Overview

overview

8

Static

static

6

fc44df008a...18.apk

android-9-x86

7

fc44df008a...18.apk

android-11-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    28/09/2024, 12:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fc44df008a84eacd8e2c226f35d361fd_JaffaCakes118.apk
  • Size 16.7MB
  • Sample240928-pcafdsvfpk
  • SHA256 7b36cd9877c7a05e740ee1f67c5a7319d2db4a0b7c7ff9404d74e170308aed3c
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryevasionimpact

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
    evasion
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 2 IoCs

Processes

  • com.sk.skedu
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4814
  • com.sk.skedu:channel
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:5122

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .jg.ac
        • Path /data/data/com.sk.skedu/files/.jglogs/.jg.ac
        • Size 40B
        • SHA256 6e959713084cd246362bdaeab70a3ccbb083c76938e93302a6c0efffaeffec29
        • MD5 SHA1 SHA512
        Submit Download

        .jg.ac
        • Path /data/data/com.sk.skedu/files/.jglogs/.jg.ac
        • Size 32B
        • SHA256 5a76a34be5a64b6fc7d8b41e026d2d53a162072685da60a99e4d44903231b2ee
        • MD5 SHA1 SHA512
        Submit Download

        .jg.ic
        • Path /data/data/com.sk.skedu/files/.jglogs/.jg.ic
        • Size 36KB
        • SHA256 f2434b69ad5ddbdeb3796b9e34fa428cf6fc31bf987dee42c12816e3632a128b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .jg.rd
        • Path /data/data/com.sk.skedu/files/.jglogs/.jg.rd
        • Size 32B
        • SHA256 89618d358def156a116de52351e76c693e9b336c5a74d32c5a73c174da7fa1c0
        • MD5 SHA1 SHA512
        Submit Download

        .jg.ri
        • Path /data/data/com.sk.skedu/files/.jglogs/.jg.ri
        • Size 307B
        • SHA256 0162928df502be173fa0dda976d0d56ecc1f714480e4ccccbf0ede9e2809aa64
        • MD5 SHA1 SHA512
        Submit Download

        .jg.ri
        • Path /data/data/com.sk.skedu/files/.jglogs/.jg.ri
        • Size 314B
        • SHA256 ecacc3d6b8ad02f6a619eb12c0d420dc3e1488b4271aa3f42939bc26bc6170c5
        • MD5 SHA1 SHA512
        Submit Download

        .jg.store.report_pid
        • Path /data/data/com.sk.skedu/files/.jglogs/.jg.store.report_pid
        • Size 32B
        • SHA256 826a338f90987b4ceae269e84f3ed89495bee2eca69056b0b62cb7e7a890c3a8
        • MD5 SHA1 SHA512
        Submit Download

        .jiagu.lock
        • Path /data/data/com.sk.skedu/files/.jiagu.lock
        • Size 13KB
        • SHA256 35085eb49456f49cf9e1784d3d04a25a7a89e0be8ddf1bfa89abe1bfca863b35
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        classes.dex
        • Path /data/user/0/com.sk.skedu/.jiagu/classes.dex
        • Size 6.2MB
        • SHA256 2f01fa1ac8c6baf62fae0101a0182fc5ee9c1b42d2b411b5828d6e481eb014d9
        • MD5 SHA1 SHA512 SSDEEP
        Download

        classes.dex!classes2.dex
        • Path /data/user/0/com.sk.skedu/.jiagu/classes.dex!classes2.dex
        • Size 3.3MB
        • SHA256 41eb5de73283efce3d822aa6ccbbc9a6f6330dbe807f4e82e82045a7ba55042b
        • MD5 SHA1 SHA512 SSDEEP
        Download

        libjiagu.so
        • Path /data/user/0/com.sk.skedu/.jiagu/libjiagu.so
        • Size 475KB
        • SHA256 5a1c513b347e2a929769e2be67552c1d591704f08f7b5590282b66cc2c7d7bd2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        19322d0080bcb7ad9c7af84173773d54180e4281a7f177864831782da56313c8.0.tmp
        • Path /data/user/0/com.sk.skedu/cache/image_manager_disk_cache/19322d0080bcb7ad9c7af84173773d54180e4281a7f177864831782da56313c8.0.tmp
        • Size 55KB
        • SHA256 f091f3b4918c012ae00dc68007a0c67287e9258ea861cbd98a786a4257abc8d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        b760740436735db808975ab96c276e61e6a9cd6832d6655fb6f0f89972e7f5d3.0.tmp
        • Path /data/user/0/com.sk.skedu/cache/image_manager_disk_cache/b760740436735db808975ab96c276e61e6a9cd6832d6655fb6f0f89972e7f5d3.0.tmp
        • Size 93KB
        • SHA256 c46ebeea510f5e0f40a8d603b91562a14a209256ca7cc31afdaca746301797ce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        journal
        • Path /data/user/0/com.sk.skedu/cache/image_manager_disk_cache/journal
        • Size 327B
        • SHA256 2d827155348375f112988b8e9eb644f02dc910547bc736e5e2a1a32dba798c23
        • MD5 SHA1 SHA512
        Submit Download

        journal.tmp
        • Path /data/user/0/com.sk.skedu/cache/image_manager_disk_cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512
        Submit Download

        MessageStore.db
        • Path /data/user/0/com.sk.skedu/databases/MessageStore.db
        • Size 36KB
        • SHA256 c2c4c69c7ef1120f8a33b1f49fb0b392f70309c0d8e259922c759b439b6842a4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.sk.skedu/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 36b5d672d9574d49a9f3af6ecd611fa0990f62b500a824317bb0550ee62fc3af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.sk.skedu/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 f17b9f1bbfe7cb870cbc99ad21dff8a907d9bd54868768d019ed708d3233d03d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.sk.skedu/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 6e2bd01605b6b19742e76cb0a001f0d8dbd262a0908342001adf87f8efc23aaf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.sk.skedu/databases/MessageStore.db-journal
        • Size 12KB
        • SHA256 65bf1f20a4c7fb68e59787805f67cfd637f6bd5bab2ecd1a26a5b87571a86177
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.sk.skedu/databases/MessageStore.db-journal
        • Size 12KB
        • SHA256 c1c9d1d3be1a70ad5d6f56127d913a447b6430c450f4b62de8085870049e0408
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.sk.skedu/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 098f623cdf454e43b9387e52dd09fe92f266e30568597da0e0012792e318b975
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db
        • Path /data/user/0/com.sk.skedu/databases/MsgLogStore.db
        • Size 56KB
        • SHA256 b5c359e241462865e44cb925c3d36a2af8b310ce7171ac28f98be65e80d7faab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.sk.skedu/databases/MsgLogStore.db-journal
        • Size 792B
        • SHA256 4b5d1eb9b08a860e121fc9de950383bd88ae4caf5d81a65ab048b4da23b9720b
        • MD5 SHA1 SHA512
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.sk.skedu/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 46b8d30b5ab1295d9c3f21edcc14e5736bab72e1d64ba91cbb4a3e6f110802e4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.sk.skedu/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 a2c891b626a87adbe57f88e4bbec277e0a76b13e2f48880bfd998f8a99c03ca8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        accs.db
        • Path /data/user/0/com.sk.skedu/databases/accs.db
        • Size 20KB
        • SHA256 b4ef8a71919ac4b6ef9a895a991b527f5c3316fd6204eb815366c9614dc71f00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        accs.db-journal
        • Path /data/user/0/com.sk.skedu/databases/accs.db-journal
        • Size 512B
        • SHA256 c10fa9e6f400aff0da1cfa3c48f5c5ac0a8a6a826df1476afad0f0178a80796f
        • MD5 SHA1 SHA512
        Submit Download

        accs.db-journal
        • Path /data/user/0/com.sk.skedu/databases/accs.db-journal
        • Size 8KB
        • SHA256 ec2e23279b932d459ca0bdc291ddd9a7c87bd44aa4105516440a5277dea1db24
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        accs.db-journal
        • Path /data/user/0/com.sk.skedu/databases/accs.db-journal
        • Size 8KB
        • SHA256 202598b57635ec6b290b728a03e62599f67e6257bfe43bbdb7df286a0bf6b9be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        okgo.db
        • Path /data/user/0/com.sk.skedu/databases/okgo.db
        • Size 44KB
        • SHA256 403bbc202c5ce2b61366582e4f665ff1cee445d4833098b6f7cdf6a8b9bd7b58
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        okgo.db-journal
        • Path /data/user/0/com.sk.skedu/databases/okgo.db-journal
        • Size 512B
        • SHA256 c3b50f539c9783d63c4b5bf4662cf4c77964b18e3cfe7232a0a864b5932c1b9a
        • MD5 SHA1 SHA512
        Submit Download

        okgo.db-journal
        • Path /data/user/0/com.sk.skedu/databases/okgo.db-journal
        • Size 8KB
        • SHA256 c6cb459af8950904b104213d9b9ae8f9448f285d4f037f296c0359891c15580c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        okgo.db-journal
        • Path /data/user/0/com.sk.skedu/databases/okgo.db-journal
        • Size 8KB
        • SHA256 d4ea839e542430d12e1db166862b30ce5573f7986916abbf9e286db0c21a61e8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dW1weF9pbnRlcm5hbF8xNzI3NTI1NDQ0OTQ4

        • Path /data/user/0/com.sk.skedu/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzI3NTI1NDQ0OTQ4
        • Size 1KB
        • SHA256 b7562ddfb0f55e43850121f15e9726ed4e33510e5e194bfe7a088a326c67a304
        • MD5 SHA1 SHA512
        Submit Download

        dW1weF9pbnRlcm5hbF8xNzI3NTI1NDU1MDU4

        • Path /data/user/0/com.sk.skedu/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzI3NTI1NDU1MDU4
        • Size 1KB
        • SHA256 dfca3a825d38adbbc0c90366fa970fc7df8ead93cd090c62c9f538e4cef75ed8
        • MD5 SHA1 SHA512
        Submit Download

        umeng_it.cache
        • Path /data/user/0/com.sk.skedu/files/umeng_it.cache
        • Size 433B
        • SHA256 088fdaebcbad59f19e7379de3a381c8792ca195dc1a1788c5cf95a9933797fdc
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 111B
        • SHA256 80c1af7a9881594add6b8cfd9b39d1792569341a0b70e361b2f0a53a86fe1a7e
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 213B
        • SHA256 1f54cbef26850d5322bd28ebc085e4c0a789d076eb32af4a06f4ee52382a85aa
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 780B
        • SHA256 9573c317dab83c2c53eb65fe9b054b7888c116aa35f487ab26746e3ec383c9b3
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 111B
        • SHA256 6e9335740c6211955b7ea65515762d16fff9c901b5d848b44a8cb3fab42b4d6b
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 167B
        • SHA256 936aa41ba120a31b978c88a65d4526233e741a254d8cfc77ad763eb613676b18
        • MD5 SHA1 SHA512
        Submit Download

        326cf669ec60430eb3113478f32edc11
        • Path /storage/emulated/0/Android/data/com.sk.skedu/cache/326cf669ec60430eb3113478f32edc11
        • Size 4KB
        • SHA256 9e9efcf47a5fa1ecfbe5f96f1ee8ef2c1b338c6b633dad566c110d9f20af321d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bb49e034fc7a4ae99aa173d0ab48374a
        • Path /storage/emulated/0/Android/data/com.sk.skedu/cache/bb49e034fc7a4ae99aa173d0ab48374a
        • Size 1KB
        • SHA256 8592bbbcb58d5d04cd7358acbda5fe0488fcb60a101ca6a36e9f7f0f2f0ec00e
        • MD5 SHA1 SHA512
        Submit Download

        tbslog.txt (deleted)
        • Path /storage/emulated/0/Android/data/com.sk.skedu/files/tbslog/tbslog.txt (deleted)
        • Size 11KB
        • SHA256 7b5f1f5f7b959cdbd65bcf2f67a03a73d3fd7668ba82a1941a200e887dd8d921
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download