a4a2c79306df2dbd194232bc88fbb9897b3ef35dc66700774427014cbdfb85ac

Analysis

max time kernel
34s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
11/09/2024, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d995705be5dd3f3e3f52d1cc53b8f226_JaffaCakes118.apk
Size

11.6MB
MD5

d995705be5dd3f3e3f52d1cc53b8f226
SHA1

cabfbcd4e101f34676ccedaf62996af15bdb4a71
SHA256

a4a2c79306df2dbd194232bc88fbb9897b3ef35dc66700774427014cbdfb85ac
SHA512

ea4f78dd79374173bca89bfda03e447e2557ecf18245bcb6c2cbe5b7248ecf125d242fc7f69b59ac8d14f36e63f477f88ac37333c7ecc22e8cc1c2806572ce76
SSDEEP

196608:LLtKqEnjRBoDel5s6xHy70FcvFziahi3VnN1G+1BVLhfKuEL4jEwPxc4GFvEdsLO:LDEnjRSa3s6xHzFkziahilLlVLhCuELU

Score

6^/10

discovery impact

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
21	f.appjiagu.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xgbuy.xg

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xgbuy.xg

com.xgbuy.xg
1⤵
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4540

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact