bb839179e60bb9eff9d6a95e180c796c09e85a42fb803c44017221b0750eda0c

Analysis

max time kernel
33s
max time network
151s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
15/09/2024, 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e21b7d9256c7bd957f0fe24314b699ae_JaffaCakes118.apk
Size

16.4MB
MD5

e21b7d9256c7bd957f0fe24314b699ae
SHA1

848e14313b6e5916acc0c4a2e8a1849e610ca878
SHA256

bb839179e60bb9eff9d6a95e180c796c09e85a42fb803c44017221b0750eda0c
SHA512

6de1544c5925a5b1975fa267387306c7079d3ee60f88ebac3ebc97be9a917ceee1a994c1886082ac0f2d3a76018ee96e333f0f9142612cabcc8250689851b646
SSDEEP

393216:nQ/ve2T5OhKLxTPbWkwu/p0tG+lDT6896v2zqbhZfuEEVF+DgbQSBFm4ijm:W9k8LxJwV1lDT689DI2EOFCc9Ftijm

Score

6^/10

discovery impact

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
4	f.appjiagu.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.zs.fang

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.zs.fang

com.zs.fang
1⤵
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4978

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact