Analysis

  • max time kernel
    5s
  • max time network
    143s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    14-08-2024 16:48

General

  • Target

    96dc778d09ac69f1eb367644fa4ded1e_JaffaCakes118.apk

  • Size

    7.1MB

  • MD5

    96dc778d09ac69f1eb367644fa4ded1e

  • SHA1

    73a212ed819d2004cbdfa51120ea325ab676da89

  • SHA256

    3e7fe6362e89073cfc42eba4661ef1c44fef918dcaa53eea01a215f60242bd37

  • SHA512

    7e6a8cadfe838fd9136050c6ce40db8e489724ba295250434fb60e7b2e2e42f70c11a2b8a3aa38dacc605f965d970085ca007bcb2581462953b1d4d115c1d279

  • SSDEEP

    196608:WFetTtA2li2T8vi/zgJpi4JInjCge3QAH9mbq6f:dyomp3InjCgtNf

Score
6/10

Malware Config

Signatures

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Processes

  • com.miyi.onlyu.zimon
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4217
    • chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
      2⤵
        PID:4246

    Network

    MITRE ATT&CK Mobile v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk

      Filesize

      50KB

      MD5

      6a2f8961c75ff474d6e62f87d2ae700e

      SHA1

      6322a924e3e533a5fd556cec52c2e4f4c0580464

      SHA256

      83d06c3c2c9e52b7703409b33900e86f6954e4946dc475ce7538a86b76f94c9f

      SHA512

      6aa3badee9e9d2637eed62c4c582c630cd0bb5b9b622f025b10f7435fd10d7934857f2470e70de80e3c20e1d04681d48d82041ce324febe1ba258677b2b195c1