58e314d493f47dbc0cb3e0119af6e50c20d74875b10619004c5b05be437f51f8

Analysis

max time kernel
158s
max time network
165s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
16/06/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4814bb1ea12d80bda667e35e3e19a64_JaffaCakes118.apk
Size 31.4MB
Sample240616-wtcemsvfnp
SHA256 58e314d493f47dbc0cb3e0119af6e50c20d74875b10619004c5b05be437f51f8
MD5 b4814bb1ea12d80bda667e35e3e19a64
SHA1 937234a2ec76c66d482244b21e11cd7f793e898d
SHA512 695ad83528f94baa30f5d4e8cf6264433fc00e0a14fd1eb8f26e0383b868b5966cb1c44630c04b29e7c4d15a9c62773adb602145d20935464c028fca19dec4ed
SSDEEP 786432:Q9IPvYarG5au3BoqbmCRtNQkkNE1fSG1HdPkqg6QS9XhuUt2F:QadLuRFbmCRwQSA5S6h9XhuUtm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.coolgamestime.dropblocks3d.gtx/.jiagu/classes.dex	4256	com.coolgamestime.dropblocks3d.gtx
/data/data/com.coolgamestime.dropblocks3d.gtx/.jiagu/tmp.dex	4256	com.coolgamestime.dropblocks3d.gtx
/data/data/com.coolgamestime.dropblocks3d.gtx/.jiagu/tmp.dex	4289	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.coolgamestime.dropblocks3d.gtx/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.coolgamestime.dropblocks3d.gtx/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.coolgamestime.dropblocks3d.gtx/.jiagu/tmp.dex	4256	com.coolgamestime.dropblocks3d.gtx
/data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/vva.jar	4379	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/vva.jar --output-vdex-fd=61 --oat-fd=66 --oat-location=/data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/oat/x86/vva.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/vva.jar	4256	com.coolgamestime.dropblocks3d.gtx

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.coolgamestime.dropblocks3d.gtx

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
18	s.appjiagu.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.coolgamestime.dropblocks3d.gtx

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.coolgamestime.dropblocks3d.gtx

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.coolgamestime.dropblocks3d.gtx

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.coolgamestime.dropblocks3d.gtx

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.coolgamestime.dropblocks3d.gtx

com.coolgamestime.dropblocks3d.gtx
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4256
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.coolgamestime.dropblocks3d.gtx/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.coolgamestime.dropblocks3d.gtx/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4289
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4338
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/vva.jar --output-vdex-fd=61 --oat-fd=66 --oat-location=/data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/oat/x86/vva.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4379
- sh -c ps -ef
  2⤵
  PID:4415
- ps -ef
  2⤵
  PID:4415

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classes.dex

Path /data/data/com.coolgamestime.dropblocks3d.gtx/.jiagu/classes.dex
Size 4.9MB
SHA256 57f7c2c7056962bd32409d9d42c4f5b8ffa34a2c5c94089e528b8946f5e071bb
MD5 77ebeb38c2647488e5cec3d6ba26e046
SHA1 150644027c166852630cc974b7269c45bfbb41b9
SHA512 d4efcea6cbc688118a9d7488f8a279e4b9db6d828409c9ab25d5db74fe33e028d5e4a7df7ed3656cc2007f0555bd52ab22d604687883bf118bad6d3dc8c6a019
SSDEEP 49152:YaNBFDBrJwSM/ZrjtUMK62LiTOB0M6kDO3JdrKXzEp1WgZ6WaJ1Ch5hSL9qyg11v:YaNBFNr6ZXWMK62WZqEpZa5EWs
MD5 SHA1 SHA512 SSDEEP

Download

libjiagu.so

Path /data/data/com.coolgamestime.dropblocks3d.gtx/.jiagu/libjiagu.so
Size 475KB
SHA256 5a1c513b347e2a929769e2be67552c1d591704f08f7b5590282b66cc2c7d7bd2
MD5 5aea02f4e4c77fbf2e7a27f7ca9cc06b
SHA1 522db1748608e9173547b29b7aa82ddc3542c534
SHA512 5c979a11f5e896829db906f533756efc1cf3c5a7e35ecc9e376a0aae818f2dada013441649feac2e188bd51affbbf35156e32fdc6552e185bddbc547f3850316
SSDEEP 12288:/xL4fCZt8eBsCeIXrso1lYatIboP1fcfn2cCjalRcf11:/xkfw0irgatZFcfbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.dex

Path /data/data/com.coolgamestime.dropblocks3d.gtx/.jiagu/tmp.dex
Size 284B
SHA256 9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
MD5 f1771b68f5f9b168b79ff59ae2daabe4
SHA1 0df6a835559f5c99670214a12700e7d8c28e5a42
SHA512 dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
MD5 SHA1 SHA512

Submit Download

uuloi

Path /data/data/com.coolgamestime.dropblocks3d.gtx/app_ebody/res/xmtok/37673/uuloi
Size 2.6MB
SHA256 e2c35ba3e0b82ced9693b57da9c9c57a1e9914d272a8f94f9f39b40ec3451016
MD5 a4be05e15ad132090b309f396e91ff58
SHA1 8c8b8354188d80d9abf60f4f63883d2b92a553f2
SHA512 1db29d80bdec4939d19566a9714cb400fcf7baf17b306b6b65ec92f573aa1910262cd4b51d9791af38b5951ef39bbb499a9003b9e0c528c31a2a21e45f09f341
SSDEEP 49152:LfAq124/8fdSRinIm/mem+xBkyNIOMl1QSmf8kNviV1dcPX/VIbfbefMEmvvu1vO:LfAq1tEluem+kIA1e8khiV0PgQevsq59
MD5 SHA1 SHA512 SSDEEP

Submit Download

.jg.ac

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.ac
Size 32B
SHA256 0a3c87fa91798239f7f08d261ec374819e83f4330aea2652f5f7e2602274cb13
MD5 5b505cf2c409ed7aad64a29d44b9910a
SHA1 5cf7f4b93c02ea1fef1caf2f0475ee47472d711a
SHA512 48dccd437e34317938c9c69da0b60893a4109fba2cfa2e52299ebb92705cd0e29df5f2b1f41d7aa917cc8f16b01702526862faa16a722eeb07a6dcc27ecdcd3e
MD5 SHA1 SHA512

Submit Download

.jg.ac

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.ac
Size 40B
SHA256 62be4c2f8d27553a3bdf5afac9a8fa3338a1a3c48ecc3c7f5192e62426a781f9
MD5 f2fe0575eb8bb9a460dedc6e54794c9d
SHA1 9f734b14d1df28921d0093ec675b046d21387775
SHA512 44d21b4f9c1677e89d480e66f40c60253c1f36378f9e7d485daa9661132b31282bbe4061f263ba47c583f2a11aca8a9c77c5984ddb18340ad7826f6c956863b2
MD5 SHA1 SHA512

Submit Download

.jg.ic

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.ic
Size 32B
SHA256 5a07be786f57c340c7cfb5d8dc8b78c9435f5de0552b1e7bbb9c3738783981cf
MD5 c9a044e50509f1cd8050125b016cf4d8
SHA1 e67e3759bcb59aea3ce46f6037c4bb158a7f5830
SHA512 861095810f57aa5777b870679cc569931e0b48268f63a9770ab236f9219305812a62a40664c75ea63be36317d3ff6bac99e30be74eafb0b5aef18353ff051d66
MD5 SHA1 SHA512

Submit Download

.jg.rd

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.rd
Size 73B
SHA256 d952b01ee8c8a74dd9d34d152ca39cafd65881a76feb1789e41fbead423cf593
MD5 18318546664bf3cda2e9e080b2e6a6b4
SHA1 ab00f0e0ac3005c80de7b956ae89edb6d6ddf1f2
SHA512 b21e6c3a12ab406564e546024536c59f96eb1659d21728c82866303a546606d219927b47266e8568422fcde3cb420fd9df2f6cd252758b436c2f6e1e5a875f61
MD5 SHA1 SHA512

Submit Download

.jg.ri

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.ri
Size 307B
SHA256 e59aed144f8f09afb3093fa8a4dcf40e38e496c64f22ace53098c85bbf73c782
MD5 c7e52e01b01af47db5efce18d76ac16d
SHA1 283cdf65ca135be1002c2c0c3f659a953aa0efe7
SHA512 fd789d18219bb6a7167b13378062f1471c37a4fb46739ef1235b4045b0adfd17ed8fb8d46fcfe08fbbefff382dda7564d67d3063150b9d6113c408b035ca72fb
MD5 SHA1 SHA512

Submit Download

.jg.ri

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.ri
Size 314B
SHA256 6d181ec0c789547eebcb09b7bf01adfd783fa07d72741f7193a4349683d1b63f
MD5 5a9fa571b00459a230eed8b7a6746b07
SHA1 7e6dc245881010862e956dfba933b996edced4cb
SHA512 aa6055377779d3449f65f82e0f799f8dd0ebec306bcdf39558116b585035e3ec0d83caad93ee1fec06b63f410087f2ccf0d39cfc162f1ef1d0e7dfe9bc1ae7a8
MD5 SHA1 SHA512

Submit Download

.jg.store.report_pid

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.store.report_pid
Size 32B
SHA256 24c1187b262c833275680a88221496b51a835d6baa2a743e836c976405619bf0
MD5 c40e9d05afa6788fb5b0df68b679d785
SHA1 8c83c0c99d569d60c76fba0928f81d192f005916
SHA512 9c7b02c9691d954c8041f709ae5d556164216b04f088d160c4772f5d3d8206b5ecf5171a4c355ce9449a0619ee0dc43bb655a4b8ed21cf9d0c3dd72799125948
MD5 SHA1 SHA512

Submit Download

.jiagu.lock

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jiagu.lock
Size 27B
SHA256 b2a863a8e04b7a954af1f7b1cd7528c9504cd7f4f81b38d2d57c941a37c75910
MD5 4b88461cdcf43c05aa890be82a3d6145
SHA1 366ab26a959dfc47872889d3f1232a537284305a
SHA512 72e1546468ae01603a92e088fbde6847bc7094fddb068a1d9a751b991e3ff5bd3178d40937df7dc30a9cc0bb3bdd9b4dc64e24308f96871f720f5966eb03c4c7
MD5 SHA1 SHA512

Submit Download

cheuu

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/ebody/as/cheuu
Size 8B
SHA256 7b4c12f120a65dd2a485f9f9b5c6439dcbb7c4c297f0156294ba0191782345bc
MD5 de04405a9ecd52ba48b30cc84048459a
SHA1 5c9cf38f6e8dff6706033de614a3c2619a495442
SHA512 928bc110ececf5fbc27f438cf527092c67da134e56941753ac7e14fba53ecf18091aa47d90f87a4dd678e6527563d3c6852e73f0a8aac92ac689b5395423ab91
MD5 SHA1 SHA512

Submit Download

vva

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/vva
Size 2.6MB
SHA256 c22c33159bbba233c5747086b13a5ee067c44bc7726267e4d02b8993fde1f344
MD5 c7464d7ac75c59a56ff2f6a0f9374094
SHA1 e18fb726a5a36039aa18c383b265e79a343479e4
SHA512 93fd8ca48d0febfc386b9cfb4eb01e5aaf72ff0f9e1abd4720884fa0c93d422728f61da7edebabc1267a8aa2c4f6aa831c8d5a596d08f6b64ef696e19188a9f9
SSDEEP 49152:Tld2pAzPCKIKcFS7qVBc5zm/sqZLHN8GQ/qUKacF8q/l6lgf6yQ2+1NcWPP:TlWAzPCEYS7qVe5Q4GOq3RIlTyQ2+TV
MD5 SHA1 SHA512 SSDEEP

Submit Download

vva.jar

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/vva.jar
Size 342KB
SHA256 185c4ce6748aecf146255ae05828bb01d88b523d7c930e058c851ea5d329beba
MD5 c575a286b11bbafcf8e4905d27f30977
SHA1 92f75a7425564f8e5ced10e4ef098c378a0748bd
SHA512 f71571ee69dbb5fea7ac72572b1e50bfac1c7b0a577a5163631410d9f002ce38ebc1e3da4b43000a3575b68b30c70609269c48d165e1cd326474d3e46e19087e
SSDEEP 6144:9JP3414Zn1Z0WpQa6Y+1pQe0saW0TT9Q66OzalDueg8fdFJrk1zz0I:fP3BSmQa81pL0sB0TTqo+l1XfdTk13R
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmd

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/ebody/seey/tmd
Size 32B
SHA256 c799bb41ae4a0e972aa7f51fa42bddcb39740813d1549c792a1bfd1cb159be49
MD5 f22d1c9d8805a03089a14cb8f0a077f0
SHA1 fbf44eea9680293a31ffaefdf4a51fe76b661b96
SHA512 9c14964bf702554b46136efa6238920b25cdba7f228d72eb66de2efeed0e7f6a785770fc97bbd53819538c23add5ec41ed99933809c30ff8a95311728b044ae3
MD5 SHA1 SHA512

Submit Download

Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/ebody/seey/tv
Size 5B
SHA256 f6c857ed9fb74036aad1662f0450a84601f9eaf5f9eb0e6943136fa6ffab21b0
MD5 1c4ec9002d8f6c1ddae5c151e48cf718
SHA1 2425cc273831d722bee4906c14c03fe497b99c08
SHA512 6371c3db3d1dd610f1d22a8a5c5ba3efb8e4d0fd8df158f0dcc001238072717bb1d385152e4b8f67d7283eaf41d0582f6381e859f83f673e8b4ec48ce59d76ac
MD5 SHA1 SHA512

Submit Download

vva.jar

Path /data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/vva.jar
Size 1.0MB
SHA256 71e6601b6a0b4de3231b8b0e9b38589d6f1f8795472dfc3db33005b12dfaf583
MD5 8caf3f483ed2add014d8d4b8c866c5bb
SHA1 8999316aebec7d65799d753aef9453a51c2e6a13
SHA512 5d6af6270e9550634cfbdc980d2c110f8514e60ef12aef7d575d3ebf4db7ce64562f355c2bc9908522cdad45a0b8d7d3669909ddd42bea00b26579e4a39014c1
SSDEEP 12288:H/odASeWkEP6eyJL2XJ6z6RobNqtVjazsavcs/Xq67Xn56C6I62KhqeHqxC6:fi9yEPFyJa2qGvcs/XqgmjKr
MD5 SHA1 SHA512 SSDEEP

Download

vva.jar

Path /data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/vva.jar
Size 1.0MB
SHA256 9e4e34e3db9a85d0e2f937c85255f2c924df7465284c9f8d91f9ab4ed8f2c49c
MD5 7eb039aa7728169a015707a82e1b41a4
SHA1 adeae37340af1ce383c908cdc4d375b270b30a60
SHA512 c60f5c867ff34eed8186741ed2947e21ea7f3264114347ff64c90d9e04381238f0a3fbae18ef4ddc3c4b390935a21ebcfa311815384615574e9c9f90a825f7ca
SSDEEP 12288:H/odASeWkEP6eyJL2B7H676Vp16qKHJhn9xGRALrRaZ4jGLX086b6b6BKhqeHqxx:fi9yEPFyJSppXYdoMRaZ4jajKr
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads