Analysis
-
max time kernel
178s -
max time network
183s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
-
submitted
15-06-2024 18:32
General
-
Target
afcaa344d9409237786f2fc800b09733_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
afcaa344d9409237786f2fc800b09733
-
SHA1
d9b7dc002e8abf30b014adce00cb95ce20a5595e
-
SHA256
7f9662785c10c4d97f0c67c8f7361cb0b8d61865c40837b6abe6d447e352d10a
-
SHA512
3c7bae662969c3e1918737cb72bca90eedc445d001ff1d86fe476fb89cd2ea733f97c793b425272222d9722bf7e1e3f4715599033f4f4a2df25e1ef0cbfbe776
-
SSDEEP
24576:soL0otaYtXMLep2sepAvb6vsm0ZGpUvb2jno+Ocjql+q/13tdHbZKm51Ob83d:TQ7YthFeGv0sKUvb2jbXjql+q/1XHNKs
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
com.eexs.tnzw.vjcd1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
-
com.eexs.tnzw.vjcd:daemon1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.eexs.tnzw.vjcd/app_mjf/ddz.jarFilesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
/data/data/com.eexs.tnzw.vjcd/app_mjf/oat/dz.jar.cur.profFilesize
524B
MD5ad834ed210ff5f8191af408a1d5c9650
SHA1c283217496d5e8f97888c820ceb0eb94c6dd91c1
SHA25660699d90ae79e5e51e080e48d80fe2b659b746d708a1f47d8dbd21ab30bcbca2
SHA5129e73b4ff5b957b839a1519e51341ec2b92009636522b65ecc464120b3abd12663d463a904689716be5792671a1def6a898e89c155166fd2c2fa57275910eeaf7
-
/data/data/com.eexs.tnzw.vjcd/app_mjf/tdz.jarFilesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
/data/data/com.eexs.tnzw.vjcd/databases/lezzdFilesize
28KB
MD5dae68dcffc3d522a79f98ebbc3b6d457
SHA16df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA25656cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA51223b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
-
/data/data/com.eexs.tnzw.vjcd/databases/lezzd-journalFilesize
8KB
MD5ae6cb8c90f08b150de76398254d26a40
SHA116ba9932e7ff3166ae2acdb009687a6be2ce6bec
SHA256160e7b6c978c49a202704a2ab43dab7433224e727ce5a6bac623cd6b46837073
SHA512570d75658ffa97e1c37b62a952c1d963fc82dd1d4b7ab548abcbae6a4e69bc17dbc5a4d25c7a6e19139f4bd701a70f45e91a5c02ad6806d756436f49ff7dd9dd
-
/data/data/com.eexs.tnzw.vjcd/databases/lezzd-journalFilesize
512B
MD5f3b5e1d840a413fec0f91e9203e52b05
SHA1888295acb0e447ec9ab1034ef2a1ea8029ce9bc4
SHA256b453d75b542f50862ca45ce814cd7231182ea18e15c69837b97bf1ba2caff85a
SHA51265eb9ba0b30af43bccd78671ef81912199c2e24927dce2654f8ab867197e82818a61b6a531ee791b4bb36bb80dcd126689eeb5e8adea5d3ac66b0914bdd68239
-
/data/data/com.eexs.tnzw.vjcd/databases/lezzd-journalFilesize
8KB
MD5e3c58d8c8761bb336d4cb1dc4e08cbc6
SHA1a9790219c3bdf1cf2742a3b8aa1cedd608731693
SHA256b53f9023f9835fd1a5cb50c100a12fbf62dfbe9222ff999577cecf3bc87eef37
SHA5121b6f2759eba6636c3f5c65b6f55cbc1f9e856d364737c6ae4e723df1268e857d801f211c56f94c6d3e363e9fa08c84e7816e76e9a24ef1dbf46c447b49e82379
-
/data/data/com.eexs.tnzw.vjcd/databases/lezzd-journalFilesize
4KB
MD566556dbd61d404f1da0e74b2bde0e0e9
SHA1113c9581c0ab7e2fa862b864fa54c27f8d36eca9
SHA25698e6f4f3155aa2297a37f0dd12148e8772d7a8219a554bc0ee4037f634549586
SHA5125d66433b51efb32f3b3ee214dcc21d45049f9ff61c17ad11f2a8ae4b3b9d429e5261d9cfb0d5c437c96da369b943edb77d9da3f0ea6ad29e7f318daf40e51db4
-
/data/data/com.eexs.tnzw.vjcd/databases/lezzd-journalFilesize
8KB
MD52e50dd35723de13bdaec75d1da5ce6ef
SHA1daf9201f951ec2e5361568dec41ebb7cdebbb8b1
SHA2561d600d8b552e0f2b99a8f1385bfa931dca7fd7da1b2114baedbdc625aa53f922
SHA512ee7c1821d1957b0f8d4014fc20d9e18761ae84c1a5c0ff7981a85dd684147a5fa82e24e43fcd7075f0cf12ec2069021c2c8d61b12fcbc6f003b7c8122276c11c
-
/data/data/com.eexs.tnzw.vjcd/databases/lezzd-journalFilesize
8KB
MD50a2d2531071b707869968ace5222dc41
SHA127240fd300651cbe2ad3a7f7221a5547cc1c406b
SHA2567f154e5c63a82ba018009aefa2df518707268358f7ecc37d5f86ca4b42946cac
SHA5128bb061c3580f686640129b65b070e090c0b213890daf3fbbb9e647a84406229af1b1fdf65e10090b6465e3626dd7af81fce9912f44e93e8b7504b6ecea8bc198
-
/data/data/com.eexs.tnzw.vjcd/files/.um/um_cache_1718476733201.envFilesize
658B
MD5e47f731ab7dda1279590bafb2cc32fa8
SHA177513b8f897ed99e289dedae36c465c139770396
SHA2567821697093f545ac3db7f374f9792b616512ed0394bbf74e3c379c68b36bdb50
SHA51201db51801f58a84f217d5486a88815e0b363325d6a438efb0c7d2c654c060b40ccc2e0af299fdce28b337b08c339e70124bd9dfa8a71d2d3758cf4808ec201d1
-
/data/data/com.eexs.tnzw.vjcd/files/.umeng/exchangeIdentity.jsonFilesize
162B
MD55b5c2fb62955ba66ca20130fdf170167
SHA168230145dbce054fde82898b6623045b564c8ea7
SHA25696b38d4b19222d9a46e82dab29e4649b7e17ee509a4a5663bdbb4f8d846f1762
SHA512e11aa61b2d4332cae56f563d64f759a43c07008bdc1def6c176fc883840066eb128dfd7b2dbc0c699b7db70b81fec93debf170367f6c4b6d1ab096a8a0d5c6dd
-
/data/data/com.eexs.tnzw.vjcd/files/mobclick_agent_cached_com.eexs.tnzw.vjcd1Filesize
797B
MD5a1247868fcaed2d7d9456b27bcc4acd9
SHA1ede6d00a40dfc00e8b3536d7951ce43a8dda0223
SHA256effc45092540ea66756e0567a6f027bbccaccbf924a74c5fe78a63f087abd1a0
SHA512c59fb86cbe0ab6aaa43778a68b63d0f029be46d36ca1d29150b8f6a451e0926a08fc43b6402f8749aefcd15f1dff8044b5ece59fdb46c2c7cebb92548e393507
-
/data/data/com.eexs.tnzw.vjcd/files/umeng_it.cacheFilesize
352B
MD550f474265de70e429bfd08855e072e0a
SHA1359ddebf6d1a139708fd8af0964cda741a3ff165
SHA256c986e63c5032a4241667fb2876a43ab80ae3efebaac531faf1a8981c3c8fef9d
SHA512c442c3497b5101ffa420d7a5accb584cd9e061eafbd40ab3a5cab6615cdfcd3f75ada8446ba7068ee5b5e807ec0cf2544f8ca6cc9e8bdbc76adc6c23b25f5353
-
/data/user/0/com.eexs.tnzw.vjcd/app_mjf/dz.jarFilesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc