fa9f0d823711e54bf13eabec8b1d7196c9124a8d8bdd4472dd8646023bcfbb29

General

Target

126aaf21ac03e011715c9f111fd36e96_JaffaCakes118.apk
Size

8.5MB
MD5

126aaf21ac03e011715c9f111fd36e96
SHA1

7bd2a9b5d1081c90002fc403425a96f8381a6d76
SHA256

fa9f0d823711e54bf13eabec8b1d7196c9124a8d8bdd4472dd8646023bcfbb29
SHA512

257bd94ceafa89a2bd6b4256ef386bcfed9e5ef4481766111fc4f1646ab8a86a55ef7b8652159cbb1d6bd946dc7a4e85e1cd0f6f1e6c9207f4b6866f85e0f32b
SSDEEP

196608:zWgFtUsMr/0gKcrvocKyl8KgMlkippBQwa6yhs8RbHyw5oc:KPr/07avAy7CIupLRbHyioc

Score

6^/10

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
8	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.loovee.reliao

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.loovee.reliao

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.loovee.reliao

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.loovee.reliao

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.loovee.reliao

com.loovee.reliao
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4940

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

System Information Discovery

1

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.loovee.reliao/files/.um/um_cache_1728027362807.env

Filesize
550B

MD5
d74d7a587149324e4cc1afd5018cdffb

SHA1
97e7ccd5214c82973894fa7d27acfaca40b752de

SHA256
49d6f39092ea99560451b73e259706454ee155ea1231e21de7f313c01efac788

SHA512
923d3fc3cef466b2451446252fc2e67589be61fe5a08862a3139a6553f89bbba7b1965e7b6b45cc164271a9639eab170919cc9cba97421c28c2d15e7d139eca4

Download Submit
/data/data/com.loovee.reliao/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
965d538bb51542654247118b1447ba54

SHA1
49f51eb95eef757d91b72f1e800d1cab5fb60e75

SHA256
06e0f278f0b4f3e12e77fa8dde136370e1ac670e2a90e4887d6e6ace6dc90ca9

SHA512
1eda2c6467edd0291905c4837d5abea6350ff4fa85e42dadf882b2755d75cbf41c19e86b0290bd9fba96476951578bc831b7aa99debcb03ac4cecc274d481395

Download Submit
/data/data/com.loovee.reliao/files/umeng_it.cache

Filesize
245B

MD5
0e61528b39130235549b7096fd058524

SHA1
98f6001981a562fa7caae0fa929ef91e4e8e8704

SHA256
21912f52a32778e019cd55555c6c515d3290904cc92174be1e1f19daec5e2f9b

SHA512
1da09def79ea6408f157b9db0af6645a4905c8a292f2df281d31df24908cc19988bd9f6ba9864c9a3087f5c4e926720934da96d6d7dc7bef88656ba3392f54ac

Download Submit
/storage/emulated/0/Android/data/com.loovee.reliao/cache/images/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/storage/emulated/0/Android/data/com.loovee.reliao/cache/imgeloader/783279545

Filesize
161KB

MD5
45d2ee4f4138eb58ae51dad696dad807

SHA1
f53586615d2e63770e98f4aaaee6d3e6cfbfabe3

SHA256
78deabd7aedd8be3a2e1269aae152fd5cad76cbfe55cf52311df1e35e8a47013

SHA512
ddbaff12ef6bc9c531a29f6cb4258018e2797e746690ec92f07d9d64d2c0442f026ec75e80d7e59e59c81c94410950ec64fd7215c62e3d9ba6ae2a4edbef3cb9

Download Submit
/storage/emulated/0/Android/data/com.loovee.reliao/cache/imgeloader/783279567

Filesize
165KB

MD5
494c1b2afc3c733c3d892a493b5418c6

SHA1
f8050f5ab699a1b0315155d8513db13159a88a8a

SHA256
d725de48d61f8eef4d8d765190286ee7a06518f9909ba31abd6d5085ac97c355

SHA512
021a95b3e564d6709ef0aa2edd5bbf105b8b676b96b4a526ee619e23c522d8c6cdec584c9ca15a36728d6d6783f9f093aa5f9c4b80eb4fdc52d107e3ec9bc71a

Download Submit
/storage/emulated/0/Android/data/com.loovee.reliao/cache/imgeloader/783279568

Filesize
186KB

MD5
c1bedbfc5bc6bae53dfb0e45f96786ce

SHA1
a0888e51375b58b2c9567954eb28a1102a6b47c5

SHA256
06fe46e3d06a88e17943fa1c2f8735fa875502dee382f6dc6a668a9f532f8c7c

SHA512
c647295842077b781ebf3f3dee4662a1dbd522fc74c43d4d0b086e747828d73fb3e9230a9a7527ab07f8f4625fc390eae6ccce9faa9477f60841fe15b4b20b95

Download Submit
/storage/emulated/0/Android/data/com.loovee.reliao/cache/imgeloader/783279569

Filesize
124KB

MD5
ad87b8853dc5bc7f2eb06ac181a60df8

SHA1
62fb313e6ebbfe6865ac5ea017f1f82743587117

SHA256
5c215a35ea5e497814297342e412f94fde7dc6e8ec550710192e02c7544cfc36

SHA512
0bbc656bbd5763367efba1a842c1da2adcc3f1206bbb85affaa6aa88f8d00a3c9f5eac4979afb08192936d2ef4b83c2b2c11c084f631967cf6c150904c2b92d2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads