ddf900d7f4b19d9cc1ebc064be4c00085e711a6f786e36964ac724b7b2a28971

Analysis

max time kernel
162s
max time network
170s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
17/06/2024, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b669d10db658e10bd1cec584ea463f11_JaffaCakes118.apk
Size 29.2MB
Sample240617-c6ewrazhra
SHA256 ddf900d7f4b19d9cc1ebc064be4c00085e711a6f786e36964ac724b7b2a28971
MD5 b669d10db658e10bd1cec584ea463f11
SHA1 8c2dfcf60d32c8c842f0fb5ad88d104468506b2d
SHA512 7a89890379f64bb31ef9e0b247bd489474e7e13d2eb1dd821efc2ba509604a4de0369fe3dff8b2c36fa330830ed6bbb17f4e47c89b54673b2281faf3192932c5
SSDEEP 393216:T1mBvttEbEfdX+4vhlMdsfPmtH/KC8048NR+mjaU1r/3Ez5XDddl:xmBvtCbEVX+4rCKC805PBfCz7l
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery impact persistence

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
14	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hzfreechineseversion.speakpractice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hzfreechineseversion.speakpractice

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hzfreechineseversion.speakpractice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hzfreechineseversion.speakpractice

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hzfreechineseversion.speakpractice

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hzfreechineseversion.speakpractice

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hzfreechineseversion.speakpractice

com.hzfreechineseversion.speakpractice
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4268

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

P15pKIjsm64m

Path /data/data/com.hzfreechineseversion.speakpractice/databases/P15pKIjsm64m
Size 24KB
SHA256 9cc41eaf3228c605583528005cadbf69eb145da3943e09e3732677423dcbe976
MD5 032abd6bc70ad7c9484f10a7daf57bc7
SHA1 12e3c03375192814883d5fd1671e2b0c64b0ae43
SHA512 aa28b2d8e87dd6364e15b1c99c52758f937585c126cda7db38cd2b4e5fb3c3e5775a92cd1d5ae68b03a6c59e7473766d670f03e3ee30e8ee53c2bba1b73f243f
SSDEEP 12:TNoWt+lTSF7V9NoXoxq+oTk6X8UOvorpoTVZo5RmBEyPbD3OwI:Tnt+l54gPsU7riMqGSzI
MD5 SHA1 SHA512 SSDEEP

Submit Download

P15pKIjsm64m-journal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/P15pKIjsm64m-journal
Size 512B
SHA256 5f028d831b01f084e6b5f2ba54f245e773dafbb891e426ff7a848ac75de3caf4
MD5 054e12fee01cd3e7ce8f9834273745ed
SHA1 47001bd994e6865959103f4769d5163f6d2ab799
SHA512 c4dda33b823f3f96f69ba8f212b388fddc73c14e0d2bcb43e83802e3b911e38e369c69d227b1aa8ecd61f8825c60366ff4ee5dff0b6871e31e129894256ccd0a
MD5 SHA1 SHA512

Submit Download

P15pKIjsm64m-wal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/P15pKIjsm64m-wal
Size 36KB
SHA256 a4da57910a606649cc9674e3fb6eec8a51cb3d8b0720d814bc84b5a886ab81c3
MD5 5f196d925938934cfec8926ac4fa1640
SHA1 df57a2e628275bc16133e6f91d3ae1fb6823df98
SHA512 3af2aa000640ed3a1546baf9128cfe5d3632303c668cb66394b51e7a6ad9d458701fcb02d14362d410de602d2f438450f730c03ef50c380c5f84cb65be6627f1
SSDEEP 24:KAkyezyGSP/2rGkWXnt+l54gPsU7riMqGSP/2NtePHq:bezNSP/8wtaFkCDSP/8U
MD5 SHA1 SHA512 SSDEEP

Submit Download

T1oX0rhhuXWt-journal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/T1oX0rhhuXWt-journal
Size 512B
SHA256 534b719e85898f50495492f86c387f4b66673c5b2dec2d4cddeeccdc32f2579f
MD5 289abfbb731d7d21d84212c1d03fb91e
SHA1 f00c99ba739ffb829b39bd09136249bcbcbd6003
SHA512 9e5112c5259957a55272388e3b5e3fd9b28ac7d930ba6dca0df5a3d95bacdf5c8af3e6e9711cc8b1d1eb15ded3ecacd1a37fc01490b0c6fcd2d16c961a21800e
MD5 SHA1 SHA512

Submit Download

T1oX0rhhuXWt-wal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/T1oX0rhhuXWt-wal
Size 36KB
SHA256 b11025359e2e1c63708fa28bca46649ce92fe4be75f97ceb6ab0e7ff7ce13752
MD5 cefff02cc95e31256046ef4489f6639d
SHA1 081c52bbfa071c1fd572fd9d676133c583938e4d
SHA512 ac3903cfd37b8972af3c80c3d046020a5e06ba1c4ad416da8875e2b4cf963694f610f85a64a474975f9760a3584a6132932b40a0be5f2506719adca38e045db9
SSDEEP 48:5kKlVzNSP/M5B/GT7KYBaFkCDSP/MGs3:5/70P05B/GTuufP0Gs3
MD5 SHA1 SHA512 SSDEEP

Submit Download

XKwVoK0huy3R-journal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/XKwVoK0huy3R-journal
Size 512B
SHA256 38368d012e48493aba81d3dd63e1b90668eb1ad8481dee00faaddc7ec25c6087
MD5 1dfa05ad9f48dd1639cbb651958eb3c4
SHA1 0201d2e152188f11af23bf83730aa58c3c0eb413
SHA512 0acb62a3d415bdfc93f655bbe3c9961993bebbef003650c10a3fe1e7aac50d74a225bcea7d6859c81ee07871dbdb1db26d89a565ddbaa3c7f7d5737f40cda4ca
MD5 SHA1 SHA512

Submit Download

XKwVoK0huy3R-wal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/XKwVoK0huy3R-wal
Size 36KB
SHA256 63bacf448d2cbc3e97f3287e3f7b6ecefad69adaeca58d1481990ed238cd98e2
MD5 cf9ab970f632e6edd98c7acb2ccd2cac
SHA1 106b28fab06a0441bfd80a3f10d80dc9ce68b261
SHA512 33b39dc8a3b28248681d4819a059086ff56139fb7821815fcd9a0da411a59d9a8c4f47fd10518eeecc258aa7cb2d39a88530cc60b17c7e9f79f29b27de7a84c1
SSDEEP 24:K2CzyGSP/218gd6t+l54gPsU7riMqGSP/u:gzNSP/2qe+aFkCDSP/u
MD5 SHA1 SHA512 SSDEEP

Submit Download

jqIqJYOT3JpT

Path /data/data/com.hzfreechineseversion.speakpractice/databases/jqIqJYOT3JpT
Size 24KB
SHA256 f4a3fc85419d0e98a0312af88fdeadf75bd9969460820043559d6ee45e7ace55
MD5 9c37108c041a67252d4fb5059436eb9f
SHA1 f65bdd652f9b2a098993d2aca0be2578e8eed20a
SHA512 d7b92b0b4900439a28552339cf7e80e2937887c7de796e10df0bec393d136bdcdeae47991133a5c144547ac2ffe484b9c99e60280246858f6ae9b8529c5d8548
SSDEEP 12:TooWt+lTSF7V9NoXoxq+oTk6X8UOvorpoTVZo5RmBEyPbD3OwI:T6t+l54gPsU7riMqGSzI
MD5 SHA1 SHA512 SSDEEP

Submit Download

jqIqJYOT3JpT-journal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/jqIqJYOT3JpT-journal
Size 512B
SHA256 faced07362f4cdcd45172efba6d3cb9821c3602f30aefa5e55a3b9920cab600d
MD5 288124ba6b4608115e7c21975ac0b519
SHA1 2d1c2423c22c5889a35cabff9df958c27770c137
SHA512 bac9bc98776e7f1b7875f0a9618c58131923e4726035f83bd8f6aec37741c291278a4af556b5f485f8a606bc3b0f92ebd303df93dbffa108af69802dbd57a1a1
MD5 SHA1 SHA512

Submit Download

jqIqJYOT3JpT-shm

Path /data/data/com.hzfreechineseversion.speakpractice/databases/jqIqJYOT3JpT-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

jqIqJYOT3JpT-wal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/jqIqJYOT3JpT-wal
Size 36KB
SHA256 b9107d7001bae95e7cf9d8b09dc7f2c287abe93018a3b57dec858b4a79a702e1
MD5 7bc16a481999307fb2ce7cf2359c630a
SHA1 5f9d5af0369615cb384d5fddf1bc9ed8bc586742
SHA512 a2fe851b58767a3a6e354beac4859c9737bb4f5eaaa5488a4b37ab1797e8e46578cd1faf89f1ea122c951bebb36ac34c5c76046195d4713a8e0a9e8b4506515b
SSDEEP 24:KAS9rzyGSP/qqTorwuFwax6t+l54gPsU7riMqGSP/qx4PF3:XS9rzNSP/qq00Sjx+aFkCDSP/qx4d
MD5 SHA1 SHA512 SSDEEP

Submit Download

speakpractice.db

Path /data/data/com.hzfreechineseversion.speakpractice/databases/speakpractice.db
Size 279KB
SHA256 05ba4a9c869f9631019eac5660a299d1c78312f455776b99aa0f32f1b8918c3b
MD5 fa3e3945945f25733519012d9de01d5b
SHA1 a96744a533841317b9dace6dabd6a1fbf39e0a44
SHA512 571b91b5bf5c98904a3d21436d0ae85ae3e4ea82b45fdf047682f4647f3de10c77c3d5c433ccc7627d334ea70d406613a15550d985be3dcbafacb0c1ffd7b429
SSDEEP 6144:gYx1IDJeeXQ0Cv6ofl7S1yBbWvLYoQ5BEcztPN30kqAF3OnKxUh4C/PiKgNmSRts:yYGkqfA4iA
MD5 SHA1 SHA512 SSDEEP

Submit Download

wIU6pTyUBYWX

Path /data/data/com.hzfreechineseversion.speakpractice/databases/wIU6pTyUBYWX
Size 24KB
SHA256 687a930724a6054924254f945ae475e34ae87ebdc2054881c34317cd91d46ca9
MD5 3f46387c5a9161a06c35918e4715e9e4
SHA1 f03b4527b29495a3f50be85d6afba301e9e3f1c1
SHA512 614fa11f57f1ddc2750185eb908a580f1ae1ea53d4f4ff6881610942a36554b918138af7103859821d90cef12ea68bcab1ca0e4548cc5a78ee7a3c658b37f3ef
SSDEEP 12:TjboWt+lTSF7V9NoXoxq+oTk6X8UOvorpoTVZo5RmBEyPbD3OwI:Tj9t+l54gPsU7riMqGSzI
MD5 SHA1 SHA512 SSDEEP

Submit Download

wIU6pTyUBYWX-journal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/wIU6pTyUBYWX-journal
Size 512B
SHA256 6cf8b4be6f17e883f3c3d09314bed85d26957365d74853897b1dc27e71550b98
MD5 46f1eba73166b2032a2f64dbc75cbdd1
SHA1 d7e0611a0ca2f2d6e0934ea16c200e8302c13b47
SHA512 d0218530aaa24f4abafd4c1c3c5a4f71885d0ab451d8bebb38c5a209f65eda4496722f6c6a0f12d76a3e6731aa5aeceac15fa8f9f1b4e738ddd09a65ef5d8944
MD5 SHA1 SHA512

Submit Download

wIU6pTyUBYWX-wal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/wIU6pTyUBYWX-wal
Size 36KB
SHA256 03b96777d3be8ff73a1e4895487e62ae6584b96a642dd4b03719f08cea274c90
MD5 a0ee0b7a65f6a01498840c659cc55edd
SHA1 9ec0fcc562e02cab7e09fe1ea30b43e80d46d133
SHA512 8b311fff3177e58ca1e5f75a70e39311bd17bd7e60248790db68e03f8e0649a929437f72d67fd49156b5cc217da972a8607e2280c2cd3f2abe02cefd807e2759
SSDEEP 24:KkaxEzyGSP/wwt8E6ma+j9t+l54gPsU7riMqGSP/K:AEzNSP/wwt8E6mrjfaFkCDSP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsUL1uCdKvjD

Path /data/data/com.hzfreechineseversion.speakpractice/databases/wsUL1uCdKvjD
Size 24KB
SHA256 3511c95f09883c65de19c3be645faa921aa3baa92d21b5c284133da349158e2d
MD5 59413190ea19211285b5c0fed44c19c8
SHA1 ee67b7590047c3c17309f6e6eed48556aabe4c92
SHA512 6a65fc51ea3e163ed1da558c2f4e911857ab4d3b15bc27135a4639e8fed9022fd6d89b4dd39a39b3bcc69060d7565f68ef23bcde4e622a2dd823e9fd217d314e
SSDEEP 12:TjVoWt+lTSF7V9NoXoxq+oTk6X8UOvorpoTVZo5RmBEyPbD3OwI:Tjt+l54gPsU7riMqGSzI
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsUL1uCdKvjD-journal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/wsUL1uCdKvjD-journal
Size 512B
SHA256 3edeb88429f642bc1a8bd8d631cca2f91adb78b0655783974b2ad351b3b54feb
MD5 345525de1ada3454994449c02215a1c5
SHA1 32c8f3a925c9b6df27c270a98a68bca0c2ffca63
SHA512 e6cdcb5b64caba08ecf1c94a312d8f99defe08391c471c99c21817353c1a6ad306f81a3a2aef19349598c0641303337ec315b06494b111023d82d560016eb1a2
MD5 SHA1 SHA512

Submit Download

wsUL1uCdKvjD-wal

Path /data/data/com.hzfreechineseversion.speakpractice/databases/wsUL1uCdKvjD-wal
Size 36KB
SHA256 7d5b8ebc3a8553b5e350db41d587d26196b80f9874b7b5b652edd978c11eeab5
MD5 92fee6556c933508174a6a6a677fd656
SHA1 955ec1fb1053ad8932559842d8c1f80d680fe965
SHA512 fff1f833cfd801a4b1d58a453cb085e97b765c2b33b4a70cc22ae109ca05e462425ebe0f9e213fd6dec681ffa7319a8c02809d108728681e2e56abdce7cae3f1
SSDEEP 24:KN8zyGSP/czSjt+l54gPsU7riMqGSP/zOF:i8zNSP/c2BaFkCDSP/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

d929bb76e8110d1a70260af57b446eb0

Path /data/data/com.hzfreechineseversion.speakpractice/files/d929bb76e8110d1a70260af57b446eb0
Size 24B
SHA256 4ca23b0af17845231164e7d8531b7177f1e27afbd3e0f9b6fd4c2aae457363e5
MD5 bc51a59f793204e53617040d713c7232
SHA1 5920db5e438f7486bba3ed204dddf9206f24d388
SHA512 5ff5ef4057e87b6e8e2f0048694fb56eb86c81164ebc792706a0f328985c54f8fdc3851afe07559af875e9d108c608e03d84ab4c201b6d750ddd8c5008ecfec8
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.hzfreechineseversion.speakpractice

Path /data/data/com.hzfreechineseversion.speakpractice/files/mobclick_agent_cached_com.hzfreechineseversion.speakpractice
Size 120B
SHA256 ec3ca3b05caab3e50b22931f51230422f6a1b572d30d75d544b47e32f773f9e0
MD5 ed06672faf601f02398a5886d9cf61fb
SHA1 912d5530f59cca6c201d9a17bac48a4408403e16
SHA512 6ab3907ef606ce6b44dafd15a1d52197a0670487f1865668ff6e302d292bedf12d3a9a749f49bfa7e673f1c8da14253fa9235fa79975587abe3e0717ca5af7d2
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads