Analysis

  • max time kernel
    179s
  • max time network
    151s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    25-08-2024 17:14

General

  • Target

    c13462c64ba98d3afde412ad9536a782_JaffaCakes118.apk

  • Size

    1.3MB

  • MD5

    c13462c64ba98d3afde412ad9536a782

  • SHA1

    74658808829357321604f69de8a56591527b5eea

  • SHA256

    5df2bc7f0850aac0a6df57770cff3c4ead00f8f77c4791aef71abbd0fd492124

  • SHA512

    467cfa7ad5488473de573ca5f7714259eab31b9d8a89cb5967c95977525651265974c73b5ff867d0498e0408fba9077242ba170688776f541ecc76b602275482

  • SSDEEP

    24576:vcEoL0otaYtXM6SprkM4FqD5Bl0ZHqU+BjHo+acjeBKq/13tdHbZKm51Ob83j:6Q7YtKrkruBl0ZHEj7LjeBKq/1XHNKmr

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.vnsn.motg.vatm
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Checks CPU information
    PID:4509
  • com.vnsn.motg.vatm:daemon
    1⤵
    • Loads dropped Dex/Jar
    PID:4570

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.vnsn.motg.vatm/app_mjf/ddz.jar

    Filesize

    105KB

    MD5

    23ba0b249042b7ba33e92c0199b0ea4a

    SHA1

    99b13ee9f7307316c2337953fceed87e9942b794

    SHA256

    1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

    SHA512

    0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

  • /data/user/0/com.vnsn.motg.vatm/app_mjf/dz.jar

    Filesize

    248KB

    MD5

    a54a18b58c6720991c021f433dfb2a46

    SHA1

    d2ffa07919f92b6e04914e39843f08fdb2a75b68

    SHA256

    3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

    SHA512

    e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

  • /data/user/0/com.vnsn.motg.vatm/app_mjf/tdz.jar

    Filesize

    105KB

    MD5

    293ea5f01e27975bed5179ba79d80eac

    SHA1

    c5b0806a537fd1cb753e11f1a9684933317716b8

    SHA256

    8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

    SHA512

    c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

  • /data/user/0/com.vnsn.motg.vatm/databases/lezzd

    Filesize

    28KB

    MD5

    fdb8a92e5060ce104e8f0faca55a47ce

    SHA1

    270d7ca30673e18cec1d2b9add71cba96dc426fe

    SHA256

    194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a

    SHA512

    ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

  • /data/user/0/com.vnsn.motg.vatm/databases/lezzd-journal

    Filesize

    8KB

    MD5

    d4510620f8ccb0769919a5f9d8b1758a

    SHA1

    a356ab47162316ef3a522103aa1f6dc24b45bfde

    SHA256

    52a73802d033cf8982da9ca28ee488968ab0f8aa86237d7c34dc7f3477fc5e8e

    SHA512

    860dc6fd920c3ad69b77f173c1a4da45268bc92351b30940c20d97e5b0403efe56be4afca740248202d91c90b7eb082fff2d82589687a339b0a809a6a3d74ef7

  • /data/user/0/com.vnsn.motg.vatm/databases/lezzd-journal

    Filesize

    512B

    MD5

    f8ac8b6d7ffb2f6c2f7738b6c29f1891

    SHA1

    6f0ba95853975b4f0fa5165b2ad21c8131b989e5

    SHA256

    a6f50858632573734ca0efb47d737b5709d45f9ba5ce79c3d4183286d61f137a

    SHA512

    e7a46b6fa82d097f02d91c41fd47a623281657c9896fe9b162e2507852247075c56c19b32f70735b3826b5baa67cc63190359c0162afad6a3357622f7bb67507

  • /data/user/0/com.vnsn.motg.vatm/databases/lezzd-journal

    Filesize

    8KB

    MD5

    2459d60eaef11599914b14f23410d587

    SHA1

    2dba73d8cc7cef6d6276a1de9e9a316213ef8bc9

    SHA256

    cf6dcfc04e21161e509a00049dfe4e3f424bdad0fa19e5003c55b7a2068c1663

    SHA512

    15adbfb89c83cf49244219f6691de83456a11dfc6aa565c50cabee360a188e054ce70e739ecb3ba476b2c6210f88fc183e89d3a2b339cf5565edf0b6893cc6f0

  • /data/user/0/com.vnsn.motg.vatm/databases/lezzd-journal

    Filesize

    4KB

    MD5

    8bd3eaffd08786f1bb2982a7c50e6f1c

    SHA1

    17d0a4330054dfd0b2af31dc8eec7d46869fe98a

    SHA256

    de24fe034eea32f2740283ee8cd82db15004c0523dfd3d7a17af3fb8e183e2f6

    SHA512

    fe8ec8b45fee40fc160387187667405743de63a0630fcf5084d533eddb05d97a16e90942b1073bc7f56ffa44a4aa6a6cd306aac0ced871c5e7f732e5805fa717

  • /data/user/0/com.vnsn.motg.vatm/databases/lezzd-journal

    Filesize

    8KB

    MD5

    fb38441c925abcfda9874eeff459c339

    SHA1

    b55a3193cadb42e8d1819d704fa7c708081bc606

    SHA256

    c40310da04757f947dde2064a62579d9f0639832f76386515e91f702b0acfc27

    SHA512

    1e35246139032942ea2114dc61af8a2b9ea0b8867aa0d922c6fdb8fd7bb6eb90609dc870c5c85c69b573745ceb911103a4975c4f0b2f97d58ba1bc0310ee5705

  • /data/user/0/com.vnsn.motg.vatm/databases/lezzd-journal

    Filesize

    8KB

    MD5

    3b59bcb1429c0d3421f8fef83349c96f

    SHA1

    9b9c9511f34e902bc73f186916fc495b5c53442c

    SHA256

    22f9683510f32489ddc8ba94fa914e3fb95820f1eedfd129bb0c467d43722116

    SHA512

    f181cacfdd646f2bf8cb88f188c5135895361b38e2dc6883f901c4c88ddfa74da04298e6bfd4692a38c4626f2e5589527ab1ee3bafbeeb6bc4d584566b33ea96

  • /data/user/0/com.vnsn.motg.vatm/files/.imprint

    Filesize

    944B

    MD5

    9307294f9f6d00d498da5d4a4988efd5

    SHA1

    b6f6c7f43e2acef618abea86d1f0df1a928b607d

    SHA256

    1db6b406e61fc0cc58937ee734d817873e35615f4e3de056320e60840b330e54

    SHA512

    3823bb66c6ba0c6cc73149ff07baa2e4946783d04af38fbfd3569925e1dc75561c4567ccad17754900b4f3c35c15ea7de432b9186af263096477a20915bbc4e9

  • /data/user/0/com.vnsn.motg.vatm/files/.imprint

    Filesize

    944B

    MD5

    dafed7be681676baad844b6efbd3da45

    SHA1

    0c0f3bb8ab2144f5b40632bf18eadeba16ee54dc

    SHA256

    85ded6f9a694b705bf3bf58b40773b68bef7a63fabeef7413451bf53b70b13ad

    SHA512

    00f6708de1dd480f918662457dcc0163ec9aee5864855656b986a53d2d4a30381a021ad16e83d72305c563638578d725d2d199a3c52dad254beaebc7f395f785

  • /data/user/0/com.vnsn.motg.vatm/files/.umeng/exchangeIdentity.json

    Filesize

    162B

    MD5

    abc181ccf6bd79799c6c7de6d1b9cd54

    SHA1

    41cbd81e0297bea3760ebcf5e28bb22d6060c3e2

    SHA256

    d7abc1608dc0e2dc902af2d4844aa10ccfda0974fc30caceff72a17aab9c3743

    SHA512

    e2d6c07aff2521ba1999c8a94099a537bed457b14e08b322225a04d94a83763daf2b333b8a975626a5be086a7a85ad7032f4e8616ce826efcd4c7c3db8a40c6a

  • /data/user/0/com.vnsn.motg.vatm/files/.umeng/exchangeIdentity.json

    Filesize

    204B

    MD5

    bb0254205acd02839e8499374a64964f

    SHA1

    b1770ce341f0d16d55df7ef629d46127607c5875

    SHA256

    3ed96e436e29454e409dccae238263fa668c68fa4a9ea830e2f912f7bac0f352

    SHA512

    408a221f92b0e75e090c575b7f9b849d76e9d17dd0e16290cc77b43caece851dcfde4471a9aa06901cf28d63a357dddbe149b461595ffca86fde9ef9962ab4b1

  • /data/user/0/com.vnsn.motg.vatm/files/umeng_it.cache

    Filesize

    352B

    MD5

    788547ee0fbc64b4067b8a30e29b5bdb

    SHA1

    2a3919d5a873717d705167a410c867dd9e937d82

    SHA256

    4b44bd90cfc0f3bfd5cf7b365bb8e77e1efbc48249d175bee51e0efe37863a0a

    SHA512

    fe5d446ee2d0437f120f8ec50d77f7c43f9cb6c451b49b8318fef071683810a0ef567569e544f72969c92a3885d023bd259888d2852d5c2cad10330d10bef08a

  • /data/user/0/com.vnsn.motg.vatm/files/umeng_it.cache

    Filesize

    179B

    MD5

    61cf32ef43e801cdc1a9ec8b90cab18b

    SHA1

    e3e8b91d1e58a4a2dd3b0f591aa699aa11174b34

    SHA256

    467cfa5d97e1be428bf494854e1b8b44fefa492287b0ed0c08583624cafdfb90

    SHA512

    8bcfba6e5e907aaeea5051af76c91aee9eafa3a894ce6d49465062a9800400afd6c27011f8b72bd425593a07f3552777d192874493975bc37d703ca2aa9a37ee