fa9f0d823711e54bf13eabec8b1d7196c9124a8d8bdd4472dd8646023bcfbb29

General

Target

126aaf21ac03e011715c9f111fd36e96_JaffaCakes118.apk
Size

8.5MB
MD5

126aaf21ac03e011715c9f111fd36e96
SHA1

7bd2a9b5d1081c90002fc403425a96f8381a6d76
SHA256

fa9f0d823711e54bf13eabec8b1d7196c9124a8d8bdd4472dd8646023bcfbb29
SHA512

257bd94ceafa89a2bd6b4256ef386bcfed9e5ef4481766111fc4f1646ab8a86a55ef7b8652159cbb1d6bd946dc7a4e85e1cd0f6f1e6c9207f4b6866f85e0f32b
SSDEEP

196608:zWgFtUsMr/0gKcrvocKyl8KgMlkippBQwa6yhs8RbHyw5oc:KPr/07avAy7CIupLRbHyioc

Score

6^/10

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
6	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.loovee.reliao

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.loovee.reliao

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.loovee.reliao

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.loovee.reliao

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.loovee.reliao

com.loovee.reliao
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4262

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.loovee.reliao/files/.um/um_cache_1728027363302.env

Filesize
574B

MD5
5757131c62311535ddd6dd14ed84bca2

SHA1
942661f01c8a8e1cc021950ad020fb65a225dddb

SHA256
77083789e747e9818d1ad1c34b9c57fc3dd449e6905436de6df149794b0dcd44

SHA512
41e5448f1920247fbe0f73ed7a0fcaa3258fb8e3e448b4bbcca1293392747d5f6de288641fafd96ca9bec15490a3a05662b6ffdab536e76d4349435ec6c5676f

Download Submit
/data/data/com.loovee.reliao/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
e32435828bc76db867a4cf0402ba73e4

SHA1
190c516d1d2eb18712af80985737f59d969e2947

SHA256
56dada04ffc47fad142c42f5ee797abf62c84c29abd2a4608f77be6966760a48

SHA512
5a795743ba9622f2276f42b6c85291f57b709d8bec5eb542402da39ef0bd6829cf566ed5b87ee1a5743fa07d7715e854bbf200b64e4e3bc19a88b512b2429591

Download Submit
/data/data/com.loovee.reliao/files/umeng_it.cache

Filesize
310B

MD5
283847d318f22a73879724af7473d937

SHA1
28af4a5ba6088174040b8e6413b5781133d02ae0

SHA256
3daee005ffcb5491b11fb5cf6808c9de85ca1ce0a288510a968667dd1685f02c

SHA512
833ee1abb6add8b0ca12eec9d443a42234173f9c67a7cb21ceee8f85c0a71896b8e355ded364b0488f8e972fd11c5792b50293e5334a088b6e6a02a0f06f6283

Download Submit
/storage/emulated/0/Android/data/com.loovee.reliao/cache/images/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/storage/emulated/0/Android/data/com.loovee.reliao/cache/imgeloader/783279545

Filesize
161KB

MD5
45d2ee4f4138eb58ae51dad696dad807

SHA1
f53586615d2e63770e98f4aaaee6d3e6cfbfabe3

SHA256
78deabd7aedd8be3a2e1269aae152fd5cad76cbfe55cf52311df1e35e8a47013

SHA512
ddbaff12ef6bc9c531a29f6cb4258018e2797e746690ec92f07d9d64d2c0442f026ec75e80d7e59e59c81c94410950ec64fd7215c62e3d9ba6ae2a4edbef3cb9

Download Submit
/storage/emulated/0/Android/data/com.loovee.reliao/cache/imgeloader/783279567

Filesize
165KB

MD5
494c1b2afc3c733c3d892a493b5418c6

SHA1
f8050f5ab699a1b0315155d8513db13159a88a8a

SHA256
d725de48d61f8eef4d8d765190286ee7a06518f9909ba31abd6d5085ac97c355

SHA512
021a95b3e564d6709ef0aa2edd5bbf105b8b676b96b4a526ee619e23c522d8c6cdec584c9ca15a36728d6d6783f9f093aa5f9c4b80eb4fdc52d107e3ec9bc71a

Download Submit
/storage/emulated/0/Android/data/com.loovee.reliao/cache/imgeloader/783279568

Filesize
186KB

MD5
c1bedbfc5bc6bae53dfb0e45f96786ce

SHA1
a0888e51375b58b2c9567954eb28a1102a6b47c5

SHA256
06fe46e3d06a88e17943fa1c2f8735fa875502dee382f6dc6a668a9f532f8c7c

SHA512
c647295842077b781ebf3f3dee4662a1dbd522fc74c43d4d0b086e747828d73fb3e9230a9a7527ab07f8f4625fc390eae6ccce9faa9477f60841fe15b4b20b95

Download Submit
/storage/emulated/0/Android/data/com.loovee.reliao/cache/imgeloader/783279569

Filesize
124KB

MD5
ad87b8853dc5bc7f2eb06ac181a60df8

SHA1
62fb313e6ebbfe6865ac5ea017f1f82743587117

SHA256
5c215a35ea5e497814297342e412f94fde7dc6e8ec550710192e02c7544cfc36

SHA512
0bbc656bbd5763367efba1a842c1da2adcc3f1206bbb85affaa6aa88f8d00a3c9f5eac4979afb08192936d2ef4b83c2b2c11c084f631967cf6c150904c2b92d2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads