Analysis
-
max time kernel
178s -
max time network
151s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
25-08-2024 11:27
Static task
static1
Behavioral task
behavioral1
Sample
c0a52b8d9918b63e45d879bd94485643_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
c0a52b8d9918b63e45d879bd94485643_JaffaCakes118.apk
Resource
android-x64-20240624-en
General
-
Target
c0a52b8d9918b63e45d879bd94485643_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
c0a52b8d9918b63e45d879bd94485643
-
SHA1
b02f87963bf76695ee0fec182e750c8ddc4678f3
-
SHA256
ed9b8486ef7139900343757cc864efa787c64e54704af8e3e2836366c3d69e6e
-
SHA512
6ecff85cdead1e003b19e721f8b93f3309d15265ec33ef83160b580761a539230c050945834d3b6894cc176b8a8cd1a96d3bbd16f8a690556fa5e0eb59afb78a
-
SSDEEP
24576:6cEoL0otaYtXMuSprkM4FqD5Bl0ZHqU+3jTo+U4j8vgq/13tdHbZKm51Ob83P:hQ7YtmrkruBl0ZHqj/Bj8vgq/1XHNKm3
Malware Config
Signatures
-
pid Process 4975 com.equq.ylbf.dnxd -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.equq.ylbf.dnxd/app_mjf/dz.jar 4975 com.equq.ylbf.dnxd /data/user/0/com.equq.ylbf.dnxd/app_mjf/dz.jar 5032 com.equq.ylbf.dnxd:daemon -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.equq.ylbf.dnxd -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.equq.ylbf.dnxd -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
flow ioc 15 alog.umeng.com 27 alog.umeng.com -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.equq.ylbf.dnxd -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.equq.ylbf.dnxd -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.equq.ylbf.dnxd -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.equq.ylbf.dnxd
Processes
-
com.equq.ylbf.dnxd1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4975
-
com.equq.ylbf.dnxd:daemon1⤵
- Loads dropped Dex/Jar
PID:5032
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
Filesize
739B
MD58c54b19e64c99daf3c2b4af0920224bb
SHA10c37c0cca228c4ac20ad8e4c895c67472d050e47
SHA256b06f48bfa8f14c6bbbcc66e4a4ef016684b1153a4493bf9caecacc376f765319
SHA5123b6142ff0bc7842739bd899823e49fa4053747be947ff5fd7bd0d96f4d0a5acdd7b50b2280f7592183afb7f9085be150584764dd425a6d11b2099397d436a394
-
Filesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
Filesize
28KB
MD5dae68dcffc3d522a79f98ebbc3b6d457
SHA16df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA25656cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA51223b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
-
Filesize
8KB
MD5f962eebf88042f81fc536455c140c3e7
SHA1aae51ebd52df4cb620e98e6591363e67afeb3352
SHA2566abd77bc234d7ab10b482e78a8f7474b3434a50200bbd03e38a018a6db170dae
SHA512b0197bade278daa280cd658a9dbb90a3b82c619568c6a1c664d005065cd44c19746808a1bcbdc7c667022e3db29bebc0b5cef2a7eb710feb9406528157a25cde
-
Filesize
512B
MD558683b467126a98bbcef2440b83a5220
SHA18de888630a5a42c2f16795502218c98e51804d82
SHA256c049b0035db81a5b949e3e7e11022aac4a68f564c34ef8b7c9cd5fead1ef44f9
SHA512365f3fcc1f8ee787a293b100e73ae40a95dcb565a8016999ad0e8095e5b8daa9dfe2dba1ef46e2754704f393b262a2a0efb4f0d2e24796d2d123b7493465bf69
-
Filesize
8KB
MD57ac198ba4a140dcebb3512255b853bd7
SHA1d6235a680cb74c8ddf3eb543cd44176ea021da98
SHA25689d434eaa15e96c680d2e586fbcb8e3bd5408a842a9b78252e0099ca3a953490
SHA512f475d6f83b3e9039ffc71118c670fdf0be20d085e35166eb9dd614964700c6c921c0b1fb4f703f2fc05ba9859dd301a73643be0cadaf50826d1b3c61cbb38fec
-
Filesize
4KB
MD5ae85e106292d66ea89e6cafe0d4f396c
SHA16324f7843c887ba680466e0159f05abf2b1f264b
SHA256664f10713c466d835ec1f31e47d6946336f5317b95a9b1ad527964ed174ed041
SHA512afb3fe2049da3d7fb369a7539a0034dc3c82c0640d736ffc5103a64ffae0a989b208df698b81af84fcb2b17072fa3b80d04dffc5f53906a6ce1583c851da6d80
-
Filesize
8KB
MD51afa9eaa477f6067469819bc3da81be4
SHA14173de2f4a80cbdd3454b941586471f66eb26ca2
SHA256cea03e404b562c689d78b4ff30a9cceb67cd7e1aa5d530f116024ae7e79be1cd
SHA51277cfedb49e077a217e9b3d368f290a87b507feddd5b3d0639c724b7cd186978950234bbc2c9411cff07de698dfe846edf87e6255353c248c22e5bba7825685fa
-
Filesize
8KB
MD529c86702d28c9d194d247516faff56f4
SHA122a30fd1d5fb8734afb758970de88148df4ffd71
SHA256f11a07ccd01a703dc33dcad27e5cd3e88464cf491335c4b115115c34b5fcad29
SHA512ec583489faf682b50f585596889a2112d7587f6f666e12dfa422f348fa7167af374073c25177255bcdb17bed93a8271125eba77edd425bf325ec22da9c0428ce
-
Filesize
943B
MD5198c9831baa960c824afbcb27c29f79b
SHA1af01766ebb27ea8d968b3453f33eb67cc0e40d64
SHA256de9ea40f8edf22fd989b7de9dd8246f6dc69f59d4a7f34044340abda10ee501e
SHA5125e77995bd9b1de3e4b95606731133c2b4b2697ef8d12678f155a6250926f1eaa3e1eb008b32391b3a3562cfea5e9ec0412959360a32dc7aaf71d235aea759213
-
Filesize
943B
MD5a005870f0373598e65c0a97d3f9e6ef3
SHA1a4f07b6b33acec0ebbde2d9627ac3400998a9ada
SHA256c3569226f580436975ebb4db8a426797684410cf75c5abccedaa8fe4f0c03c7e
SHA512047fc5c7f17a55d895fea0d9e7312d59eb8c3a16187d0959102a2975ce0fd6e1fa69b169412ac94539f104cfbaf2c5ae9747792d47e6bd4965d1409456676845
-
Filesize
162B
MD56f232352ba2b2dc56d4b43ef9c3e4b1f
SHA16aacf75ec26770f7516e85435e687ff3429adba2
SHA256ac596ef54c2df9f3a0bd30fcbb2e0a283579afb6c032cbbb63b7dd48a9b4bbf9
SHA512aeaee38fe58980cf1a565fa394dc109898a2e35a8c228a38e9f0a96c8025b5fb2dd2b3c41d7a819d5f607fff56fd6d1f5a9e0596072b35f85d8ac9ee31825145
-
Filesize
203B
MD50360fdc84f5a87a6965efb71ef2c1101
SHA16a4a207b06a6afa20d29c4a4b37b01f84d9bddf6
SHA256ea01d39061e39286ffabdfc7dc2cef9630c1988add6c27181b07d360af8a0660
SHA512c57758fc63eeb96daebc20afcf8dc0f1dbefb6e0c503523088031926e04fc0032323e4baecded8f023f62659bc2c4f89b116335abe22f60dec2855a33547fbd6
-
Filesize
350B
MD593a2ae1e67b2e1b07aea8ef6e83fabae
SHA10b27a248a0d3484d48c43b0f818b9a1a7324fc66
SHA2568375e0b367344ba0ca8207080203fdbee14909fd2005647dcbb6364cacc4c530
SHA5121e36104435a321153f782a0890dbfb94c60807682ceca0403b2f341e56b1d16ac13a159d3ecb9e409fdb70903d2076e6f6b8c004ce0e8d5364633bd5b5f0ff07
-
Filesize
178B
MD50120e4ed83d662623c88250b97c60d7e
SHA13cdcc29b7888e76dc9df03d0fb7577d24d275b4a
SHA256bcca9ff93048cd741270b01e402a4794489199b0866a32bdea40571bd347ecd2
SHA512e57048427dff00248e0cfd2747b70cc7d0a4787129665bf9c1ea4c4045aec26e881b75fb1128989c09d11c844c6a00eef818686a146210027cfad068f3106857
-
Filesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc