Analysis

  • max time kernel
    175s
  • max time network
    173s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    16/06/2024, 18:12

General

  • Target
    b4814bb1ea12d80bda667e35e3e19a64_JaffaCakes118.apk
  • Size 31.4MB
  • Sample240616-wtcemsvfnp
  • SHA256 58e314d493f47dbc0cb3e0119af6e50c20d74875b10619004c5b05be437f51f8
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.coolgamestime.dropblocks3d.gtx
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4534

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cc.db

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/databases/cc/cc.db
        • Size 36KB
        • SHA256 c422190539b6414072fc3950da19a17985c0c4c2172740b2f74682b520af5231
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/databases/cc/cc.db-journal
        • Size 512B
        • SHA256 ce2efd01ab6cbe6d60d3e50c2ec6efe508890fd14df4d27f0cf99a48fdef6396
        • MD5 SHA1 SHA512

        cc.db-journal

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 686fdcea3bcad212b31e5b7033a9759c0f96b515f2b4324318a306f34ad9e052
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 31fefb18fec587fb4d812466e379e1ab72d81297d55207fb6d7b74022195ec88
        • MD5 SHA1 SHA512 SSDEEP

        .jg.ac

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.ac
        • Size 40B
        • SHA256 62be4c2f8d27553a3bdf5afac9a8fa3338a1a3c48ecc3c7f5192e62426a781f9
        • MD5 SHA1 SHA512

        .jg.ac

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.ac
        • Size 32B
        • SHA256 0a3c87fa91798239f7f08d261ec374819e83f4330aea2652f5f7e2602274cb13
        • MD5 SHA1 SHA512

        .jg.ic

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.ic
        • Size 32B
        • SHA256 5a07be786f57c340c7cfb5d8dc8b78c9435f5de0552b1e7bbb9c3738783981cf
        • MD5 SHA1 SHA512

        .jg.rd

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.rd
        • Size 32B
        • SHA256 2c462888a0cdbfa9448ad9e6da36164541451fba2c706588785a55aa51c0772f
        • MD5 SHA1 SHA512

        .jg.ri

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.ri
        • Size 307B
        • SHA256 14979e903b7a9fbea16829b7840613cac14b190accdde9360449943b0a7445b2
        • MD5 SHA1 SHA512

        .jg.ri

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.ri
        • Size 314B
        • SHA256 6892e5fb13ef44089f27a36715af7944bbb7ab3d15c2e96d75569284a370347c
        • MD5 SHA1 SHA512

        .jg.store.report_pid

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jglogs/.jg.store.report_pid
        • Size 32B
        • SHA256 24c1187b262c833275680a88221496b51a835d6baa2a743e836c976405619bf0
        • MD5 SHA1 SHA512

        .jiagu.lock

        • Path /data/data/com.coolgamestime.dropblocks3d.gtx/files/.jiagu.lock
        • Size 27B
        • SHA256 e13e6364f624470ba82a8f9b238950972ba44e4d0276dadd7a0a8dadb97e9d77
        • MD5 SHA1 SHA512

        classes.dex

        • Path /data/user/0/com.coolgamestime.dropblocks3d.gtx/.jiagu/classes.dex
        • Size 4.9MB
        • SHA256 57f7c2c7056962bd32409d9d42c4f5b8ffa34a2c5c94089e528b8946f5e071bb
        • MD5 SHA1 SHA512 SSDEEP

        libjiagu.so

        • Path /data/user/0/com.coolgamestime.dropblocks3d.gtx/.jiagu/libjiagu.so
        • Size 475KB
        • SHA256 5a1c513b347e2a929769e2be67552c1d591704f08f7b5590282b66cc2c7d7bd2
        • MD5 SHA1 SHA512 SSDEEP

        uuloi

        • Path /data/user/0/com.coolgamestime.dropblocks3d.gtx/app_ebody/res/xmtok/37673/uuloi
        • Size 2.6MB
        • SHA256 e2c35ba3e0b82ced9693b57da9c9c57a1e9914d272a8f94f9f39b40ec3451016
        • MD5 SHA1 SHA512 SSDEEP

        cheuu

        • Path /data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/as/cheuu
        • Size 8B
        • SHA256 69ca61f7e25f1d4f3c53132fe8c9cd32868037bc3e4bbb56766ee6efd65aa505
        • MD5 SHA1 SHA512

        vva

        • Path /data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/vva
        • Size 2.6MB
        • SHA256 c22c33159bbba233c5747086b13a5ee067c44bc7726267e4d02b8993fde1f344
        • MD5 SHA1 SHA512 SSDEEP

        vva.jar

        • Path /data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/vva.jar
        • Size 342KB
        • SHA256 185c4ce6748aecf146255ae05828bb01d88b523d7c930e058c851ea5d329beba
        • MD5 SHA1 SHA512 SSDEEP

        vva.jar

        • Path /data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/res/37673/vva.jar
        • Size 1.0MB
        • SHA256 9e4e34e3db9a85d0e2f937c85255f2c924df7465284c9f8d91f9ab4ed8f2c49c
        • MD5 SHA1 SHA512 SSDEEP

        tmd

        • Path /data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/seey/tmd
        • Size 32B
        • SHA256 c799bb41ae4a0e972aa7f51fa42bddcb39740813d1549c792a1bfd1cb159be49
        • MD5 SHA1 SHA512

        tv

        • Path /data/user/0/com.coolgamestime.dropblocks3d.gtx/files/ebody/seey/tv
        • Size 5B
        • SHA256 f6c857ed9fb74036aad1662f0450a84601f9eaf5f9eb0e6943136fa6ffab21b0
        • MD5 SHA1 SHA512

        ga.sqlite3 (deleted)

        • Path /storage/emulated/0/Android/data/com.coolgamestime.dropblocks3d.gtx/cache/ga.sqlite3 (deleted)
        • Size 40KB
        • SHA256 e2360c988255a5653f0fa9972a056bebff01a5baa1c9a66bb408632b96c15a7d
        • MD5 SHA1 SHA512 SSDEEP

        ga.sqlite3-journal

        • Path /storage/emulated/0/Android/data/com.coolgamestime.dropblocks3d.gtx/cache/ga.sqlite3-journal
        • Size 8KB
        • SHA256 25cb3cf6ba9d258d593273b9a05aabd8a30929f3efabd3d58f9d4a417297722e
        • MD5 SHA1 SHA512 SSDEEP

        ga.sqlite3-journal

        • Path /storage/emulated/0/Android/data/com.coolgamestime.dropblocks3d.gtx/cache/ga.sqlite3-journal
        • Size 8KB
        • SHA256 e8f66dc89f0622bd2c0405d283278813a5302ca733509daca46790c7c295ff67
        • MD5 SHA1 SHA512 SSDEEP

        ga.sqlite3-journal

        • Path /storage/emulated/0/Android/data/com.coolgamestime.dropblocks3d.gtx/cache/ga.sqlite3-journal
        • Size 8KB
        • SHA256 5bfab28fc228f933e9dd2e7750beaf5b4186bdeb23636d2894f49242935a48e0
        • MD5 SHA1 SHA512 SSDEEP

        ga.sqlite3-journal

        • Path /storage/emulated/0/Android/data/com.coolgamestime.dropblocks3d.gtx/cache/ga.sqlite3-journal
        • Size 8KB
        • SHA256 5d7aa5c88f3f1160a1b3547aa2da4833e3ebd97e0a016ef0fb87ee9df4373e30
        • MD5 SHA1 SHA512 SSDEEP

        ga.sqlite3-journal

        • Path /storage/emulated/0/Android/data/com.coolgamestime.dropblocks3d.gtx/cache/ga.sqlite3-journal
        • Size 8KB
        • SHA256 1ddd23fe7fef08d3e63cb5fb3584567c7096d2f82d4a5dc895a1f6d5c57ce46b
        • MD5 SHA1 SHA512 SSDEEP

        ga.sqlite3-journal

        • Path /storage/emulated/0/Android/data/com.coolgamestime.dropblocks3d.gtx/cache/ga.sqlite3-journal
        • Size 12KB
        • SHA256 dd55fbb553993f46ca5f04227f9bff28ec61689008c68dcf403702679de76303
        • MD5 SHA1 SHA512 SSDEEP

        ga.sqlite3-journal (deleted)

        • Path /storage/emulated/0/Android/data/com.coolgamestime.dropblocks3d.gtx/cache/ga.sqlite3-journal (deleted)
        • Size 512B
        • SHA256 5894b59d4621f9dac5979b0647c7989855c1fb37a6178335786f10108a3f4795
        • MD5 SHA1 SHA512

        config

        • Path /storage/emulated/0/Android/data/com.coolgamestime.dropblocks3d.gtx/files/Unity/local.d03c3a97561604c7a9de9d51484e1bff/Analytics/config
        • Size 293B
        • SHA256 83b3f90c4edf1f122c8faf9784ca0aee4dd017c65493ac181c1814211703db96
        • MD5 SHA1 SHA512

        values

        • Path /storage/emulated/0/Android/data/com.coolgamestime.dropblocks3d.gtx/files/Unity/local.d03c3a97561604c7a9de9d51484e1bff/Analytics/values
        • Size 153B
        • SHA256 22d28e4d6317ef6d52718346ac248a08f14a8c3447924ea24c8243b264fc942d
        • MD5 SHA1 SHA512