Analysis

  • max time kernel
    174s
  • max time network
    142s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    15/06/2024, 18:12

General

  • Target
    afb98f0c27e234d4eb68355dc33099b7_JaffaCakes118.apk
  • Size 4.9MB
  • Sample240615-ws8fpazdqa
  • SHA256 1bba1da3f9df37c9c47fba04ec9c63ec389c2c3984d7e300c7e535b3970a0729
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.s.launcher
    1⤵
    • Queries information about running processes on the device
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4270
  • com.s.launcher:push
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4421

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        widgetpreviews.db-journal

        • Path /data/data/com.s.launcher/cache/widgetpreviews.db-journal
        • Size 512B
        • SHA256 737d8e5b6c5ea417f553fc02a6ea5e6f577aadd6c53c85f6a2ae60045e5c5571
        • MD5 SHA1 SHA512

        widgetpreviews.db-wal

        • Path /data/data/com.s.launcher/cache/widgetpreviews.db-wal
        • Size 32KB
        • SHA256 efdcf6520b7953c2687ab830fe4fab937d888bb0a2f5bb472657c4f3752ddb0b
        • MD5 SHA1 SHA512 SSDEEP

        bat_statistics.db-journal

        • Path /data/data/com.s.launcher/databases/bat_statistics.db-journal
        • Size 512B
        • SHA256 879c3b8f8827c5cfc2c9f203bfeeb8ae5c367cc4a1acd9e7c450a04a4fcf8838
        • MD5 SHA1 SHA512

        bat_statistics.db-wal

        • Path /data/data/com.s.launcher/databases/bat_statistics.db-wal
        • Size 40KB
        • SHA256 4219bc6e742db6548a62eae6e29e3d8288a9f50702f5b519c91fb6a92a799982
        • MD5 SHA1 SHA512 SSDEEP

        cc.db

        • Path /data/data/com.s.launcher/databases/cc/cc.db
        • Size 36KB
        • SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
        • MD5 SHA1 SHA512 SSDEEP

        cc.db

        • Path /data/data/com.s.launcher/databases/cc/cc.db
        • Size 36KB
        • SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.s.launcher/databases/cc/cc.db-journal
        • Size 512B
        • SHA256 e6eea0280c266df656c701a268e8e89ef982af29c01df809483341c0ced5f2a6
        • MD5 SHA1 SHA512

        cc.db-wal

        • Path /data/data/com.s.launcher/databases/cc/cc.db-wal
        • Size 48KB
        • SHA256 b3e956f328c36ce2597d2c29fb9380589a84c62e6e26474b9ab901ec149e16e6
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-wal

        • Path /data/data/com.s.launcher/databases/cc/cc.db-wal
        • Size 16KB
        • SHA256 d25b97ad2a1381e9bc3d6aecf5e6a1a267dfe32beb7f6e1c5249c64565f24ffd
        • MD5 SHA1 SHA512 SSDEEP

        gameApps.db

        • Path /data/data/com.s.launcher/databases/gameApps.db
        • Size 188KB
        • SHA256 d3853dacf69c6954b0655bb3d8d59fb6828fc66f93d2ddce487496fafcf5e47b
        • MD5 SHA1 SHA512 SSDEEP

        gameApps.db

        • Path /data/data/com.s.launcher/databases/gameApps.db
        • Size 4KB
        • SHA256 a9d0671bfe65328b4430ed9de688953af63988093ba3f5a839cbfbade951195c
        • MD5 SHA1 SHA512

        gameApps.db-journal

        • Path /data/data/com.s.launcher/databases/gameApps.db-journal
        • Size 4KB
        • SHA256 4b5451ca1da052ebee26fe7d9408f591a385b7144f33bdcb5b3da9dc77673e70
        • MD5 SHA1 SHA512 SSDEEP

        launcher.db

        • Path /data/data/com.s.launcher/databases/launcher.db
        • Size 4KB
        • SHA256 61eb02f1c3f0b402b66a2cc32a6baedb27637408ceed8e199e3cd999868a91d0
        • MD5 SHA1 SHA512

        launcher.db-journal

        • Path /data/data/com.s.launcher/databases/launcher.db-journal
        • Size 512B
        • SHA256 8efb8e18d094b98019da59b19b5f6399fa12556985295e3731b2a567feced0bd
        • MD5 SHA1 SHA512

        launcher.db-shm

        • Path /data/data/com.s.launcher/databases/launcher.db-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        launcher.db-wal

        • Path /data/data/com.s.launcher/databases/launcher.db-wal
        • Size 124KB
        • SHA256 41cdb8989099d7e73cd6ff21c03cd2c11ba12451e69f9a957072f17fbe2299b0
        • MD5 SHA1 SHA512 SSDEEP

        sort_favorite.db

        • Path /data/data/com.s.launcher/databases/sort_favorite.db
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512

        sort_favorite.db-journal

        • Path /data/data/com.s.launcher/databases/sort_favorite.db-journal
        • Size 512B
        • SHA256 025a09958aee8326edb94428b74a37afac33d972786e32b78951f9aa80f2de93
        • MD5 SHA1 SHA512

        sort_favorite.db-wal

        • Path /data/data/com.s.launcher/databases/sort_favorite.db-wal
        • Size 36KB
        • SHA256 46d072891fb77de06998783325bd1bef5355b548293720517f7543eb6d77662b
        • MD5 SHA1 SHA512 SSDEEP

        um_cache_1718475271831.env

        • Path /data/data/com.s.launcher/files/.um/um_cache_1718475271831.env
        • Size 1KB
        • SHA256 edca828028cb5bbe98098bca2fab6d279151223074800402cecc3d93cd3ea488
        • MD5 SHA1 SHA512

        exchangeIdentity.json

        • Path /data/data/com.s.launcher/files/.umeng/exchangeIdentity.json
        • Size 162B
        • SHA256 cebcf2d6f79982da903bfd5f2478e82549f498351c22bad44dfb1b3cf0a49923
        • MD5 SHA1 SHA512

        exid.dat

        • Path /data/data/com.s.launcher/files/exid.dat
        • Size 60B
        • SHA256 09f89d4e6c2e4a81ca66caa5226bd149c3012ea9c7a54dc26b22e98aac8f6afc
        • MD5 SHA1 SHA512

        gaClientId

        • Path /data/data/com.s.launcher/files/gaClientId
        • Size 15B
        • SHA256 bcddceea8f39d4e8db2b4d087f3709006c79e619b693cad4974bb2f90d9780f0
        • MD5 SHA1 SHA512

        launcher.preferences

        • Path /data/data/com.s.launcher/files/launcher.preferences
        • Size 15B
        • SHA256 9bd54ce2fe34faa03d173df22621b5c747e544ed354e521889b692c031ba99b3
        • MD5 SHA1 SHA512

        launches.log

        • Path /data/data/com.s.launcher/files/launches.log
        • Size 8B
        • SHA256 577fcad6fcd8592bf8b3b70c5ed4981eb1b2f7b7ac7ae355b930aa302ff85a55
        • MD5 SHA1 SHA512

        umeng_it.cache

        • Path /data/data/com.s.launcher/files/umeng_it.cache
        • Size 498B
        • SHA256 e8ede7955f578b8e02407107a521bc03d0f19d3e68bde2e106db6e524521aee3
        • MD5 SHA1 SHA512

        ContextData.xml

        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 111B
        • SHA256 044bc3e300cea83e107ebc37e8deda98c3e9b3f2306c887d228324b932096336
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 111B
        • SHA256 a2e66db2c46fc4232e9047e3e3cc8a460e5780d2451490463a1d4317d7ad1f4a
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 381B
        • SHA256 77a6b9f7352f4b611ee6a49b88de14fdc6bb465c33a5872125665f20c12de312
        • MD5 SHA1 SHA512