61913c17aeae92e3b3c9812676ab4dc6642bee403717a5a5a5051aaf4a1f2f72

Analysis

max time kernel
174s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
18/06/2024, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bcdff66ff0eb2d10a2b64ca08ed7e08e_JaffaCakes118.apk
Size 15.6MB
Sample240618-twbvsavgnl
SHA256 61913c17aeae92e3b3c9812676ab4dc6642bee403717a5a5a5051aaf4a1f2f72
MD5 bcdff66ff0eb2d10a2b64ca08ed7e08e
SHA1 a019fa0c043b0a7a9380afe497f86d7cc6c15d64
SHA512 15b894bdeb2fb87721cfcc953dbe8b72cf9b35d75377bef617da556f723907455e75d247dbc4c237bc5d53367b8cc8fe467f41ed6dd1a28d142af6bd8a119d32
SSDEEP 393216:gnEelSjaPWuBGvZr/bs3Ny1jzy+HNDibMstHaXFOFik:cEWSuuuBGvROw1HyIDZrMFB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion

Malware Config

Signatures

Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.tshang.peipei
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.tshang.peipei:remote

Requests cell location 2 TTPs 3 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.tshang.peipei
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.tshang.peipei:remote
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.tshang.peipei:remote

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
23	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tshang.peipei
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tshang.peipei:remote

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tshang.peipei
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tshang.peipei:remote

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tshang.peipei

com.tshang.peipei
1⤵
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4645

com.tshang.peipei:remote
1⤵
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4715

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

db_default_job_manager

Path /data/user/0/com.tshang.peipei/databases/db_default_job_manager
Size 20KB
SHA256 0b76b1352ede0ca2711e4edd166073bcdb06201b7f572b0840d67e3e97d5429b
MD5 804ce0165b608a30f86b3d53cbaceb89
SHA1 b472f19a824511d727455936454563fd37a383b4
SHA512 48594ec68e0305be3b5e09fe328b34446932e1e00adb5e8847984de7aa95cdd24d1c59a3165866d35227fdeff8b35844ad755874369e7bfb6bcdfdfc0cc01c15
SSDEEP 6:7+/l9tmGn14pg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK27SJOwG:7+tu5pqLiuWdYRmBEyPbHkOwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_default_job_manager-journal

Path /data/user/0/com.tshang.peipei/databases/db_default_job_manager-journal
Size 8KB
SHA256 533ebc0b4511b6b794dbb2ee331fdd453ba2378273c560e462c7bbe408f95b68
MD5 d9be378b07976be20900f8dc06b2fb50
SHA1 ca11c8c35b958590f968b809f057832160a55030
SHA512 6e59520ff76ec01e67c2608f75bd659f35e9070680e437dc276569a73db7b6dbae2e3fa82d39e3539b93956fd179484e7327f0c5262f976da7b00bf00543306e
SSDEEP 6:7+/lhXg9bNFl+lXs1w9v5puKx/zrAvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERX4PL:7+thXqLEyw9CNUTN8iqPs3RmBEyPbeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_default_job_manager-journal

Path /data/user/0/com.tshang.peipei/databases/db_default_job_manager-journal
Size 8KB
SHA256 5aacf0b626acff57769b965698acea622d7f74f59e9029d3a00f670e0ec3b18e
MD5 bc71da700c772d9ef823961440dd89dc
SHA1 1a0267c0f16b648415453783a51236cf571e9950
SHA512 e44fa6179ff67a9fddc3a38c98c898f29e4d5e825a96116fcb2e55643802e19174857d8d5c181717ef2da1ca4d2a980d76c056bb9a8ee9aeabbc4f4351c26b34
SSDEEP 6:7+/l9/FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK0Ll//e:7+tlBqLJdeWRmBEyPbhXe
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_default_job_manager-journal

Path /data/user/0/com.tshang.peipei/databases/db_default_job_manager-journal
Size 8KB
SHA256 f51c0747b15b281b519f81027264d7030ad597a35bf67a92c1cd7e8ec05b2e81
MD5 83bf46813c26f65f49408ddc202c82a2
SHA1 e9df5912bce775a40b5f47a4c5cda0420d45cdfc
SHA512 498e238abf823ae13740056019c80eb6da1e797a672747fa8f9b74680b31b8b99d67092833132098e8a92c730229333c04a3e4bd5702a016dce171cac7774d92
SSDEEP 6:7+/l9lqng9bNFlq4ysGbvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERX4PBX4ogLugMy:7+tKnqLZGATN8iqPs3RmBEyPbPgn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tencent_analysis.db

Path /data/user/0/com.tshang.peipei/databases/tencent_analysis.db
Size 40KB
SHA256 efb7e11c8877868ddc8127917cd0ba8f51ad68a2db0ef1c0a4ecfd417143dedd
MD5 ae1a69be87e9104307a990cf6f2b6eed
SHA1 c25cd989dc4a0cb663eb7f2dbc3ac3e827e90bb7
SHA512 a8f45aed1a8f0a6cfd73a91d92514a097f45e62f6e5a9f8f99a79833f5a65ef7e0c8afe88b6a5c93c6d3e3d116bcf20f7630ea664628a86e26012966090c49bd
SSDEEP 24:TLAavcUO3vrOgSDQ/PoISKIDT8GSvGH1ot1m:Tsa/Ofr6UPmlSoi
MD5 SHA1 SHA512 SSDEEP

Submit Download

tencent_analysis.db-journal

Path /data/user/0/com.tshang.peipei/databases/tencent_analysis.db-journal
Size 512B
SHA256 68d8576c1dc23ff76cd077fdb127557ac9a3ae3e91c7afa8996cb24a32fd55be
MD5 11ddd2310a4516e54ff74aee2863e930
SHA1 180c26538577ec9f7418e863b3616e0561da29da
SHA512 d4a7a7523bd6266a2343d78093186711995e3cdd5caf15164276d689ceb1397e5a041a7f4e4d9198a6e89dc8e2b000dcf7e2d5758501279142eb5a7021143c60
MD5 SHA1 SHA512

Submit Download

tencent_analysis.db-journal

Path /data/user/0/com.tshang.peipei/databases/tencent_analysis.db-journal
Size 8KB
SHA256 ff8e6f5d7a612b93cf81dfe472e209110549f709ec04f4fa20d36c44c846497e
MD5 0d422c3325091c2fa6e02b0424adb118
SHA1 9b9c251ed2df6104724ca356ed6a7cb1a8c0961f
SHA512 361170b2b244cd39d5f59bc09bc72d93c6d3a03ea0a38165a00c33ebabcb87b0a1fb6ab4c55e0384a55a11572136def2957d84aae5e4848241d96c47f1269c13
SSDEEP 6:7+/l9AMoFn1xtg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKw:7+tStqLiuWdYRmBEyPb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

tencent_analysis.db-journal

Path /data/user/0/com.tshang.peipei/databases/tencent_analysis.db-journal
Size 8KB
SHA256 f48665faef0726a32bf725a18178a31b31e11f36e471a2e0a3a65656330519da
MD5 139631601a5a7e11c1c439534e31792e
SHA1 c4415e0aa17794282692617d117732eff5bb2fad
SHA512 a00df6f0193514567ad7b3e4ffd1c2d196c5236c102ee4cb0b1894ea7c35c1864594f61be2998ae26f1bf7c62fa2da15ff359b4d04e4e7a02189a15bb9f19b46
SSDEEP 6:7+/l/7XBg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK4Ol//Jn:7+t/1qLJdeWRmBEyPbiXJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tencent_analysis.db-journal

Path /data/user/0/com.tshang.peipei/databases/tencent_analysis.db-journal
Size 28KB
SHA256 56574ed9d8db3a39aa60baaafa9f8b1c55353a494718918eceebb096ef1f773c
MD5 e2c58b77c8409b969743565ec4a39d38
SHA1 cf67fd7fe48b4c0d371c7038953d96ae66cee0a4
SHA512 768db6a41301f9b0d6e36911e2635bd5d4f69e7b5ca755787b7d53669e2ce740669b8a5d2d0c5e49c765195af9098f6c61a87c12be7cfe435d4f19e26597813b
SSDEEP 6:l9bNFl4/msW1mu9v5puKx/zrAvH8i8PQtLu8iqPqqLGf2OJRHXF/XWERX4PBX4oJ:TLWemu9CNUTN8iqPs3RmBEyPbGtOwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.tencent.open.config.json.101071579

Path /data/user/0/com.tshang.peipei/files/com.tencent.open.config.json.101071579
Size 1KB
SHA256 8572be02b59f4d514000939ec04a9b4e2380c55265256b724a617d8d0f4c6940
MD5 f526172de1566b34fdcea744710d9559
SHA1 000cb54d9a008a807a1c5a3fd2b2e7cb41e7939d
SHA512 dc81f0fe345b18c96b1638c67b9ef4c5e60059dfc4a02f3c30a23645d4847abeef46cf467d044c42597115c48052ce0e8ea24328382114a544c5dfd039a95e7d
MD5 SHA1 SHA512

Submit Download

mobclick_agent_sealed_com.tshang.peipei

Path /data/user/0/com.tshang.peipei/files/mobclick_agent_sealed_com.tshang.peipei
Size 518B
SHA256 17eedd7122878e5e44984d9a1374401de1ee48595180a2b6f657cf44d6f92df9
MD5 b424959ab40385709657dc436ab9de05
SHA1 fb239b8fe8f9fe446a5685c5d864c45e17b2fbb9
SHA512 5435d7713032ca9e9cffb4d6a4b353c15fbd22fd82b2d7c37466a75da64d6042252ecafff9ed5cf32b926d9108b24660c41489397c0359c0c63a4baec905ec35
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.tshang.peipei/files/umeng_it.cache
Size 148B
SHA256 ccc056502d7ffde393e5fbcc84f7d973f1b29c6166a21c4fe7ecb28f32ef9f36
MD5 3ac44852a2ecb72266c5d452d3c19d0e
SHA1 30fe684e7d2044334660b6fda58e9d7d64811cbb
SHA512 1216bc5dac9ee32f91571269da6880570de1eee0aa6bbb0bde9b09c5c186a5e89b15ae7392d47662a72783fd5f1f936e86e74bdb155f7259a720aea87e6c0b52
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /storage/emulated/0/PeiPei/imagesCache/journal.tmp
Size 56B
SHA256 6c92c4f75378206112d068b4f52fc58595c2fbe09010884e12187b3efa13b91a
MD5 45c74afe00c9d642bbb2e07a77b88d26
SHA1 ccdd463b049048041b0fbd3e35d3d4eb6696a3d1
SHA512 99d2d4adc2ae49c9848c195ac41d3d78ec82102d4ff2885a0cc3f6d02188e59434013cac93646ff3604d8e7c6cf32227bcfcb9c6fa8d9b33a9e547a636848ee5
MD5 SHA1 SHA512

Submit Download

yoh.dat

Path /storage/emulated/0/baidu/tempdata/yoh.dat
Size 24B
SHA256 f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412
MD5 a936690571e9104e1922dda4a0ba5bd1
SHA1 65f49c57edde2f96be2a1dbdfc3f7351f1e66554
SHA512 3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394
MD5 SHA1 SHA512

Submit Download

yom.dat

Path /storage/emulated/0/baidu/tempdata/yom.dat
Size 24B
SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
MD5 1681ffc6e046c7af98c9e6c232a3fe0a
SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5
MD5 SHA1 SHA512

Submit Download

statistics.log

Path /storage/emulated/0/iapppay/statistics/com.tshang.peipei/statistics.log
Size 116B
SHA256 31cf09681e167c25122a9a2891e848c94ce5b554d25f2c2801ac4d37ca9b0076
MD5 cbd44c48eba3b7f4e5276df669dcc847
SHA1 88c68f862c05d301634427451ccafb142c26a1ca
SHA512 d6f87799cf40e4f8c569d36c1eb5979906326b24fd411b31f8d996cd21663b32dec15e2f192267057decb0c5af953af84b2fe183d416e3e475c2a72ed6c1fb65
MD5 SHA1 SHA512

Submit Download

2024-06-18.txt

Path /storage/emulated/0/peipei/log/2024-06-18.txt
Size 125B
SHA256 06e7a78914970db42563975b8a30dcff567ce0f2615e5076f3c8f4e51bbda658
MD5 1d2794c025fd0dd5e15a96466d8e3fdc
SHA1 e4de56f0727decc1d9e777c0b06dadc6b104c445
SHA512 6f2f6b038ba7007456774799ae5407fcb55379486498773c764fc5837e3e5dc8c7a8c0df75cfb04361da8ec291ee938f29c15abb1d90ad0da493b3940844eb2d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads