bcd6b7a12c74f5c2c03ba2b7d5ff99e9f5e56233ddad5e9a2097a981fdac0117

General

Target

2eebb882a93d4bf96f8e64266fe94d21_JaffaCakes118.apk
Size

3.5MB
MD5

2eebb882a93d4bf96f8e64266fe94d21
SHA1

a44ed70a80f37ec4e2416e5af28be3da1deaeefa
SHA256

bcd6b7a12c74f5c2c03ba2b7d5ff99e9f5e56233ddad5e9a2097a981fdac0117
SHA512

bc3ed0e3733269f888f00e93d15d849fe9178bd0218ad876cf60647054d11068d54986d7c00fb38755a0d998e8561e4cdeb54965fbc8e501a079385f0c7dcd48
SSDEEP

49152:sByK6HNSyHDr7N3JLzXciHNS9KSY4d83juZk2C0E6tHHNSHDwckD7NuAfXhQhCcV:myZFzYYS3d83aFG8c8NumXhOlsMWty

Score

7^/10

discovery persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.hexun.fund

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
6	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hexun.fund

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hexun.fund

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hexun.fund

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hexun.fund

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hexun.fund

com.hexun.fund
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4243

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Process Discovery

1

T1424

System Information Discovery

1

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hexun.fund/databases/rep.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.hexun.fund/databases/rep.db-journal

Filesize
512B

MD5
c4ed711bcda14d74855b0b1a1beffe32

SHA1
1bb80d3e4cdbaceac856d9ff3de7bf05f61a8e65

SHA256
267d6ee0ad0fee26160e082446aafb9e425d1ce75a0b1ea9ecd181b3429f0660

SHA512
82368845f71b815b60f3acf531f069023b40a6232702f8be7dd988853e6f7356dcd60227f47dd851a99f44065ce83dd0bd93996074c29711247fcf1256a09ab9

Download Submit
/data/data/com.hexun.fund/databases/rep.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.hexun.fund/databases/rep.db-wal

Filesize
36KB

MD5
7ea452dac6071847658738c4ad3e82b1

SHA1
da9fef9b5ec365663d75a8137a1ca9cfa6397989

SHA256
7372dffdc71e2d2e080a91725524e5c2f991388c8e4c69101a0fa19e95f16be5

SHA512
772038d3b50fc4519dabc2c87bda3f42b611acc81924a0097e844875072e0fe80e97fb32655e67126554625973cabf26c19247e0ae0eafb591f5cd242cbaeb24

Download Submit
/data/data/com.hexun.fund/files/jpush_stat_cache.json

Filesize
162B

MD5
266131053e54f64dc224b2fd70c59865

SHA1
9120822c12dbec5e422aea1d0dd0de0a53edc699

SHA256
3fb46b337511f56e1d616fbc4db3430821c3d7900de14e8179bccd0406bcda26

SHA512
6932dd23a53346f6b32506343bc9518afbe59be275b41991ccd7d4ea9c8520542de50cffd5919b41baf85a4adf5327a642a0837400b905c583edd1054f2a11a1

Download Submit
/data/data/com.hexun.fund/files/jpush_stat_cache_history.json

Filesize
158B

MD5
bfb3accc6faea8065e89682c9ed790cc

SHA1
510c7817b3ac401a180df8843592f7881afda917

SHA256
5cdfe127b65e2a4770dc71a7423eb57296f75271147a18bdd28319a4c55c1de0

SHA512
fe44efbebedf52a1d297efaffee847e56f4174c19483a062238e0252a050c9c0a03ab2e6680fb11205ae3bfa1d3e2e64b43141a71af6b3192fd9c344b4b1a50c

Download Submit
/data/data/com.hexun.fund/files/mobclick_agent_cached_com.hexun.fund

Filesize
121B

MD5
e467775d9aa15411db674453a120314e

SHA1
b015b64b709548c1fe8bc970ae3fdf35c7e08a7e

SHA256
790443085133da73d22d28bab9f1304d3a97871463e35c21cee9fc3546d3cc01

SHA512
cd1ee2d7f4e7c89ac41a787cd4443a4a8696db893aa7f57be5b9e93a5734d5a1b2da3f0c7365f810a5bd7964ad0ea997bc313bc38a3b287b412ea756c9a2e6ee

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads