Analysis
-
max time kernel
178s -
max time network
181s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
-
submitted
16-06-2024 06:58
General
-
Target
b23ee7c3ca43a01810e36abdc048d3cd_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
b23ee7c3ca43a01810e36abdc048d3cd
-
SHA1
4f48cfe6d8372b154f709171606c06281e4a4c13
-
SHA256
0c89f9870d0ebd8fae3c65af56cba370de78af9399a2b04122e7b2443440da98
-
SHA512
28930f63785760a1f1c1f76815b8cbb57470f81841f3944484716d9107ac758210d66b0d769b2d330f7bf540677ce26faf7fee779befca7d0ce9867ffe61b36e
-
SSDEEP
24576:6oL0otaYtXMZMPc7T61VaxP5PFA1rypq9o+P8j7+Zq/13tdHbZKm51Ob83t:hQ7YtDcX61icdysVUj7+Zq/1XHNKmjb9
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
com.eyyk.qwit.yomo1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
-
com.eyyk.qwit.yomo:daemon1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.eyyk.qwit.yomo/app_mjf/ddz.jarFilesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
/data/data/com.eyyk.qwit.yomo/app_mjf/tdz.jarFilesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
/data/data/com.eyyk.qwit.yomo/databases/lezzdFilesize
28KB
MD5dae68dcffc3d522a79f98ebbc3b6d457
SHA16df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA25656cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA51223b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
-
/data/data/com.eyyk.qwit.yomo/databases/lezzd-journalFilesize
8KB
MD5286eade4091d97df15e53ea97c6b2594
SHA1940d3a13c5a226e2d7737c4e5de6c0d6707cd29f
SHA256fdb8f28767f6f567df461d7757cd686035555aeb92c6e32b489f0941326c8e2e
SHA512a384fa5c9b8d3759fbfa84f3a777c6b429ada6ae03558730f963067324ab14c34679d8de8fae756e1d5fe2665be99eefd5a40cf1c9f6833a8cd254e24dc273e2
-
/data/data/com.eyyk.qwit.yomo/databases/lezzd-journalFilesize
512B
MD5311941fc91c98c08f3c448ab62a933d6
SHA1c7db56eb3d75a9bcaba61ff93c3c163ea25ff32f
SHA256b2d7b90f529a3014888d0396958432f2c53a5b88b13289ae7c1f0ae3df69f01f
SHA512458f20f6ed0ab0ca91ceea330818dd0c72e0155cc5c583872e4c3cabf23dd74a37360c2c061da61b14a9ae1f6e12638f7543c76ae67e5f85053793558082f729
-
/data/data/com.eyyk.qwit.yomo/databases/lezzd-journalFilesize
8KB
MD546bd7921f33dbbc94acb6620fc80252a
SHA14ba0dc19e8f072eafc0dc2fcab98f8fffef8aa99
SHA256e7b94a6613afe04c01d1780d8c8fbc8563d54e16314a8483b8626675c95bdff9
SHA5122ff06d154a3539891a565ae44ad82e18af73d3a0676aa2eeb8c9ef92f5e0db8a11a51e50820bd22940b564dc53ae35dc0564e1e2b424decffc1fe9434a49e70a
-
/data/data/com.eyyk.qwit.yomo/databases/lezzd-journalFilesize
4KB
MD5a74409aff34a8e76c5fe85076f5edc35
SHA1313a14f06fe7c9e9d5d79d99447f9898bc33a939
SHA256908a43381afb6b7178dc7583b190a9649b276879751b119fa1ca45fcd0420d12
SHA512b04aea5abd297ad0b197ce83a390c069430fed3a21e1f1d0c97855e3f2f6ee826198f7e59bbeefa78b20476de26f033e280ef22ce519360dab38e1fc9164e931
-
/data/data/com.eyyk.qwit.yomo/databases/lezzd-journalFilesize
8KB
MD5ab916aa4a422df9e2958c9f5dab0d096
SHA1dc58047a1ee0ba679f682887113fa36498547b31
SHA25694b93e7cd9dbaae4c64ae96861e1851f3ccdb2ca53e7daeafd29f789dc6a0b0f
SHA512fa358ef51a221c2f8cdfa18814f3e2824dc088d1a3678b016b04f58812e33f5625cda793eaed609914363448af59ec88ed89de3044fe0364445794974c826160
-
/data/data/com.eyyk.qwit.yomo/databases/lezzd-journalFilesize
8KB
MD58520f187cf37666fbbcd8f2e60e81b19
SHA1d5325f8cd866e2465fe13383a88003f00df49119
SHA256a73fd29aaeec259bbb476124dfc67eda944e1e07b1876795291b02ec23820f29
SHA5126eaf846c949f44e4fe8384a8dfa43863272506e0a96c22582fcf9c477068f069fd35b650d4c961c2786e94644ffa497acb642c0f25db958c68a7a9394dff7de4
-
/data/data/com.eyyk.qwit.yomo/files/.um/um_cache_1718521241301.envFilesize
655B
MD5c5ae77e0685ade75aeda74ef9a9d06f6
SHA1eb059d759df47649b6e3ba1ecb45edbef25368ee
SHA2560f4233244e15470b9527cd5c1c05aa189249b99cee938f66f973f1eb5a6122a4
SHA512706bad85c9774f08cedab4a4ebc1895db67819f27dd1a8743cc44ee068996806ffbbe0b2f33ea953d243166fe58b12766795cc0ad5531a4328d60dae37cfda50
-
/data/data/com.eyyk.qwit.yomo/files/.umeng/exchangeIdentity.jsonFilesize
162B
MD5360f462067d33f65e650d028d239043e
SHA1d2c4b73e8f5b90254111a83faece177918abe41e
SHA2562814697de96a9cd95e5da620fd3f0c5b77f9630199f8d98a60e3beeca55bd3aa
SHA512ff1eac1357a11fffed8a07ad84cf4010550324e7971f58ad2d3e17155dc6073e6e31eb9d33bed62489485623d06c0dcada0d04dbb5f3803f334b515662ad52a8
-
/data/data/com.eyyk.qwit.yomo/files/mobclick_agent_cached_com.eyyk.qwit.yomo1Filesize
791B
MD56960b5d639721cd3180294970a32902d
SHA18df2c96346b2d02fd71051e70ebf2c015b26c6f9
SHA2568fa1a992d15898e4734f0b8434d1a3643af0752cb59eae1eb265247c99983b30
SHA512a6e1158046401cdafa6ecd3ff9a47ce4ff366fae29af41fec3a6a458246f7d8adb49502ab9e35490a5184a73c4c258214dbeabb19b1fb7424ece277eaaf3aee1
-
/data/data/com.eyyk.qwit.yomo/files/umeng_it.cacheFilesize
348B
MD5907923305b00d15bdca91364e0e5b92c
SHA129281f46544af824643cd3b9cf5c1b99d9e303f9
SHA2569c4ea22ab655f1702dee3d279fe334ffc5d46c8d5b47c81f615309daf3afec3e
SHA5123e804465e49934d459326c9629f10b3aea3fbe84137ea78568ee4afbe010eb262f8b1e7785a468b5fe8ee21674d4aad2e011b65f353b37232d257675b8b718ae
-
/data/user/0/com.eyyk.qwit.yomo/app_mjf/dz.jarFilesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc