09f305fbb21f5df485880f7de2df47773a4c76cb84bedcc7acb04fa306a0e64424

                  • /data/data/com.moji.mjweather/databases/db

                    Filesize

                    12KB

                    MD5

                    b0ef4ca8e16d8d658a2d4a54206c0f2a

                    SHA1

                    038202098136d1c85a74d17851cb0ed0de625108

                    SHA256

                    7edf7cb0d5c445429d7ed2867d2876daa48a72a09d0281ed3cae675669dbd9c7

                    SHA512

                    81cef3b55fd580d406bdc8c45b15f95d2258999f7077b5daa0b3850ee16c4d3fb3aa3963003be8de797a8c7e4867999d40369c59e845daee6f1f8756f72e6951

                  • /data/data/com.moji.mjweather/databases/db-journal

                    Filesize

                    512B

                    MD5

                    a1da76284dc489d0c933d174c19595b4

                    SHA1

                    7edbf48598baf9c78afd2752ac4dac545e379c5e

                    SHA256

                    a2b400852cadfe91058f794dcf671828aaadc7bce9af16e20c52d0ca8945b205

                    SHA512

                    6159456c5832f0e6a6081cf1696d59f63cdf736440594e0f31944fd65f3390925f591cb67b5f33f91dc7d85900fa498bf4c69b89c079b769eab09ef89e10392e

                  • /data/data/com.moji.mjweather/databases/db-wal

                    Filesize

                    16KB

                    MD5

                    18c2c46e3750ca0db541ec1a523a9a5a

                    SHA1

                    1ffb4ef8fbae3a567753960bd504bb624db51253

                    SHA256

                    40311af75b70001dfb702c7f551974c4ab833af9ece216bd9a7b46a7fc06efdc

                    SHA512

                    ac0428cd5eeb3cc3d1617036e94a634cd5873c4e82c3f72d74a480378d45c4d5caf39ee011115dbf0cdac7510889d6aadb7ff8e5e795a02a2bf66d2fefa69d42

                  • /data/data/com.moji.mjweather/databases/dynamicamapfile.db

                    Filesize

                    20KB

                    MD5

                    bdc9fd0fe2c7dd88e3fd3a3b455e35bb

                    SHA1

                    8819a3137213af03a57269a26c0bd5990f7dd239

                    SHA256

                    577571f576541a2d19d1d4d58eb4fae566b94729c42b25f116dc3f422f31117b

                    SHA512

                    6987fe9beb000f53bba1b4fbb07792902a9c065fdfdc1d337ada7f2ee0bc7e945358711b9b9e489c8690a668182f889c7f6c543d3d3accff4131679a55c7c65b

                  • /data/data/com.moji.mjweather/databases/dynamicamapfile.db-journal

                    Filesize

                    512B

                    MD5

                    21786e82815997d743502da924082c2e

                    SHA1

                    3cee048e2a63465c884a3f087dc9e0a85b958a09

                    SHA256

                    216f34e3f89bdff5fee0fce05ca521ff7e08f2172511adde98d54f9c6b14c0e7

                    SHA512

                    2801b9df1bc163ff162db2a0eb5fbe9358657fc822af78f03944db229814d70d7f938ed2d73c9292860f3e4bd2d54c94266363711704b98f3edee6746db26300

                  • /data/data/com.moji.mjweather/databases/dynamicamapfile.db-wal

                    Filesize

                    32KB

                    MD5

                    c81a8134d743eeaeb1dc43988cf25ac1

                    SHA1

                    a6a6c4351c457b294515f71dfebef4a9a3364068

                    SHA256

                    037a5d4467333d7c5516ecc48cc3f5be91c06b99d5a4df647fa6d0bb2e3608c9

                    SHA512

                    71002ce1a701bf16834684fa5f212a486fd5ab33c6d50e65a13c1c67f0d4fe8ecad02be1f9d6806e01ee0979e6868885500c67e2b3d3c46be43489da7e15b07f

                  • /data/data/com.moji.mjweather/databases/mojicity7.db

                    Filesize

                    1.1MB

                    MD5

                    d76a17b7f6d5d384812a0a4513dc2ed4

                    SHA1

                    7f2e5f4b96c65e2baa8dde2724a19fa8f3f11134

                    SHA256

                    6ab8718d6dacc6d60b21926a0c05167b0731173f7e5a72480b842e360cd11722

                    SHA512

                    5958f1e9c5d97b8330ff1297a19c23cad978d43ab18bdf38f98500fdf3601664425bcc188fba4ec5c148f0480636d08749619ae59e8383a6922f8bc729bb2515

                  • /data/data/com.moji.mjweather/databases/mojicity7.db

                    Filesize

                    1.0MB

                    MD5

                    7e563fb4d865e3290e2d4d78a11619be

                    SHA1

                    81e2560ce7262bded7cb0f44aa1bb426e82b7a80

                    SHA256

                    7bf640f21883f2b237254b934752fd72189b2606e6c9a2cd0c4b9e5a39fcf081

                    SHA512

                    315f38488dbcbb5c61ae3110c234733928b0dc2b2ec36d0b3641cecbfc3ec53f2d9e6f3496d5720572e2fe995eac3b268ec07029b1addc13125327b82453e7bd

                  • /data/data/com.moji.mjweather/databases/mojicity7.db-journal

                    Filesize

                    1KB

                    MD5

                    276381cee1e380d7c222a6edaf1cb4bc

                    SHA1

                    147f8a73e74b910218aeb7fba07be472bdfe8368

                    SHA256

                    f759f14597d905fd9ec870adfa11c61f55a92f6f5634b5fc8e6a967ad68aa05b

                    SHA512

                    0835ad7ad3a152db941bc92fb3110bf64ea4a1d950e80bc084b66daa4073995a2f1e965c3ab63fa0f4d6ea3b61e000a5ea4c69987b7ee1aa3f45980aa0001eb0

                  • /data/data/com.moji.mjweather/databases/mojicity7.db-wal

                    Filesize

                    5KB

                    MD5

                    255b331a1c32e6a538742c91c385b1bb

                    SHA1

                    b8ece7c322b18f073865ccb740e0d148037369fc

                    SHA256

                    89559bc26567bcc07e65c7e72980ffdc5df5558134cfccf21c3ef3abe9225467

                    SHA512

                    2d5e709088b13daa021adcd5a98cc61f13fd5d96ea5b61a10d0595cf08181ad5607d36799fb9dba25ed182f121dc477e94e47472ea87869904bdccea2c70548b

                  • /data/data/com.moji.mjweather/files/.imprint

                    Filesize

                    1002B

                    MD5

                    1a29d6e4a1df61de6bc92049eaf3ed31

                    SHA1

                    8f5a421fe3866ad4c8823436e40fb73997b34b7a

                    SHA256

                    35cf47f610694dff871e090c1ef77700d89477a19607e4104a27dcb001767207

                    SHA512

                    ec9b0f61602d8ce1d39eb093328463476d97b21dc1dd069decb6af51d96d306d6db4e9e17dcab1ebe298132cd63b36229992d1246cfa2ece11ab5cfac5f43a43

                  • /data/data/com.moji.mjweather/files/.umeng/exchangeIdentity.json

                    Filesize

                    162B

                    MD5

                    773294bbc5f480c37a2fa4352a9b5283

                    SHA1

                    ae75b930d71a29aaeed92804144c890958eb390c

                    SHA256

                    a4ecb681440b80f4dd71d511a395ca26d2fd5b6c603e5c60109a9d849cdafe01

                    SHA512

                    f8e720a7a4f8d11135c5883d05d4f7fa1ac0adad65bd183fbd7bca076feb2acc1c6bd609742ee46d6ff27693ab7d8cd160218f58bd334334b4640977b21968e7

                  • /data/data/com.moji.mjweather/files/buglylog_com.moji.mjweather_.txt

                    Filesize

                    4KB

                    MD5

                    e0d95c93172300b594501bc5858389c7

                    SHA1

                    9b654f2595e6615934c109bf93c272c59c496b47

                    SHA256

                    bcdf0b19c2b3d2cca4b4d872e46a317c1417edf1640cad5a3b7e7502e4cb3679

                    SHA512

                    a416515b4c4ab7ecce55027444ee51905747b5d3d614e838b7472e07e9a2c5ab0cfcc6c009d45866d18da8371dbd6a99a435c88ae4a0cbc9654a05737384481f

                  • /data/data/com.moji.mjweather/files/buglylog_com.moji.mjweather_.txt

                    Filesize

                    1KB

                    MD5

                    cbd32b334fc075eac4e5dc22972fb56c

                    SHA1

                    9f5b6d0686f24e5c57ed7f0cd4a56bb79c424969

                    SHA256

                    9920091b494689a74994384b8ffff575537b98d29fb52e2e6f41c30bf873db5e

                    SHA512

                    47ecf1848b1d476a4320ce3a393c0bea813877d6436b3a652c8b163c31e2e3a5db5b13dd18893d7eb513ab47200e9285a76573e08f6f8d3c0ee02f88eaf1170a

                  • /data/data/com.moji.mjweather/files/buglylog_com.moji.mjweather_.txt

                    Filesize

                    4KB

                    MD5

                    9e8c8b8da230347b8ea5552792f65aa1

                    SHA1

                    a902b041ae7ffd3c4a696286c5b2859d4660996d

                    SHA256

                    ffc0b3c8f123c4a797f67f54260a7df42d5e6c161b23225d866f813c9d2e4ec1

                    SHA512

                    e1a6eb4781d8380f1393e080d6de32e05f51d6dcb4994d90e053397bc45663e405a55dc5feef8118d300c414bb0b22c8613c6b7d0eec1ee11f3552499a753b0b

                  • /data/data/com.moji.mjweather/files/buglylog_com.moji.mjweather_.txt

                    Filesize

                    59B

                    MD5

                    552eab26bd59e91f94b8e8a707d3cee0

                    SHA1

                    c3900bcc281513abdc096f6582074785f7141fd7

                    SHA256

                    a6bed9c3017224e9bd3681fe329fdb1ff117f9a9b8ee4f5ee9c9b1db4c2344c1

                    SHA512

                    6f79b1e75f01385662557eea8a0d4cad623048e0f74efc03f502e8f15d319679929037d260f822fbef66b9d35ada19ccf1d86aacd76f9af0b5d44be85effdbf9

                  • /data/data/com.moji.mjweather/files/umeng_it.cache

                    Filesize

                    310B

                    MD5

                    035b1ff48c59226c623f3ededfd4432c

                    SHA1

                    dcce933063268a6933190222908a1a814afaca8e

                    SHA256

                    ad0daae799c8a4e89aeeefe24b1121551b510cc8b0334358c5ecd225a59190aa

                    SHA512

                    0aa9ca73f84733b576ea7845eae0c01779b7088a04666a32e10763f7fde71d8cc5cf5b5e449fe3f79b2509ef4d48949018e149f274c2cd429d500d8a6d1d1c91

                  • /data/data/com.moji.mjweather/files/umeng_it.cache

                    Filesize

                    158B

                    MD5

                    720e0a94e7db5ea280a7cb65c11a3e1f

                    SHA1

                    efbe1d67a8ac4d2b8d8a6b58e91609e0305fe653

                    SHA256

                    d57db95e8e242ecf8718db731a5ea74c96f24f87b76884b03e3dcd1f3c90b7b1

                    SHA512

                    1b4ea07154ae0abcfb3775bfb05481d75e61f4ac74faa4f8a4ac71f35cd25e426452bb3d85239d07c4347fa839181ef943c6da09073eff476556059e66c708a4

                  • /storage/emulated/0/moji/temp/lla.log

                    Filesize

                    289B

                    MD5

                    3466566946a9f5b905381fa260ca00ed

                    SHA1

                    352f6bbc38f78314aaf5d8d704e97e92246e77a8

                    SHA256

                    fe21933294e1c4e499ef787a357a93613e97ad2cbff2486ab0a3ebbb75c3f27f

                    SHA512

                    94d1df881a06c3c2c447ff5a0684f386e52faa760ef7e51aa63d707ea44c6a45303faa38a5dcdc62b9d1be5370360f085e176044549459fa4025da42e9ce0b85

                  • /storage/emulated/0/moji/temp/lla.log

                    Filesize

                    298B

                    MD5

                    95410f80e2fa8c76db6fed3cf1fa3a89

                    SHA1

                    75280ad0e6d914b6ffafeb71719101a15b368bc2

                    SHA256

                    f0e8a81cd4248d4a1a55d35c92a781214af3040a999190675c4a9c04ac0733c2

                    SHA512

                    a46d1b32270e237b74f09ee7dcd9deaa943437017bf269f9805d3a84d49a2eab78c7d5c9fedf63dabd67bd4aa19f30bfa8305a0fcf6773cc49f35bb0c7345f0d

                  • /storage/emulated/0/moji/temp/lla.log

                    Filesize

                    292B

                    MD5

                    a0c79a6dd07411ae4541a11a78f69e41

                    SHA1

                    5d3054b8fbca9d47e0c32de9437587f379681775

                    SHA256

                    335c6ba4f3cd4b1ab3427fbb78347bba48f845f626fefd1ea9fa0a95ff185138

                    SHA512

                    15a590473992064388dc090758e6b434d2480ca317c4a9d9ae96b90c969ac0288d37b1aa252aa82d5054b4e727d4ca6e5669d5dcfb8187c8641b05ad699d0822