d4265892e76c9b67e2615fada900070758b341321ab3942766bd772bb16700cb

Analysis

max time kernel
147s
max time network
153s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
28/09/2024, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd63b4bc204a48de9571567c56c84b7a_JaffaCakes118.apk
Size

17.0MB
MD5

fd63b4bc204a48de9571567c56c84b7a
SHA1

7edcca04f91b23d060a57a2973c78319b7855c89
SHA256

d4265892e76c9b67e2615fada900070758b341321ab3942766bd772bb16700cb
SHA512

beccccea1b7800f325632608b1fa4640f59452d45ba0c999c2badccee46ab2fa7f2c174b47519f7ebcedfd3e861c680f161c7b02219c7d92a4b34e028120d23c
SSDEEP

393216:76rrO8N8FiT1Lsz5yCPEgiIwyPdeRvdho3S:2jm61Qz5yCPxwadedz

Score

6^/10

discovery impact persistence

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
5	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mallestudio.gugu.app

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.mallestudio.gugu.app

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mallestudio.gugu.app

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mallestudio.gugu.app

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mallestudio.gugu.app

com.mallestudio.gugu.app
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4204

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.mallestudio.gugu.app/databases/xUtils.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.mallestudio.gugu.app/databases/xUtils.db-journal

Filesize
512B

MD5
e1fa6ff13809331a20fc5a6ec45e85f9

SHA1
07eec4913995ee3f9bade7f07b67d08f5859d89b

SHA256
2aae7608b36e76c9a51516d7d3150e001b3a63d5bd451fb3181693ebe8c44442

SHA512
f0259485b569b46158e8df97050264c2812ca192237baaa786a521373d9a3610aa5b4012cdd39cf95fb6e3ea1cf73418d83f5c4fa0e0002ba60e376742deb4db

Download Submit
/data/data/com.mallestudio.gugu.app/databases/xUtils.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.mallestudio.gugu.app/databases/xUtils.db-wal

Filesize
20KB

MD5
dda7b533418e16bf670bbf79790ed234

SHA1
57a786af26390939b8da2774a6b384a5fc3ba0fa

SHA256
46aac15a44919aa6a1342d3d0133532615e708fbcdd4805f0640339d9e76a16c

SHA512
6d63b3584c18bfbb61323db7b870f003d4f6d478ea7dce73c1b65ec37a36ae5087fa7a3b8cb82d99ab44bc306bb6369281e7c07df3e4e15e7a4826423e694dfb

Download Submit
/data/data/com.mallestudio.gugu.app/files/.um/um_cache_1727567522988.env

Filesize
598B

MD5
3765d3940f306668e577af498ca9308b

SHA1
7dc8a139bfed882e605ed2065bfb6a4d63197163

SHA256
60b3de718b2aeafe7c441fa6d5358802438a377461671118d775468d4d061330

SHA512
a1fb1c29de0887269900cc8fabf3152cf84a4d4ae675c30ede67ee0d5bad9dd85d0987b58a2d4066835a78c682246b0eb8d4485efb3a7c7153b6d4c4c552d932

Download Submit
/data/data/com.mallestudio.gugu.app/files/mobclick_agent_cached_com.mallestudio.gugu.app8

Filesize
924B

MD5
ee9e73b2d76baa14a17924493f38bcd8

SHA1
317eb3686bbc15eb5d6c71aafe122294b25ee8d4

SHA256
abbbd8a089fd6782e90bbd08501ed219b9d28bafd3b43f5217673ef522939efd

SHA512
36a12816100a2384c431f8b48c13f430678daa80cb686844c9533eedf5a1f7a89ed344d2c6853d2d741daa3d1d3c32097f58bda776c93184977d4cec017895a5

Download Submit
/data/data/com.mallestudio.gugu.app/files/mobclick_agent_cached_com.mallestudio.gugu.app8

Filesize
1KB

MD5
cac7f0c7b9b351e576be135fb2466a07

SHA1
470297adcf4033cf4004ecf313455e41f8e33cfe

SHA256
7fb30af0b809bc2512db4a574eab9ca330ddaf42f60107993a67d4ed62d48666

SHA512
ebb7131e832d9b5f34a69a5497dd5af23038b3bda24f2b8229c84255dec5c1beee1a92432fe15cbaaceb9fcf05de6a0a2a1ac938e17ca6f2568873749bd247c5

Download Submit
/data/data/com.mallestudio.gugu.app/files/mobclick_agent_cached_com.mallestudio.gugu.app8

Filesize
2KB

MD5
031eebb97fe66d04dc540c14c75fca52

SHA1
1ecb50d885c326e924c14431bc982b59a073bcfc

SHA256
20b49e6bbe10aec43aa096473cfec46af339dd4a0a42c36276d95956d822074a

SHA512
c3e217afbcdef1a73134d31e24962df32b242d1ee1bfcad4685cd1f20918fc9ae9d3e52466a84bc1f9c6707d09b9e4dd2cb92a8959dca9f67a1ca6c2ae582a7f

Download Submit
/data/data/com.mallestudio.gugu.app/files/mobclick_agent_cached_com.mallestudio.gugu.app8

Filesize
705B

MD5
46490dde16e4db9b458e0da87abf7b1b

SHA1
3e65d39b48582d37f95d45ce7b5f830da63292fd

SHA256
0441416a336b32cfe5ad48e1bfcd8532feb42536443f50f8b3b86f12a8f6b2af

SHA512
5cd1d2bdfd49c38bc70a9cb599c2a2851e279e6522cf43190facb80c3716d1e22aafadbe2cdad5fa086db43edd9afe68042b58c6c4ab6745fc5f5a9613308041

Download Submit
/data/data/com.mallestudio.gugu.app/files/mobclick_agent_cached_com.mallestudio.gugu.app8

Filesize
778B

MD5
40600ad26cf822834f8d19762aa12ab0

SHA1
48b6897ad7041e15c52e7e0a169e8c9c5554d3dd

SHA256
9790d1ee1d87328bea986752f2ba1e135c81a2003a62d8cc88219218baa1a6d3

SHA512
e3541a259eb32dedb59583df4f68069f76ce52d2fee31ebdd95489dc2bc1edb84b3516b65347471f6d0dad323b60481b0ed28a58a8da2b5bd2aabb00a7b64695

Download Submit
/data/data/com.mallestudio.gugu.app/files/mobclick_agent_cached_com.mallestudio.gugu.app8

Filesize
851B

MD5
c591acd2cf1ff61e9a6f0078e629ef9a

SHA1
bd38e3d79b60271f802b674156ac3c104aadf6d7

SHA256
df494cbac43a3fcce89e2a790754ddf282d167b660cbf492e9bbd0a5b8283d8c

SHA512
64c62daa0d8e326512b87069b977e450e6bafb0bbf1fa9906386c8197712b14a330ec083bc201709503a99fbdab57936ab409c131a375870089cc1a695232733

Download Submit
/data/data/com.mallestudio.gugu.app/files/umeng_it.cache

Filesize
310B

MD5
bd94fad89fed61705b059793d5bff9a9

SHA1
4adbb50938ee35b77c6d0c8ec673ec7f30e6d9cc

SHA256
c1ecba243afd5f311891ff2138718e320b24079ec0c8dc7b94e62c3216606748

SHA512
3b22c92842f2705844e613dc1c718f541714eda8c5514293e3e2e3979f4d24c3c2206b3155c8d7eac498f23d1f0016a6eadf4ca6bb3cc06819f5049168ad9c68

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads