Analysis
-
max time kernel
55s -
max time network
126s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
27-06-2024 08:06
General
-
Target
1542de6835d0a97b7edd7eb2f21aec79_JaffaCakes118.apk
-
Size
1.5MB
-
MD5
1542de6835d0a97b7edd7eb2f21aec79
-
SHA1
5addc9b49993dd1cc0c7243f00e975c81b5d6135
-
SHA256
f68a71f696c2cf42bc1e6717644d7cbe975435cb28bff24f5dd4328f7f0c22a8
-
SHA512
146e2ae62c1897a6ad505a075498009d058f73ae6e922171b48d1838f196e9883fad445ad7bb66e9a9aebdb8a5a4251502495f8a78cd813226e04c5b00f425a4
-
SSDEEP
49152:wy+a6u1yQfS6pFJoo0Eo9AOOniENtADy3MGI:wx3iSkFJo28OiER8GI
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
-
Checks known Qemu files. 1 TTPs 1 IoCs
Checks for known Qemu files that exist on Android virtual device images.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ddccv31⤵
- Checks if the Android device is rooted.
- Checks known Qemu files.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
-
chmod 755 /data/user/0/com.ddccv3/.jiagu/libjiagu.so2⤵
-
-
/system/bin/dex2oat --instruction-set=x86 --dex-file=/data/data/com.ddccv3/.jiagu/classes.dex --dex-file=/data/data/com.ddccv3/.jiagu/classes.dex!classes2.dex --oat-file=/data/data/com.ddccv3/.jiagu/oat/x86/classes.odex --inline-max-code-units=0 --compiler-filter=speed2⤵
-
-
sh -c ps2⤵
-
-
ps2⤵
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
534KB
MD5815252536c3949fa3fb91ff969d92dd8
SHA16d3b366163cbc8074a4d81cd87010f2504f9d582
SHA25660370b905a022cea81a810a1262ddd7f1628b34270d462aed89fbbf53d3c5677
SHA512fa2e6571105e7d36de8e445567086c7286af399d2183372b88d8667ae77acba177a902da09d1e55b38d7ac78679069db64052bae77f8312ea2f938da3d8ace4e
-
Filesize
1.5MB
MD520898dfd3e3d0ff8a6b99ede4a08e92a
SHA1c6a9756c2d58e723ace9d22367362edc92535ee0
SHA2560e8fbb64fc0cad28aa62e46951ce317ff0975461fc76e58316eb4970dc37f7df
SHA5127983c46d3b2cca27de118e466595c45d4d8ad43e06511fe0a453cd14af013d7ac4db980d8882b735a5851d290830d6367253e74de94798d907c319250b1a4762
-
Filesize
83KB
MD5893dfcee96dbc85834e5345669d40d67
SHA1be338a037e53ac2155d9b3664b0ca2a7c993102d
SHA25641790ad9f29fc47051e5efebe54dfb93d2059afc73b136ccc920ffc72d5204fd
SHA5127791ebbb0240ceb0900a24aaae18bf71b835ccccaf93bda7e78cabba381ea467fc0dbd3f67d698dbef076a0b043ffed4ee09d68b5151032abd0e3d4cfd01e112
-
Filesize
363KB
MD5f7f5e960db0c8a6f3b5b8d1a0427a042
SHA1a8b623f9f87a6e785508befe07314da2fa903bfa
SHA25617ac5b03f2a51ebdf2cce66314bc8e3e1547bfa0dde61357fcc07768aaaecb3c
SHA512ec889d1d9428cdbac082d0b5ab81cf33ac417874a416daf27b02af3d207b1b02ed794fc0b3f0ea266c8edaf3bfeb8f3cef7c631af689405fa629fee948ae8cba
-
Filesize
40B
MD56d1e2a20ef3843617a3838a840c5d3bd
SHA1d93427d2f5df911d179111bc474e24c83cc52fd0
SHA2565ec9f7ab3bc9e0339b2a07f3fcb8566544f53e0cf840dc488cf9b181c94bead0
SHA512558428c420a8c05a9c115d14b2795a2c7409e5fc2299e240e728239bafcfc0a5827546504fbd4e71f53d05e34e55dc0ac8d47113045506801647fba54190650c
-
Filesize
40B
MD5e9c5523761d636c5cec41e2a4009d91a
SHA1e1bf754688e0576765f5886a56ffb4d8e45b7979
SHA2568b5574fb662878cbfff3ec4be737eb131db56dc87a6cd4dcd36f7eff6f1abf87
SHA5120261eb17901c2a84ad8a86cea3383079e671b22190e9758c76f081ecb61f0b95b55e8cf1cd8f5cb660c8aaf478d9ef11ac0d47374272bfb754abfd4e430ae5ef
-
Filesize
340B
MD5582bec674ef057a2561eee5f2b313dae
SHA165554fdb914c9fdbd254391d71bcb41c1a4f5eb2
SHA256fd74a107d15c7914930d9b608168dcc3828457644f9dc594eb2004f39dab9b16
SHA5128c8157de20357294e219d02058875bfd2d0189eb4fd278cc444a3ed96cec231098f8fc6be3d3ea2582883b48647bfe4a6a96b29718924f8c54fea22e8fd0b120
-
Filesize
340B
MD586de7aaefa41065613ccc6e8833471c1
SHA1a5163af1a87133ecd29c534c80a045bde043d1b1
SHA256d62d033ca3a56bd9c2755402aaafdb691f390cd357c8e6d19c92d350517f021c
SHA512703593b91bbcddd036a59cc66a92bdb49805d40e8337ba410132980d557dad586fa747af5e7cacac2894a1432fe576030f93eb6847b3da81cbe0114d1ac391a5
-
Filesize
40B
MD5d9c694484fb965c436f762de52935895
SHA1711ae007d9f8429502de0c5eb913903eec1ec115
SHA2565f2808bd0859f491f1056cc9fafb92aafb34bd3a10672f7bac3b10bce27f75fb
SHA512aca34c7c8073059debe7a0bb3ffc4221718ca7fb9b74eebb0bad8f867340584ef83839bfc0449334d6f416f1b84d684171689c26b15a4af9f49d83ac3b8657c7
-
Filesize
314B
MD54f4ecf21bcf011ff3bca168bccbf6d15
SHA1a12f5341df618ee990cbab4d6b5f26fa84ccb850
SHA256e71af0e1c0e7381cb176c2473c29b7ea65f8698dd39e7880ebb8eb729f84ab12
SHA512f2cec02cd00802f44953e84e4db42b7f3338b7b463fd2edd1a201ab4661803b4faf073db4004607cdd942b95ea2d4618a2705716e27d4276d15e58c3e4c6ae1c
-
Filesize
27B
MD58e383c96193bef7c63a99c13a8dd2625
SHA1dab448a6171b0def2c2dd8cf9db6726bfd7ad403
SHA25646bcc48775071340e5649e28e2ed26617df08fd108781b1207bbe50f53a36fe6
SHA51285de81daa22798a8b9bfafea855437e9b2caeb094137a5c3d7abbe95828fbb132debf1982830c81a771768f55028ab351c7bd5efb8791a6e197b7f3c62fbbead
-
Filesize
48B
MD51d8d16c4e3b19ebf18988530d9b9a757
SHA1bc94c1cce05cd848a53271ecb9c5311e27ffebf5
SHA256abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7
SHA5124562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82
-
Filesize
32B
MD5b122afd03eb882e9e9775419dc1a5693
SHA12739b7037481995d9085c670f0224fef6e545d73
SHA2564ce951e9275d2a938aec53d122bc8e1a985ab7a82bbe8404c5c50679b2821277
SHA5127c98852859f1d62cb25a40650aae2d43d1bee0b092299fa5be13f0e29ea2c2dc9655da68eb7aeba1b041e707e702592af068e220a7b786832f0162dadc486f99