b3837544e557b26f031e063f4fa5f54ebf4fbc807574453130afcfa96ff2a71a

Analysis

max time kernel
63s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
01-10-2024 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

046e38e9e19ae927ea33e8b6494e3e13_JaffaCakes118.apk
Size

5.7MB
MD5

046e38e9e19ae927ea33e8b6494e3e13
SHA1

a662f98c3214f329ed547cdd742be60193c7e464
SHA256

b3837544e557b26f031e063f4fa5f54ebf4fbc807574453130afcfa96ff2a71a
SHA512

a025ac8739ec89b672745945b3de745e23ba25dc2211d3d1e20015202dbfbc6869deddcf0faf3998d36d905cd1dfc0ddeb743b4faaa326aeee8565428f058459
SSDEEP

49152:qazh0eheCDUnZign0f/VlwjB4Zpq8qoniptX:PxvN1lwwpqO4

Score

6^/10

discovery

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
5	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.winfield.apps.foodsafe

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.winfield.apps.foodsafe

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.winfield.apps.foodsafe

com.winfield.apps.foodsafe
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4923

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.winfield.apps.foodsafe/files/datax

Filesize
5.0MB

MD5
97f5db86d7c5fae7185bed2783db4f37

SHA1
45409dd8c84cd545ae05ed8510ab398a8fc2f81b

SHA256
1ab8686bd80947166cc0dbf44f1353b45e1643454c0fd7611fef6de63b1a82cf

SHA512
3efce61601b1f5ded364c5a1a286120d3efb3345fcd48ad1724decc1967c77ea5e3c49e2425876781a49aa28277c1cadf58d746b66524241be94c4e72912cd33

Download Submit
/data/data/com.winfield.apps.foodsafe/files/mobclick_agent_cached_com.winfield.apps.foodsafe

Filesize
121B

MD5
06b88ae98494980f658b3bf31e56ce51

SHA1
c80a573a069a71bb6ae8494e1be40ecec72db4ae

SHA256
f9122273efe88e5b307865caf90b2df5fac5cfd3a7e92637a15e374d286a55cb

SHA512
2662b683537235d29336c67c75483a650958d50f2d07296bf63286a7f1f1bebd8ed89ade047ac7792b5311f3cd8645161a940af171eecce66010a99213c995e4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads