Analysis
-
max time kernel
149s -
max time network
153s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
16/10/2024, 03:25
Static task
static1
Behavioral task
behavioral1
Sample
4b355c6f124e5f6454109c2d58d21ae3_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
4b355c6f124e5f6454109c2d58d21ae3_JaffaCakes118.apk
Resource
android-x64-20240624-en
General
-
Target
4b355c6f124e5f6454109c2d58d21ae3_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
4b355c6f124e5f6454109c2d58d21ae3
-
SHA1
cfcbf10f2f8169ec0092ef005108abab401d2555
-
SHA256
c6ee0d569566c76f6b7e11c615e51a5056e07ae618eb930b82923738614fc5ba
-
SHA512
9efe79db5075173cad4fab61bfabc28f91682eeaa1cdc2611d89d9753eaeb78e838f53b1d4344b683fa9bf5d7190a16938c18e2f91904629dfd88904516007ff
-
SSDEEP
24576:eWQXoL0otaYtXMRCnEOn8wB7PvQ4jTo+j0jT+lq/13tdHbZKm51Ob83z:eSQ7Yt6CnEQfB7PvQ4j/YjT+lq/1XHNF
Malware Config
Signatures
-
pid Process 4967 com.clul.ifoe.zzhm -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.clul.ifoe.zzhm/app_mjf/dz.jar 4967 com.clul.ifoe.zzhm /data/user/0/com.clul.ifoe.zzhm/app_mjf/dz.jar 5023 com.clul.ifoe.zzhm:daemon -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.clul.ifoe.zzhm -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.clul.ifoe.zzhm -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
flow ioc 26 alog.umeng.com 39 alog.umeng.com -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.clul.ifoe.zzhm -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.clul.ifoe.zzhm -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.clul.ifoe.zzhm -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.clul.ifoe.zzhm
Processes
-
com.clul.ifoe.zzhm1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4967
-
com.clul.ifoe.zzhm:daemon1⤵
- Loads dropped Dex/Jar
PID:5023
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
Filesize
721B
MD59dc503c7935bdd7da5f66e4f5068e6af
SHA1ca334b02a7cdf7807edc910e736850dd720f722f
SHA2563c318264ce89d9a7a286a44549177a4641c3d8f261d52756f08cf751c7204433
SHA512f53f3f9429053f5f25158205b2fab8f497c0e19be5b0fa1d521b71759188ff734629fa568a6ce9dec9f834156be2a48b8ce90bf6739210d6f21f197287508c7c
-
Filesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
Filesize
28KB
MD5dae68dcffc3d522a79f98ebbc3b6d457
SHA16df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA25656cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA51223b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
-
Filesize
8KB
MD5d35b5aae20bf43da0b2e23e2a00b3a16
SHA19a98c0ad65f59bd0e312a035f6d15a60905e6997
SHA2567297cca6d5bf353578793a229f8a4e8b3c4e17ba60f909c7af593edaf6d2dfc7
SHA512dc361e15c7392e66ff17290c6c4c7feb962a4e4fe8895886b76dad8e2534dfe02087b9b3d83b5614740ed7c304210d6c424923fe30e9df8eb31f566e5dd7c8a2
-
Filesize
512B
MD598579996f89df3114e1303ad1f3d37fd
SHA1f4c8a7ee0f2eea1af3687546d9e6732d3e40abfb
SHA256858ecfb7aa1ce29a820dbcd0803a6d76dbfce868473db591f1e81a278f2d2643
SHA512473270fa33519159a71985f3f41dbb55019c89a0618a4db6a573f81b687dde43f8e224c3a1a1365e7be740474ad2cae4f5324b4de23c897a60c5a558d35beee6
-
Filesize
8KB
MD5e1d523eec3dc92ccf91ac0dbb2723da2
SHA1ad7aa21324798acbcf4cae77b1c8cdfc657973ba
SHA256d17c642e7ecdb466f2a636492305ec14f075dd151058153eddf8b4733a36e8cc
SHA512e5e42c452720e05a845fdb45b1971a9e4becc4cae511640abf5cd10c02b015ea3bb26bef44cb83ead974f55d953b014e0b1b15e6ded42d823e6cf47ea5524ab4
-
Filesize
4KB
MD52c84e5b720ddb85475ec5fd961790b44
SHA1e3b3752263c066474e5e6fe7328a38b28911ff89
SHA256648640ee3c8a909295424ae6a392ba6cdbdd4e29afa37348709e7ff12ea0b34d
SHA5128ae16f0a1c5093116e5339add6df3d9d00e95261517e9f946a0b75cf1b4991eca57b3a4200e4805bd775f37c58c279f4f6d32629eef84f8bc5fa6ee8596d27a0
-
Filesize
8KB
MD56fedd15348bdfae21fb587ba65010da6
SHA1d4f82f0e50f414d6c814ddb256c8064baba49270
SHA2568759624e7f51b5f2399232f67754e7813432933e8d9af34ab31a72eaf3db4213
SHA512341616837030353b02431a382d9cfa7a5a9ce74c113d3eb1d23e53f153a71f22cafb5a34ef84bca3d09291de3454207b88d0d41363342232356b98d44ab6c265
-
Filesize
8KB
MD5f39218578039e9402cc3577afe360b62
SHA1700c7b20d5984ea39235eb2d9d11539130da385b
SHA256862d744980f9350db07bb7e8f9b274b9517f2c9ac3d64186cd3e1805f96553a9
SHA512f4085b5c7c82bf655068e0a0df694651c58b328269ba2af259ceff07523e016166a7a5e7b8f07d78cf9eedc2c7e8c72f73c0064c9fc3e18f61ce777047fb051f
-
Filesize
653B
MD581b8d511851dea091b86e19f3e502d61
SHA1ef934c6352490737efdfd28cdf54259c9e78a14e
SHA256543466d7bb099b2bf7ffb42d57163c78aa89f2d616b1ffb56068223526c48e65
SHA512e2c0df02754c7a0cdffd342fd6a88bc2f05b596ae3748abd0de2caa57654358e55c3ffe8c22418a8303a5bd2673486e26175e6ab7ee090a2c25fec17a8ece3ac
-
Filesize
162B
MD552fa577473f7f3dfd832c7cc1028ec46
SHA12db02d25c00425cdd2e9bd3b996ca44b17debdf4
SHA256f3d6df2ba5f1a62165d2e5ae0dc1bedfd7dcd16ce9df21daea4d2b3dcd797652
SHA512ca5539c7c4da1343a9238e084b7583521baafa532336bc8e370438454594dea554ab8bd3d294011c63cf12bcdaa7f0bbc695f6d435090acb3a8d9b8e9a41727e
-
Filesize
352B
MD54b85c678dc2af1bdf6212669cfaf154b
SHA1ba8577c1fc27468eaed8858794f917efdf84b4b2
SHA256105a640cfc3ce5a5759bc1c4d9c7a2a56524500a5a883df8fe690642993ab4f2
SHA5125c34d5848c721c429253246a89a0ce52e614cd1b5627ca0f50e674010624b306197f6b9f58a82676b539acd238d6c9d635d27b1649b5acbbf9fc4be03df4d693
-
Filesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc