Analysis
-
max time kernel
46s -
max time network
160s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system -
submitted
15-06-2024 05:04
Static task
static1
Behavioral task
behavioral1
Sample
acf7b82c588732c171fe8920ad812887_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
acf7b82c588732c171fe8920ad812887_JaffaCakes118.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
__pasys_remote_feeds.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral4
Sample
__pasys_remote_feeds.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral5
Sample
__pasys_remote_feeds.apk
Resource
android-x64-arm64-20240611.1-en
Behavioral task
behavioral6
Sample
gdtadv2.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral7
Sample
gdtadv2.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral8
Sample
gdtadv2.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
acf7b82c588732c171fe8920ad812887_JaffaCakes118.apk
-
Size
13.7MB
-
MD5
acf7b82c588732c171fe8920ad812887
-
SHA1
0d6a2b0fa9974debd8e71957e11b5ea0b9d0f138
-
SHA256
52d488c072923b9d02483ab1d3108e28a0ce7f6f27be680dd3ac0cb7cf542f82
-
SHA512
3eeace09a93a975f393c31ffd55f5723c03ce11e73630a06cddd089da77a9e04f1507e226219e5b0f09f62ee2dd06d276cfe42bf3b4d0acfea9874186a47727b
-
SSDEEP
393216:2f/jQdeDMFXcqKBRMHOV5RYlM13wXm1jLLNQ5K:iSeDsXcLrMHOV5UMOW1/LSA
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.moji.mjweather/system/bin/sh -c type suioc process /system/app/Superuser.apk com.moji.mjweather /sbin/su /system/bin/sh -c type su -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.moji.mjweatherdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.moji.mjweather -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
com.moji.mjweatherdescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults com.moji.mjweather -
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.moji.mjweatherdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.moji.mjweather -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
Processes:
flow ioc 27 alog.umeng.com -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.moji.mjweatherdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.moji.mjweather -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.moji.mjweatherdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.moji.mjweather -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.moji.mjweatherdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.moji.mjweather -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.moji.mjweatherdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.moji.mjweather -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.moji.mjweatherdescription ioc process File opened for read /proc/cpuinfo com.moji.mjweather -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.moji.mjweatherdescription ioc process File opened for read /proc/meminfo com.moji.mjweather
Processes
-
com.moji.mjweather1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4292 -
getprop ro.miui.ui.version.name2⤵PID:4335
-
/system/bin/sh -c getprop ro.board.platform2⤵PID:4354
-
getprop ro.board.platform2⤵PID:4354
-
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq2⤵PID:4383
-
/system/bin/sh -c type su2⤵
- Checks if the Android device is rooted.
PID:4402 -
getprop ro.miui.ui.version.name2⤵PID:4424
-
getprop ro.miui.ui.version.name2⤵PID:4449
-
getprop ro.miui.ui.version.name2⤵PID:4549
-
getprop ro.miui.ui.version.name2⤵PID:4568
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD52d0ca2e5252e6532e3f246435f6bda04
SHA110b7797f155d044ed7b8aeead59397b978629ea6
SHA256ba8fe3bde6252b98c2a83647072b902c00c3789d5a6a49c0be7bbfbb8bf54d99
SHA512a40c21bfacadbd61cc7951e0e61885b48ef635a383218806e93adb2cfe82fc6d145630e6f04d96670e2ee30354da3f7311492bb1926cabfc72372168f0c8f244
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
32KB
MD57fde38812378bffcfefc5537ab9240c6
SHA176e758f4a65f29118b4a87c9594a1ee90f8066eb
SHA2564cf98ce7aa402e25a492f7fe486e05e6629709c3857bb3a92f0a9f477eca4335
SHA51248cf20439cfff841e7bcf45bb441b3c513dba5448b553105bdbb26175db770e295f3f3b87121a940d9384bfbf36bb3205ffb00a2a3cf1ea675561acf40c3c438
-
Filesize
512B
MD59def84e9ba2cd078cb5a5bd22868ab58
SHA134c12771a6b43fa58c1f1d0dffb3b38a21298f79
SHA2562e9c2ee601368df6519c4ebc0736ee6e87bed58c5b2baef57338b5d0ef570b70
SHA512794e918117469d2bac2a3447eb779a47529cd7f004296b7c9f373035b46922b1eddab572d02194f86a443bac837ed4b701997ea14268610ef15951f7c262694c
-
Filesize
92KB
MD52588f8f5835f47390cb36ff7f70d448c
SHA11e1375c6d2511a8a6af0269c4481e8aa5d140333
SHA2569f565cb6547fb8c3ab110ce740e90a060e2fbb0ed31216f99c98fd955f8fefa3
SHA5127b4524a261326f3fdb19544a8b51092029b7e75abdc1bf45b652c950ce839b09f305fbb21f5df485880f7de2df47773a4c76cb84bedcc7acb04fa306a0e64424
-
Filesize
12KB
MD5b0ef4ca8e16d8d658a2d4a54206c0f2a
SHA1038202098136d1c85a74d17851cb0ed0de625108
SHA2567edf7cb0d5c445429d7ed2867d2876daa48a72a09d0281ed3cae675669dbd9c7
SHA51281cef3b55fd580d406bdc8c45b15f95d2258999f7077b5daa0b3850ee16c4d3fb3aa3963003be8de797a8c7e4867999d40369c59e845daee6f1f8756f72e6951
-
Filesize
512B
MD5a1da76284dc489d0c933d174c19595b4
SHA17edbf48598baf9c78afd2752ac4dac545e379c5e
SHA256a2b400852cadfe91058f794dcf671828aaadc7bce9af16e20c52d0ca8945b205
SHA5126159456c5832f0e6a6081cf1696d59f63cdf736440594e0f31944fd65f3390925f591cb67b5f33f91dc7d85900fa498bf4c69b89c079b769eab09ef89e10392e
-
Filesize
16KB
MD518c2c46e3750ca0db541ec1a523a9a5a
SHA11ffb4ef8fbae3a567753960bd504bb624db51253
SHA25640311af75b70001dfb702c7f551974c4ab833af9ece216bd9a7b46a7fc06efdc
SHA512ac0428cd5eeb3cc3d1617036e94a634cd5873c4e82c3f72d74a480378d45c4d5caf39ee011115dbf0cdac7510889d6aadb7ff8e5e795a02a2bf66d2fefa69d42
-
Filesize
20KB
MD5bdc9fd0fe2c7dd88e3fd3a3b455e35bb
SHA18819a3137213af03a57269a26c0bd5990f7dd239
SHA256577571f576541a2d19d1d4d58eb4fae566b94729c42b25f116dc3f422f31117b
SHA5126987fe9beb000f53bba1b4fbb07792902a9c065fdfdc1d337ada7f2ee0bc7e945358711b9b9e489c8690a668182f889c7f6c543d3d3accff4131679a55c7c65b
-
Filesize
512B
MD521786e82815997d743502da924082c2e
SHA13cee048e2a63465c884a3f087dc9e0a85b958a09
SHA256216f34e3f89bdff5fee0fce05ca521ff7e08f2172511adde98d54f9c6b14c0e7
SHA5122801b9df1bc163ff162db2a0eb5fbe9358657fc822af78f03944db229814d70d7f938ed2d73c9292860f3e4bd2d54c94266363711704b98f3edee6746db26300
-
Filesize
32KB
MD5c81a8134d743eeaeb1dc43988cf25ac1
SHA1a6a6c4351c457b294515f71dfebef4a9a3364068
SHA256037a5d4467333d7c5516ecc48cc3f5be91c06b99d5a4df647fa6d0bb2e3608c9
SHA51271002ce1a701bf16834684fa5f212a486fd5ab33c6d50e65a13c1c67f0d4fe8ecad02be1f9d6806e01ee0979e6868885500c67e2b3d3c46be43489da7e15b07f
-
Filesize
1.1MB
MD5d76a17b7f6d5d384812a0a4513dc2ed4
SHA17f2e5f4b96c65e2baa8dde2724a19fa8f3f11134
SHA2566ab8718d6dacc6d60b21926a0c05167b0731173f7e5a72480b842e360cd11722
SHA5125958f1e9c5d97b8330ff1297a19c23cad978d43ab18bdf38f98500fdf3601664425bcc188fba4ec5c148f0480636d08749619ae59e8383a6922f8bc729bb2515
-
Filesize
1.0MB
MD57e563fb4d865e3290e2d4d78a11619be
SHA181e2560ce7262bded7cb0f44aa1bb426e82b7a80
SHA2567bf640f21883f2b237254b934752fd72189b2606e6c9a2cd0c4b9e5a39fcf081
SHA512315f38488dbcbb5c61ae3110c234733928b0dc2b2ec36d0b3641cecbfc3ec53f2d9e6f3496d5720572e2fe995eac3b268ec07029b1addc13125327b82453e7bd
-
Filesize
1KB
MD5276381cee1e380d7c222a6edaf1cb4bc
SHA1147f8a73e74b910218aeb7fba07be472bdfe8368
SHA256f759f14597d905fd9ec870adfa11c61f55a92f6f5634b5fc8e6a967ad68aa05b
SHA5120835ad7ad3a152db941bc92fb3110bf64ea4a1d950e80bc084b66daa4073995a2f1e965c3ab63fa0f4d6ea3b61e000a5ea4c69987b7ee1aa3f45980aa0001eb0
-
Filesize
5KB
MD5255b331a1c32e6a538742c91c385b1bb
SHA1b8ece7c322b18f073865ccb740e0d148037369fc
SHA25689559bc26567bcc07e65c7e72980ffdc5df5558134cfccf21c3ef3abe9225467
SHA5122d5e709088b13daa021adcd5a98cc61f13fd5d96ea5b61a10d0595cf08181ad5607d36799fb9dba25ed182f121dc477e94e47472ea87869904bdccea2c70548b
-
Filesize
1002B
MD51a29d6e4a1df61de6bc92049eaf3ed31
SHA18f5a421fe3866ad4c8823436e40fb73997b34b7a
SHA25635cf47f610694dff871e090c1ef77700d89477a19607e4104a27dcb001767207
SHA512ec9b0f61602d8ce1d39eb093328463476d97b21dc1dd069decb6af51d96d306d6db4e9e17dcab1ebe298132cd63b36229992d1246cfa2ece11ab5cfac5f43a43
-
Filesize
162B
MD5773294bbc5f480c37a2fa4352a9b5283
SHA1ae75b930d71a29aaeed92804144c890958eb390c
SHA256a4ecb681440b80f4dd71d511a395ca26d2fd5b6c603e5c60109a9d849cdafe01
SHA512f8e720a7a4f8d11135c5883d05d4f7fa1ac0adad65bd183fbd7bca076feb2acc1c6bd609742ee46d6ff27693ab7d8cd160218f58bd334334b4640977b21968e7
-
Filesize
4KB
MD5e0d95c93172300b594501bc5858389c7
SHA19b654f2595e6615934c109bf93c272c59c496b47
SHA256bcdf0b19c2b3d2cca4b4d872e46a317c1417edf1640cad5a3b7e7502e4cb3679
SHA512a416515b4c4ab7ecce55027444ee51905747b5d3d614e838b7472e07e9a2c5ab0cfcc6c009d45866d18da8371dbd6a99a435c88ae4a0cbc9654a05737384481f
-
Filesize
1KB
MD5cbd32b334fc075eac4e5dc22972fb56c
SHA19f5b6d0686f24e5c57ed7f0cd4a56bb79c424969
SHA2569920091b494689a74994384b8ffff575537b98d29fb52e2e6f41c30bf873db5e
SHA51247ecf1848b1d476a4320ce3a393c0bea813877d6436b3a652c8b163c31e2e3a5db5b13dd18893d7eb513ab47200e9285a76573e08f6f8d3c0ee02f88eaf1170a
-
Filesize
4KB
MD59e8c8b8da230347b8ea5552792f65aa1
SHA1a902b041ae7ffd3c4a696286c5b2859d4660996d
SHA256ffc0b3c8f123c4a797f67f54260a7df42d5e6c161b23225d866f813c9d2e4ec1
SHA512e1a6eb4781d8380f1393e080d6de32e05f51d6dcb4994d90e053397bc45663e405a55dc5feef8118d300c414bb0b22c8613c6b7d0eec1ee11f3552499a753b0b
-
Filesize
59B
MD5552eab26bd59e91f94b8e8a707d3cee0
SHA1c3900bcc281513abdc096f6582074785f7141fd7
SHA256a6bed9c3017224e9bd3681fe329fdb1ff117f9a9b8ee4f5ee9c9b1db4c2344c1
SHA5126f79b1e75f01385662557eea8a0d4cad623048e0f74efc03f502e8f15d319679929037d260f822fbef66b9d35ada19ccf1d86aacd76f9af0b5d44be85effdbf9
-
Filesize
310B
MD5035b1ff48c59226c623f3ededfd4432c
SHA1dcce933063268a6933190222908a1a814afaca8e
SHA256ad0daae799c8a4e89aeeefe24b1121551b510cc8b0334358c5ecd225a59190aa
SHA5120aa9ca73f84733b576ea7845eae0c01779b7088a04666a32e10763f7fde71d8cc5cf5b5e449fe3f79b2509ef4d48949018e149f274c2cd429d500d8a6d1d1c91
-
Filesize
158B
MD5720e0a94e7db5ea280a7cb65c11a3e1f
SHA1efbe1d67a8ac4d2b8d8a6b58e91609e0305fe653
SHA256d57db95e8e242ecf8718db731a5ea74c96f24f87b76884b03e3dcd1f3c90b7b1
SHA5121b4ea07154ae0abcfb3775bfb05481d75e61f4ac74faa4f8a4ac71f35cd25e426452bb3d85239d07c4347fa839181ef943c6da09073eff476556059e66c708a4
-
Filesize
289B
MD53466566946a9f5b905381fa260ca00ed
SHA1352f6bbc38f78314aaf5d8d704e97e92246e77a8
SHA256fe21933294e1c4e499ef787a357a93613e97ad2cbff2486ab0a3ebbb75c3f27f
SHA51294d1df881a06c3c2c447ff5a0684f386e52faa760ef7e51aa63d707ea44c6a45303faa38a5dcdc62b9d1be5370360f085e176044549459fa4025da42e9ce0b85
-
Filesize
298B
MD595410f80e2fa8c76db6fed3cf1fa3a89
SHA175280ad0e6d914b6ffafeb71719101a15b368bc2
SHA256f0e8a81cd4248d4a1a55d35c92a781214af3040a999190675c4a9c04ac0733c2
SHA512a46d1b32270e237b74f09ee7dcd9deaa943437017bf269f9805d3a84d49a2eab78c7d5c9fedf63dabd67bd4aa19f30bfa8305a0fcf6773cc49f35bb0c7345f0d
-
Filesize
292B
MD5a0c79a6dd07411ae4541a11a78f69e41
SHA15d3054b8fbca9d47e0c32de9437587f379681775
SHA256335c6ba4f3cd4b1ab3427fbb78347bba48f845f626fefd1ea9fa0a95ff185138
SHA51215a590473992064388dc090758e6b434d2480ca317c4a9d9ae96b90c969ac0288d37b1aa252aa82d5054b4e727d4ca6e5669d5dcfb8187c8641b05ad699d0822