1b7c82e900d4746ea94f6fbb206e8c8ff59e8b9278769c54dc047a544b0a31bb

General

Target

3bf70bc4e48e31251947ef51995daa7c_JaffaCakes118.apk
Size

1.4MB
MD5

3bf70bc4e48e31251947ef51995daa7c
SHA1

f0bb859293e646216f477dc49cb92c9b6ca4cfe9
SHA256

1b7c82e900d4746ea94f6fbb206e8c8ff59e8b9278769c54dc047a544b0a31bb
SHA512

b0b74f0bcb67fe1b01e1b67e4ab0e4f1ee742b8b0c397135704529031f9fb0d44f658de21373012783c4954625dda5836ca7d3c97445450a2444b93a80e8b6bf
SSDEEP

24576:ybLY1rYnDmbxUg4sGKj81KT0fD6ShYQgIOWnJR7n7JyVmyAzRQgfs3Ev83iuOaRM:f1rYSU1sGKj6KTO6LbbCHAFAN4m8SF

Score

7^/10

banker discovery impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
11	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.zuimeinvrenjie.cn

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.zuimeinvrenjie.cn

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.zuimeinvrenjie.cn

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.zuimeinvrenjie.cn

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.zuimeinvrenjie.cn

com.zuimeinvrenjie.cn
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4253

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.zuimeinvrenjie.cn/databases/xUtils_http_cookie.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.zuimeinvrenjie.cn/databases/xUtils_http_cookie.db-journal

Filesize
512B

MD5
a5772c4381425da6c612bcba072e4cf3

SHA1
eb43e812ad2bdc8806a6396e23dfaf918aac7bf9

SHA256
9bea892dc30a51cc23d71d3dd80768f62de130503b93d52f3f2b4e408914067d

SHA512
05015f521235669c3897313853ed7f10a097b5952e254840f3d946c689f84244714e4f1d0b3c998636d6b3589010e57b5001585bc7bebb137c90ff77f3828d17

Download Submit
/data/data/com.zuimeinvrenjie.cn/databases/xUtils_http_cookie.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.zuimeinvrenjie.cn/databases/xUtils_http_cookie.db-wal

Filesize
20KB

MD5
91d125a77730ee128998444dd1d3f71d

SHA1
e75bcdfdf3aca24459a52c34ddc8e024ef5f3d27

SHA256
52cae3a33102355d4a8438f526b1cd78fa8466fd8d43956f579fa8f743461494

SHA512
963cf8404f0a6d3fd279215ba6c2f1a57d39e41e15506a7dce054ba79075ae6859898c141daf85a195ac3e3e188b361c8ff7dffef777e8b1c4bbfec20615fbbf

Download Submit
/data/data/com.zuimeinvrenjie.cn/files/.um/um_cache_1728766099832.env

Filesize
713B

MD5
28080f2034ec7ce4d19c12a14de99a53

SHA1
1fea4aef5b30253659e186463206cff1ebad6cec

SHA256
212d9fed94de8a416bd47017593ed30f3d823947c511c1de1cbdc1b3258e66c5

SHA512
22a41f14c1ce040b99bfccdaa751969d537afd876660a5e3dc691116f219163d52fdeece9287f87cfd4ef1b37859175c4b19f4cf1a81c3304ace5bc134dbfa87

Download Submit
/data/data/com.zuimeinvrenjie.cn/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
8108f4b173685dbc00771752ad553699

SHA1
2f4ab0559568e8d170eedc8b84e851cba3ee06e1

SHA256
7bb6a58cafbae330ace7f1951b2058f0e7cc32254103baf315215d4482c14960

SHA512
5e71daa0fabc22c8b93b39ff0e78f5551325d3c4881a007464e4279b628309f83da1a7f989d678a11d00378c6698e907524dab2d5a558fcb1cce863b17324b88

Download Submit
/data/data/com.zuimeinvrenjie.cn/files/umeng_it.cache

Filesize
415B

MD5
bab84eef8b77aad37a6462240bf228de

SHA1
61bc394e3ef6028017aa53b7c035396788d74c41

SHA256
29e3285109ebb0ac5e48ef7acc403bbd3ff9f6dd54c2a35ea01fde1008ce448e

SHA512
999896bf0611f205f713e4edd1e1d30bcdbe9039fa77eb3eeeda71e32f8dc90916da49bfe0ed642d13879e98ac6329e58185e4dc70146381b2a434ddb7137235

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads