335edfddd6440e1ae6086bb7b6b89376e28e3212c96a58c604630ada26e28ca2

Analysis

max time kernel
112s
max time network
187s
platform
android_x64
resource
android-33-x64-arm64-20240611.1-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240611.1-enlocale:en-usos:android-13-x64system
submitted
16/06/2024, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b39bd293131213425b743daca2fde73b_JaffaCakes118.apk
Size 13.7MB
Sample240616-p45evatfna
SHA256 335edfddd6440e1ae6086bb7b6b89376e28e3212c96a58c604630ada26e28ca2
MD5 b39bd293131213425b743daca2fde73b
SHA1 30ba7e1df07aa0bc9a7449c64dd5e46087ad6ce9
SHA512 f4d673b8af5b6c284dce88d0879639512c8a8aab76bccc7c9b374447ab40eec60dc2db038784f0c6a4f98c727d02fac0200188bd2ddaf2dc255dd9a876713227
SSDEEP 393216:9c12nW36BI/khO4Ryb8zp+/PPClwclpfVq2zA:GPmI8wb6sQ7ldE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.daywin.ttqjh

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
29	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.daywin.ttqjh

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.daywin.ttqjh

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.daywin.ttqjh

com.daywin.ttqjh
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4227

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

sharesdk.db

Path /data/user/0/com.daywin.ttqjh/databases/sharesdk.db
Size 20KB
SHA256 caaa0ef6017ab04a0d8730481dee3d13ca286f60c4190f7fbcfef61bb593c822
MD5 769562d7e6f9624db857dfa092f14411
SHA1 b07c12906ba4dba306741c16ad3a18362e20389d
SHA512 6b9422a7244a40682feb0ec37865096710dd88d791749f011e9a846f4577ca1be90665e02fbf0150eeb4efff384f343d12d926673c045c467ea56974a5310f37
SSDEEP 12:TLmFfcyNTSFbygcVzckcD3iCLRmBEyPbAVOwG:TLGp3OGNGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

sharesdk.db-journal

Path /data/user/0/com.daywin.ttqjh/databases/sharesdk.db-journal
Size 512B
SHA256 4ca4c9ac72dde2f6b4b294f0a0c576a65038f132bbaa53a4b7b9df5f9b872cfa
MD5 0e3a5623478b0c94632ffe60a026073b
SHA1 e84a3522d16715e2e354e11bae0354fec7487166
SHA512 dffb8415d34a2f91eb21d5ddfd0e7e72191b484f94b7118bf252275e0ed9cb1191ff5c7f892029d7b1e9720233c08a71232d0099b085084df2a90e82ccc2c61f
MD5 SHA1 SHA512

Submit Download

sharesdk.db-journal

Path /data/user/0/com.daywin.ttqjh/databases/sharesdk.db-journal
Size 8KB
SHA256 3ebda5c0cdacb39f4c4943c58ce2799421dcee5328478af31db5b9ebae859c02
MD5 ad8b8b5578487133b087b6c252578f9c
SHA1 0ce8feaf81e752f8c5ec43c8abd74b5f170f7a82
SHA512 041943c68a3e3afc9974fdcf5965133c1bae5ab323dbd2d2664affe56922581f1a1907b34a852d236d539a123cc3bc3f0032ad5a83119441848d246a86f1e925
SSDEEP 6:7+/l9h8Hn1AWg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKoz:7+tdWqLiuWd7RmBEyPb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

sharesdk.db-journal

Path /data/user/0/com.daywin.ttqjh/databases/sharesdk.db-journal
Size 8KB
SHA256 b3e2469deba6f6bbe7791a6af2a442a9c69a10e673832c0f25dfbafc375a3097
MD5 4f60f8b62ce941a314bb1fafaf33ca20
SHA1 bc934a511c53bb068c98dbebc24ad299f2d4a7be
SHA512 e2396144b82958edd7cf51c54e6938ba47638bb9174bc49aa020650d6f5b5d209eb857a8c536e7572c45d44828aeeb8afe12a02d304ea7f434cd98abb1dd5067
SSDEEP 6:7+/l92FPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKqqt/wK:7+tkBqLJdKBRmBEyPbb+wK
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1718542526426.env

Path /data/user/0/com.daywin.ttqjh/files/.um/um_cache_1718542526426.env
Size 542B
SHA256 336fd0c0e28323a5a131b81a443c6b0a8f9a5edf844e8978a8b0c3f443800900
MD5 e02b6326aee0e10e9b188036c46e1dd1
SHA1 2949da6ffb5be102da9aa6ad2509c98d6d6d9f59
SHA512 7834aacc6422eb430e588e70f04a453881f9d34d2990ffa527b7673eabe189a539488887362cf57f8d7d71313d2de51b6c8c2eacf13a380006a928d596a779c0
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.daywin.ttqjh/files/umeng_it.cache
Size 245B
SHA256 a152b606a9c6eeb4ac27603ee2304758e0166eb16deb708aea1f4f2bc04c267a
MD5 a8ebb6d804595be22dcd7acc1f5c6829
SHA1 13bdaf0e9d8d47d947d7b0722b350184c4d7de17
SHA512 d842fdb1c96323ee4de41703611dcefb9cb36d37b4edd819759b14bb4486324ef09c5b0a4c4bc2c7575c350df29428c3e2867beee5107196d7bded5a13071318
MD5 SHA1 SHA512

Submit Download

.ba

Path /storage/emulated/0/ShareSDK/.ba
Size 377B
SHA256 6b19a6ee25161aab3f49b8ca77dada92c380980823eee1247c934b573a264358
MD5 0f069f521dc2f61fe81a5a6b8a4ed411
SHA1 fd08725fe5398c0b2afa2c845e1f674c5ab16101
SHA512 2e1e33757fd0f2f814c3b3cfd370a05723e2f1f83dd2a565eac2a30963f01a5ce7caa51a00abdd6a45097774fc75497afab7407e620750869b80471559dbe96c
MD5 SHA1 SHA512

Submit Download

.ba

Path /storage/emulated/0/ShareSDK/.ba
Size 476B
SHA256 517cd8c93f1c7751b66830df00a4a9bcb019e2b95479b78e0bf67fe4ebc5e0ff
MD5 fb2e8072bc061e04c4b0c94281d52dc4
SHA1 eb12e2990d204c2a87605fea0bf01e356a3ebd73
SHA512 b25c72ec008f9ad476f0041dcbc44e424db09e84817706f272748a491d83eed30654230ad80894232c6b68a4d48f7584f745d10806b5d81e165699f513cd92d4
MD5 SHA1 SHA512

Submit Download

.dk

Path /storage/emulated/0/ShareSDK/.dk
Size 107B
SHA256 45e6cf5549bc12c1150b2a10f20de32ec5b86fe23221536eca2cb2a43b1e2d21
MD5 893bb9930a6efdd3211826f4114b5a29
SHA1 57b8895adcc3bbfec87268d5f004cdaa6caee8cd
SHA512 78f094bf00c6b440a57dc5b8edc10c3abf4fac63176dd64a54b2e7b03d9973485504d619ae80312fed1bc72db9f1617a990f37edc7bfdfa032ae47b054939010
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads