Analysis
-
max time kernel
144s -
max time network
150s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
07-09-2024 20:51
Static task
static1
Behavioral task
behavioral1
Sample
d2d0a486fe9d8e76fee51461f3604dc1_JaffaCakes118.apk
Resource
android-x86-arm-20240910-en
General
-
Target
d2d0a486fe9d8e76fee51461f3604dc1_JaffaCakes118.apk
-
Size
12.1MB
-
MD5
d2d0a486fe9d8e76fee51461f3604dc1
-
SHA1
e364d8ba23818b08446c62ca74a7609b8ddd9d89
-
SHA256
159e969a3033801b26b6d0c69e283647a44093969f3d11df0c311c36ed63a952
-
SHA512
9cde0c858b4e7a719aefdaf2f1315c8dd414cdeedac07cca21dab8f52312b6b9a0892b2253e437dd56e137eeb25d7145b56c4e3faf0ddde7a6aa52664c80a919
-
SSDEEP
393216:SX/o94NEJdONS6PFDXaw6bf9RyKCb+6zP:m/oq46NDXaDzryKd6zP
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/bin/su com.sursendoubi /system/xbin/su com.sursendoubi -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
flow ioc 6 alog.umeng.com -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.sursendoubi -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.sursendoubi -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.sursendoubi -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.sursendoubi -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.sursendoubi -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.sursendoubi
Processes
-
com.sursendoubi1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4218
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.sursendoubi/cache/data/app/com.sursendoubi-NqwzIz3HGmxA5i2HQruGvw==/base.apk/journal.tmp
Filesize31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
358B
MD5a3a4dc85a1ab03adcdf97fcc8cdf9242
SHA1c282c0ecf2b81be50b10a7c74d9de69906b63ea3
SHA256c320dab54729715ee3669f77fad30d7bdd00d95180e89d0ac18ca37d5af6c4f0
SHA51223902324b7dc402d5c9f997ef696b08490fad5d0fca2449f5c3604b9768af4b6223a48d06250d35e2f4d97942ed7de2318427acf409d693ee50eb5d99e0060fe
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5f1d9fb8810218fe1f9b37f7b06058c26
SHA17f18484fd6cc9bdaa786d7f53febdb464edcd6f7
SHA256acf24302ba0381cf3574d9d6f22b0f407546083023b18c168c5fe878c2e37259
SHA5120ef792ce9e3de5ffdcf509f1720102ed89f0d19b27ccfbb4d2498ada05f425f0451c7b15171ed47ae8d316ebd70f5a3c07298e754d1fec10a6b3c2cf866fb40b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
52KB
MD540b6ce02a8bc28220139047b8405019e
SHA1eb5883f7f554c5782db636901615bcd0a72115c2
SHA25689d0edd3e61da62e43b5e1e18c54dc944658107668d183b666a2d98334db11cb
SHA512e49838b5ba8ca38c06822eaf10bfc06e3390624105ac15cddf3175dbf39ff10ee8ac4420cfe9e267c3435d5f68b7a7aacc9cf1ad9b473a27b89f635e3b649cad
-
Filesize
512B
MD5fb683413112b96a98cbb43c0efdb4e78
SHA1e86f1b904a5c3416d2a58e0a213e89070efb9a67
SHA2560a05f716377a63e430f89717ca39b8324d703824dae71db4c985b29e3dc26432
SHA512a2957c05a5d92b88c42a746c60ccc6528702bd8cb63420f7c240b96fee98d9b8c942c02928c79755f71d03eabf660e0ab9ffc65a33c29a598ae3223c0e083e04
-
Filesize
36KB
MD5adb0a14670a32c6da2b58b74d8c8fd57
SHA1e5daf9f6ca62a13692000d896e3d4a94c6699516
SHA2566653a921d1c37770a55bc56eec4cac1a07ec85732029bb79ae3addf30fd9cd82
SHA51209e318c36de04dcc599fa4868d46082ae354f6b624befbddc06368d04d396f1020b546916a676910ad50fa64aad2d1daa35a73e727817b48b8c2ed639e76be85
-
Filesize
661B
MD51bba80daeb670cbf076068a05a1cecab
SHA1dabcb28a2edc85eaf46c528de8635b05582a4a99
SHA25657a0ed569b974ca85f6601616c6651491aafbe109e91c41eb368680869df750c
SHA512b9bccc15b92839cd9c003b129c632ba67f1e34478e6b516fd0e1e11e43b35fa867afd334a45cbd7427df6617050d6e0e3941266c33e2efe21637bc9721ba2d8c
-
Filesize
752KB
MD5ccce8a3a860a8c271ed9f588c8880383
SHA1b866975ff12ac66c7360c026db47567d82e32782
SHA256bef0c9bd57686d98aba7bf7892611ea9d933b9871ea5ea8f60d4d4d140489226
SHA512ba2499f7a9a9995e9f961b80ab6208988cf5f64c18cb7bf25e56a29ec945a61b5fedd17bf64c012c2bada47db99dd6853974b3f57fd99f3e5fd5a23d55034feb
-
Filesize
3KB
MD53844c9d199c91f477e939f57460e8d4a
SHA18ec42f0e4cc0201745e64c750166c5361f03f34f
SHA2565bfee417519d6428a498f805f392108fa00fca35772b05cf233a232b554250cd
SHA512033d62d69d7395ad3dd91cd488a354793daa3e4d9f0488c8811209ad4247a49557cf58ba391b198f9edf6015ef95067349c60770fbf13574d0bfe4a6b3f52f1b
-
Filesize
2KB
MD53a373d98a467427d64082b0cee4b679b
SHA16fb5b68fc4de557b7be7505592e2dff3a3237048
SHA256b4cab5d4c354463867c8a73e4047b3f4ef95dce5472f47961746b47c91b77d4e
SHA51258bf186f415368a235f1b09fdc65329200c1c97589533a463ed1b1db937722c3528e9adc4fcfd99a1b012c552225b4990f192fbd9aafd3f45f7881a67edec2f3
-
Filesize
2KB
MD5b08c568883e84c50c9a67a192b99a492
SHA163bd0315e5903669782f306898a2c8c9a163e2ff
SHA25648141d2f8400c0f29879fdac67033628347e8c8025d698e957ac6eacd8b2fd7c
SHA5124abece80d04d7f0860d212bd9577d25e3f1e5c5093e3cbdd37d038e133ed705a24587af4af9d630ed3839c3ac29205386f6c519bbde1ef4754032ee4bb81dcec
-
Filesize
2KB
MD5f2d8919ab9c5ec16659cc2da3a8625ab
SHA1e22618e3dd912e2458fccaa782b26a3b12477cf3
SHA256a644d4690abc9db4f044ee23fe064b89cebe1e2bcd072c3ac78866210c27a1ff
SHA512483aa286a9456a5d741d0d6a10e82fbbda5ce7f52c1a664b4e2f33594ff434f49efe64186a877ae8a91bbf919eabe99b3f65ac668921aa679af26a3d37591534
-
Filesize
2KB
MD5fe8b0adcad3ffcabc978420238f6a2b3
SHA1960653699ceedf3803be6168669ba8a2670b0dd0
SHA256c6e86790f607fcd3e2a04844ce689a30c97905f143d778edab86d144c9ffdc47
SHA5126a9e217c19182e80b2756df95a9a993dac0ef3fbb7d99dc259d65da6c74fb074b8c655f6f45f1f426f39f3ecd6573c7ca30e300b0a24915fe74e42a78784fbb4
-
Filesize
2KB
MD5f5e2d9f1dcd720bfe807281884bc2a20
SHA1cb7ed7f07fe409b804ee21e5088807d081850c8b
SHA25603f7628f6b7639eb65a15e96da1a95bdf31027e9a7eefacb3594a5ad4747e664
SHA512c47ee3eeae97e0e503af45282aec04c98a35f3d34855af0e53c191239849827ec8dc7f28aca16759aefbb036fba36326559a346e12afb2dc0db0118304dd87f3
-
Filesize
3KB
MD5a004a70512c9a003a95c1e8e4714eef6
SHA15db343fe2ced6a061c2e6d76edf625219ad5c63d
SHA256e2d7050a6590a22f0e4dc5bdf7f093f28630d0b3cd8d687057451c0afd360ca6
SHA512162dad6f196abdb3a8dfc026cba7fab2edb8a68d6586a02e6481d6d9d418d3ed9d67bd7bdd57968e1b8dff095c9b3869355d3a145b04f53d2705af6f8752405d
-
Filesize
2KB
MD51abec0711ae046f9c6b7a116ad8f381f
SHA1027f7e71317db54e1ce353190713465107ca71ce
SHA25681712c7489c3d59a21b8698e8180ba1635c69f5ec100042a04480c8009d2b62f
SHA51201c0362479f7d329119ef86ace999bdfdd9ce559c7b711294258009943797fe195078e7621924870bc55f1cad34658d929c72867d819213a4c7cac2e4e00ebe4
-
Filesize
3KB
MD5cf5f03b172ff36fb65600f7f0c4d21bb
SHA1e322ba45bb1bb51667eb94164d90e7861f8e1235
SHA256dd6a7126b9b1ef4fbf16706a0446a6afdb7f414e2fc1a4c64ef7f9a1b4bcf91f
SHA512855a4d74261fef82a237e7dd4fd905766f39a02a6d429e0622e56914b93d66e301b9255b50a36c32a16f15056ea017ede6f60b2e9f93e20a36aebad9419f272f
-
Filesize
3KB
MD51178f34708f6a185939411961ceb9d4c
SHA1406482bc56862734cb1f00788ff3bdcf332c0521
SHA2561f111be94a4da9a2e595a3527908fb179edab0947e3543adf1ee58db6ce67b53
SHA512d35951cfef8c26290a23269105935145fe26469b70f29255e9071b74305eaacc5f24b1a7534cd5782f6bf766e763ed5ad027a6befd2c9f55620d8772dacf3aa7
-
Filesize
160KB
MD5fc609a8a27249438661a28045ab91489
SHA1794cae413656dffc6a4c262cbafbd0619235ea1a
SHA25697bd8a68fdf27c1ce6570f08b2b7544d7970661168cb788abf7ec1614b57f1f6
SHA5122830ba8e14bb4629a0b6f72dabfeedd4eb0438d7f83b79525330dd9b5a5788be78c5d869b635fb179056f5bd4a559589458e40e98831969b1138a074502d4067
-
Filesize
51KB
MD524ac967600e3e7700d776362abee22f8
SHA18f63861933f7da4dcb3370b97f5be70a70750ad7
SHA2569cbda14aaa54c37f727effcbe366fabda9ffb2fd760dcf894af9a5bec80ceb6b
SHA512864fbd7a0dc9e2e579c0681ab266062369f8be54ee34fbb83c121d0f248e9c9231d7700cf57b30a2ccbb4ab312a22a1ffa8c1dacfd20e2810925f1cefba8a066
-
Filesize
38KB
MD59edd107e7a0b4fb0a0314447e40c13f5
SHA196ca01df9e81906408bea461441cd8767b469705
SHA256cfcc1aadf69f7242f4db605aea394dd8665f010729feac057970b1dda071abb9
SHA512fabb2090f6a6f88d86f0f1e6e586efe3f68039393c47a1c2d27b75c26e89e18ea8db11445dd20fca23107dfb56aaed79520eef99749c4a0f292ac9e20d4be07c
-
Filesize
30KB
MD5d2a8c9d6c907b510d1013dd213b9712b
SHA1b341796bd98c24acf343553d395a5a70a73b206b
SHA256e0a1b89fba259a3a584cf3993ac1ebfae31d31969e81df3a21f829a8e38846cf
SHA5125ffd12af91805edd003d62f40754b3376e62ca4aa831de7728791c80aca94fbc502bd68e98b6acda08eb44f30f1d4048300da53fb0c5a100f5e8d31afc6f2a19
-
Filesize
3KB
MD5fcd8ea9dc09b2e821066844b7e80a385
SHA1caf2d639d06e67a1ebab22afbc8c441ac31737c0
SHA256a634a873ceb25015335905d5640ecea5cba7520a4b90d33fd9b8ee46492bf223
SHA51289f6259fd31315124d9a26c10178ea50e431021a2e65c993dae4c976abe24d04ffbfb6a85b0f2651410aabf26d2b7515bdb7f95e45dfe5d3e1d9f326af12b03a
-
Filesize
14KB
MD5ebf26f48d507013d2316dd6a9e9cc847
SHA11a196d826598b3ed6fcdd8875300fea51c3f54dc
SHA2564c4898996213616a7228d330998c7866be8966c61101bfe5cfd9d4935cded5e5
SHA5121d61ffe4f5a937cf7d2c3789ade44bf1fa07286cc5acecbd717f5ceee3590c0721e27fa159a51ef01468d65961e96b93ff4fcf0d3ee88a2a26df3b5ab401b8bf
-
Filesize
13KB
MD5fd91bcaf12495cdc8f5f5abfc4477aa4
SHA1f1f0db792d52aafc846246ed51c1fc2abb75b24a
SHA256543439c11e34b3f3112a5b06eb430e5be4f4758b60ffdf923145ec7a57bea442
SHA51223a5f4b72b1f92a03c91f95c28d6b6e187c37d6f93c0b72c316a75e451c3d2f98965f8437cfe3e959d1d0360b7a1fc47e3bbf32107c0e877bee7669e8b7fb388
-
Filesize
190KB
MD50c809af4d7728f8df15779e7513e5893
SHA181fd8ac7e6497f686e4403d59ce51c573c621bb1
SHA25653933fb5540dede491847f578936630611428a15481ae9b3a8af64dcb763d8b3
SHA51203da14923a6504b6f738a136d8651eecbf1915193f420470199e65f023a014e02563318a80ab351912021eeb114dc08ed9f6deff93cdbd104053cacf5b5690ef
-
Filesize
47KB
MD5ee721358078a3c84af118e5cfaef108e
SHA17c0ff18038f516ca02cb29be0bcccad9beeb131c
SHA2562d39622c37ef0d4d587294c1629d7325294fb730604e64b15e1e13bb1bea0fae
SHA5120199e94fe6ac249d0eb06631909a17b0074c7aa7574df92f59e6a2e94bf0e5422d21690e85593a45b7904edf07507666c459b03afee1319669f3a13ca41a642b
-
Filesize
42KB
MD5f03c0dbba47217194611c2a74ae84f12
SHA171c61ec72555edda8fff483cfd46736e9507a321
SHA2562261abefca53a73c01ed61a846236cc7fd374a446ec3c72f9b0123eed28471b0
SHA512e3fbf4c062d9f1dd66d7d3a9083f9a5400d57669ab2ad3e822f32a2daf2e6a1cbac6b5650ab6dda20f2737f028d349d5b19874417ed74a92dc3a3cdfcad094c0
-
Filesize
46KB
MD599d5f0388621d6fa6fe318116f81378c
SHA19dc296c7cf9349f5f8aef6d0b60827ea7ed29456
SHA256dd697a61485212c9a9cf4f9715d480c8ec46492bf6d85ed106fbf5c0855f56e7
SHA51246fe2721365ab2fc1874b6fec7fb597ae45eeb92f878737245075cb855e870901a67e16c36aebacfbd892b6d32e90bd9d6a9dfdffaba95a3f8c8a521960fc6ac
-
Filesize
46KB
MD5711b6accf588cb4a6dbcf0f542e42d46
SHA1c7a98990d9a13ce8d430108d0d891c067c5ccb76
SHA256f8afebce8d108f28eca8a6659c4fe092a5c2ba4ec7b9252d6b8a92f62a01f5e6
SHA51215e084ad4891af2df4c298de3037599e0edfca4bd927335e8ebfde8d6a79942a7189a4e9dd2907b78044bb3aa033a3496ca0baf629fd700e0da862f5f1cb261e
-
Filesize
7KB
MD577efc3960915d37eee9926732dcda25c
SHA11bf68c8b996cfb18b5f962156d6f255eaa38beb1
SHA25672b1bea5babc2e3854069810cf7e67cfe033928219aa072215a3079a23d0059e
SHA512af07a9dd74a965ddaefde6bf2546bf2d1aeea0649e5d679d08d94b59e784a79e0dffa18bc9562fb5dff69a144deef000cdf173b773f28dea3427b4f4d6af351a
-
Filesize
499B
MD56630a1a72a088462be9bb5fca63aa4ef
SHA1a6192a914d723a802015c3f22b6913611478a99f
SHA256ac5e19faa0d0d51e1fefb822aaa58badb2c96e9d7259754c5b4763c47919def8
SHA5123b3ad50785c661c2c38747b71cb06e287320c79d723c4877834f5ead657bbab45f697b89f8c9d34b1c495c778a2f85f937c569a0098046e5956fdb30f19be187
-
Filesize
91KB
MD5e11f6513d08eff2f2adf81f69fbb8301
SHA1334471613c085df425d771c4909a48face563ba8
SHA256179f4b6c5bd20942e847699ae9fd36d96d61173450071981331f036be7e0a65f
SHA512172c81622102f1fbe02a469d5fafcd52d5d7b1cafce30eaa4aaa368449c443eaa06e6e2f609010d3326ed15c1f72a811236d8df6c385887a8fff745e9e3d45e9
-
Filesize
5KB
MD5bd499a2ae00d8b41f8ddf8a8e862b35f
SHA161589728f40dcf3f36e61726d1fd90a2f618f4f2
SHA2568527733b6fd9ceea804bae938ef4dbe3666e4a5a3e6694a371a8dcdfd6bbc6a9
SHA512bc23a1575aaab4fa4e4ff674b3336c4f39afa6b4d6bcc5dd5c56836f2ee34c1833f59bc93c5209a3a925813e96b25df53b6047d58b557901ab63b688fdb5bb2a
-
Filesize
443KB
MD5739c853d47d58a1762561b285b75ef6e
SHA1d90c1b3996de086076dc04a2cef7437624fbc4ad
SHA256b2c37bb2a02ada5c25158a375ad02f0b6782accd45a6cf5b26cf5f4ba0e5cc8e
SHA5121a32bd02819e36965226f9568460bf7cdb5992ecc6d76da7e80ef9d8196b0646d8b190b8b1a26901fefe39bccff08f077ef8334b99327699f3f3ce922547a7d0
-
Filesize
135B
MD5d5da2239e2423fbfc36951edd5cbcbd5
SHA1876e704752b8ccffb3decc3a15738d159d3aacb6
SHA25634d8714ee24526215870cebe601d60f249b31241ced7128f105f59d92e9a2763
SHA512b628d98056381798d224f6193a646148757b008e250bd3673ec99a23398bd2f371c52eb18fe33e872e677131e7865c8d49720ca3cdf37ffa3cd1db80d989103c
-
Filesize
133KB
MD58edc31e70300d59a20b23cad0c214814
SHA16e61cb2f1838bcfaf6be530027d51e9461e7ac0c
SHA25631dc11656dcc541ae85bbfea8adc7bcea33ae4c2bfca4e86320e3223412bb2ff
SHA512a2794d60896b2b3273844659bf2939499efef99d5501f72861d1e43dbe843277d5c7bc0abd55a5fef018613cf5180e98dbd3d351d4e57c3652005b51fb38ef1c
-
Filesize
310B
MD5a61b6786f7a1954a5a61e49dca9d3ff8
SHA121dbd0082315f13ea0122023e503f4c3d2f940d6
SHA25626e4604fae6538b65000deb114cd03492895c239d229ea2566f386530a5e3a3c
SHA512cd007b0298324fe6154e32a228d92b29b68ea457540d06fc8883a26cac879b5d179eed5c76fb2025fd42c3576712eb166c1fe1bc43bd9eb7048faf75f472653f
-
Filesize
48B
MD5fd8c393e124a375a7fd42cbfea6ae9ce
SHA190b1278e57b992d57f1a36542a93a1394470b0ea
SHA256115ccc07a620308d3640d53a5a6f06a7b8ed17a5374416d4ab2349ed219a73c8
SHA512433a7e84a62123d6db15bf0291b9ccef58c205d24f39427c55081d42e267bb42084f8238fb3d2537c470dec05eb6a436cb9d927c44dcfb7b10876f916d170957