c4ca2ec77f4f43f3ea7985be9961cd7a710145de268851202f1f27fa163cfd2d

Analysis

max time kernel
33s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
14/09/2024, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dff1f5885d3136fa81ff2644812278ff_JaffaCakes118.apk
Size

11.8MB
MD5

dff1f5885d3136fa81ff2644812278ff
SHA1

34bbbab69a763c57df6993b73d0b233e1f32d7ed
SHA256

c4ca2ec77f4f43f3ea7985be9961cd7a710145de268851202f1f27fa163cfd2d
SHA512

3f25c6a819a4aa851cd26267e4910af6b6e05a91520b00150ac300da50f44a7665295489368db037ba14f6ccc3b3386b581db5a5c19b8f8b14fe618d9924f55b
SSDEEP

196608:DNc4p/Scc0qa4OFnby9DF5/DNJJSL0Q+wZz0h43wgMNX1kX95ME5B8xMjj0Br/NR:DOfcn34OFnGBxMLiq0+DgXY5qs0BrqDO

Score

6^/10

discovery impact

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
22	f.appjiagu.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.baihesoft.ssrt

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.baihesoft.ssrt

com.baihesoft.ssrt
1⤵
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4476

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact