ad2dbaebfd8d7b3f3e49ffe5bc851643d50f4fcc2b3f729e270e11517d081e3e

Analysis

max time kernel
123s
max time network
148s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
09-10-2024 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e8962107dc800c8b1b3fc70c7ab1e9f_JaffaCakes118.apk
Size

3.6MB
MD5

2e8962107dc800c8b1b3fc70c7ab1e9f
SHA1

8e0749831437c4f934612052a8d2077dadf8fb49
SHA256

ad2dbaebfd8d7b3f3e49ffe5bc851643d50f4fcc2b3f729e270e11517d081e3e
SHA512

4f1fc09c2020cfb332a76e6d2e8324f3c8ce065ba78c1e0e86231033c1187ad53f50e77e143fd9e1abe507f70a305dc54c680e841feb06b7eb4de6b51af56579
SSDEEP

98304:/Wy4r66wbDmVqxIBJWG5H0VZoYNv9nbb+4p1ietoGv/HGwFrG:uyb+rz2VZoevdbhp1htPv/HGwF6

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	mobi.infolife.eraser

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	mobi.infolife.eraser

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	mobi.infolife.eraser

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	mobi.infolife.eraser

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	mobi.infolife.eraser

Reads the content of outgoing SMS messages. 1 TTPs 2 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/sent	mobi.infolife.eraser
URI accessed for read	content://sms/draft	mobi.infolife.eraser

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	mobi.infolife.eraser

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
34	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	mobi.infolife.eraser

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	mobi.infolife.eraser

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	mobi.infolife.eraser

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	mobi.infolife.eraser

mobi.infolife.eraser
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Reads the content of SMS inbox messages.
- Reads the content of outgoing SMS messages.
- Reads the content of the call log.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
- Checks memory information
PID:4447

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Protected User Data

T1636

Call Log

T1636.002

Contact List

T1636.003

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/mobi.infolife.eraser/databases/google_analytics_v4.db

Filesize
28KB

MD5
c27a7fb9c46bfde1d353ba6d3bba75a9

SHA1
538ab5bef51a080c659f2287d60f72c300e09f91

SHA256
51940b2e38846df9743df563d13766c582acc6499b1e05a899081d890806ae46

SHA512
d4821b66093bc754a00747d29b254de28da4db600bc49760ce52bae68f394fc856d4c6b23149972c49ad22455097de22a5ace1b5b88dbfc2afa85f4c101778e1

Download Submit
/data/user/0/mobi.infolife.eraser/databases/google_analytics_v4.db-journal

Filesize
512B

MD5
017e3eb0a5eec243b7df995afa7a997f

SHA1
40ea65d40f296ddaef61dd95e67dcfb0ec69fa17

SHA256
4bea267587cf0d89c95d7eb5bccec6ddb5b25e9bc2571bd7ca2f009f33a2d30d

SHA512
4a236bfccdab1c592e89ace7b0f668ec578a681f07b82ee6aa8b14a9e8e8fcb6eaf7e43007cfe00eb51009329f31948213dc1f14f205133e12681af98184b4ea

Download Submit
/data/user/0/mobi.infolife.eraser/databases/google_analytics_v4.db-journal

Filesize
8KB

MD5
e8d8b543376f5fe2fd4e97c608278cf7

SHA1
a9b5f178b51792242908de242ba30f9971cb3207

SHA256
f74ca6cd6dc4f2456050f88e2db199d16a45a00cc38cc1327ec790594120fec4

SHA512
e6f3bda22c2adf7e4bb2b0076834509a28e1ad49c839cda227525510c69eda62704f026017143122c91d84f3b0f212b9505e31e11d0a13986134089efc7c4429

Download Submit
/data/user/0/mobi.infolife.eraser/databases/google_analytics_v4.db-journal

Filesize
4KB

MD5
ae4064dd3b943dcb19938ca19718c0d1

SHA1
7fcf257430cf93a1c733ede64c4a6f1d6fa200c1

SHA256
56585e7560b6ad832095ecc6a06a464564bd9b55c142b022f081db9352860176

SHA512
9f8dc3f7944d6d5bc7ba8d7a94d22b65c711fddd43d5d9796722e2ae951f3490ba8ffc5647c16bb6d6eb830a336b518dfe5be38b2b796588d88b544495c51c60

Download Submit
/data/user/0/mobi.infolife.eraser/databases/google_analytics_v4.db-journal

Filesize
8KB

MD5
7ecf380739537f1adb31b62ea7f4cac8

SHA1
c0125fbc41da3d428b9d47c123e8bf8c70ab2f38

SHA256
801b91fbf632208ed9de48292ffbae24811c5d61cd74912f609eb55be4d1076f

SHA512
eef2806996b8af44725b8ae4739756a3cf109db5952d20dceb301f651047be63070fca586ea9438d4966b046bb24f2183ed1433e9da01c65d71abd7736c51974

Download Submit
/data/user/0/mobi.infolife.eraser/databases/google_analytics_v4.db-journal

Filesize
8KB

MD5
20a8cc19ffaea09243f754fee493cd59

SHA1
7451d7f6992e2ab0ee4bd47bc4eb9bac75238142

SHA256
0ef83530e494af019d1e3eb6d1e18b9f955cc81ebfb5669958cc8729f10825f0

SHA512
0fb09870f4a811097bc1ebc96bfd97fef3c7a548dfed1658c864e1d72894f0183868bbadc21552a54fa30659e3ab9be89b4864afcd4f4d42434f7033674bd152

Download Submit
/data/user/0/mobi.infolife.eraser/databases/google_analytics_v4.db-journal

Filesize
12KB

MD5
d63e1502e83c3b10f017c6e2f8604a8b

SHA1
e87d5bcb944deb03e1195cd65cd202025247955f

SHA256
04b3db16a6c7204152c945c91b10c462f94b4c048f9041d05e7ad8ac913d769b

SHA512
ce663ac53bab61f9d04feba50285740cf3911749223595edc96af51b57d6e44a307b11236094271c24d2d5f3bdeb5931006d67f54c746f32d8a49013e44e62fc

Download Submit
/data/user/0/mobi.infolife.eraser/files/.um/um_cache_1728465427094.env

Filesize
698B

MD5
bd00e87126e7028e0afa5268df0fc9ab

SHA1
32c7adfe85dede4789a14cc744d8753e3a66ec29

SHA256
46d576cfb250e9e82f6579ae87073a6d7f097759fc2fcc81c0aa550fc1c104c5

SHA512
bfb07823cc428f5c9b8aeac769cb407a995e0a3971fbbcfaa5b94b9af8a96dd5c4280bd8000fbcfcc2097e6214a266a0cbc8378414658c6bfc7f4391e140f8f2

Download Submit
/data/user/0/mobi.infolife.eraser/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
90ea8b11fbbad272ec66af66d24190d0

SHA1
8b9e44fc9442e2dd9b9b7052a3b36efccdae0723

SHA256
89afd1ab1c9e018a35f110590411d2c6ff9f43a6b9d318c7defdc0e4557a7163

SHA512
be973c57312c2597b15dec5998c0b2a42f10679da6a0dc25be787e80fb8793e3ae9e69cfbd7cf22ffcb66ea0dfcdda85ec97f379bc6c95f4d0d533c81d9e0a77

Download Submit
/data/user/0/mobi.infolife.eraser/files/gaClientId

Filesize
36B

MD5
76613764e6654aa48665261aefa1292f

SHA1
06a1147e42c7674e9b01fbd283a5c8e035a52d28

SHA256
48cc36bd3ebdb6d224a18b4c40d642b9f8609ea6ed8a7e7d22b579a2288bcc20

SHA512
30d354190bc181218477cd1a8ab9177cfb4e4d180d1f524f6f3deadffc504cb8f841e1bab15e8566c2cb405d77e0d92adfa347f4e6a86612fda62b3119d4ab67

Download Submit
/data/user/0/mobi.infolife.eraser/files/gaClientIdData

Filesize
32B

MD5
736f10fc70b85ccf7a552ea70306f17b

SHA1
ba26aab4709bafc51aed1f8ad7072c1972d07b64

SHA256
dcfa571cadb7dfea860fc673caade7ad1727739e8dfa607d8843a654944b9fbb

SHA512
7e0f11273e0471307cab7f4a6a117f769e9c1d0e404bf189911589230502083e7bacc9a26959a36e45d56ac5db4dd16def8097775acbc68e02ad6079f7be7bc9

Download Submit
/data/user/0/mobi.infolife.eraser/files/umeng_it.cache

Filesize
285B

MD5
4e02c7ce86b9c62218c6841521fae269

SHA1
0c52976eb7cb6580c61490ffe141361fd5dc4fcd

SHA256
9b36574873af03e85047624779bd28b79ef4ea711106dd564b8942cfdd687165

SHA512
0302449d560340bcfa80969615bdeb4f8975b2eeca974bf15d37c3a4d304bc922f49b34cc38781d9ef1aed95041247e039faf04a0b8b59d2b84559981ffd0b78

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads