Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    16/10/2024, 03:25

General

  • Target

    4b355c6f124e5f6454109c2d58d21ae3_JaffaCakes118.apk

  • Size

    1.3MB

  • MD5

    4b355c6f124e5f6454109c2d58d21ae3

  • SHA1

    cfcbf10f2f8169ec0092ef005108abab401d2555

  • SHA256

    c6ee0d569566c76f6b7e11c615e51a5056e07ae618eb930b82923738614fc5ba

  • SHA512

    9efe79db5075173cad4fab61bfabc28f91682eeaa1cdc2611d89d9753eaeb78e838f53b1d4344b683fa9bf5d7190a16938c18e2f91904629dfd88904516007ff

  • SSDEEP

    24576:eWQXoL0otaYtXMRCnEOn8wB7PvQ4jTo+j0jT+lq/13tdHbZKm51Ob83z:eSQ7Yt6CnEQfB7PvQ4j/YjT+lq/1XHNF

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.clul.ifoe.zzhm
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Checks CPU information
    PID:4497
  • com.clul.ifoe.zzhm:daemon
    1⤵
    • Loads dropped Dex/Jar
    PID:4560

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/user/0/com.clul.ifoe.zzhm/app_mjf/ddz.jar

          Filesize

          105KB

          MD5

          23ba0b249042b7ba33e92c0199b0ea4a

          SHA1

          99b13ee9f7307316c2337953fceed87e9942b794

          SHA256

          1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

          SHA512

          0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

        • /data/user/0/com.clul.ifoe.zzhm/app_mjf/dz.jar

          Filesize

          248KB

          MD5

          a54a18b58c6720991c021f433dfb2a46

          SHA1

          d2ffa07919f92b6e04914e39843f08fdb2a75b68

          SHA256

          3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

          SHA512

          e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

        • /data/user/0/com.clul.ifoe.zzhm/app_mjf/tdz.jar

          Filesize

          105KB

          MD5

          293ea5f01e27975bed5179ba79d80eac

          SHA1

          c5b0806a537fd1cb753e11f1a9684933317716b8

          SHA256

          8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

          SHA512

          c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

        • /data/user/0/com.clul.ifoe.zzhm/databases/lezzd

          Filesize

          28KB

          MD5

          fdb8a92e5060ce104e8f0faca55a47ce

          SHA1

          270d7ca30673e18cec1d2b9add71cba96dc426fe

          SHA256

          194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a

          SHA512

          ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

        • /data/user/0/com.clul.ifoe.zzhm/databases/lezzd-journal

          Filesize

          8KB

          MD5

          60682df074efea5e1628150b39f94abc

          SHA1

          43507508f28447dc6d13d45c6bca2bed2679a1b4

          SHA256

          356b33a04df8d8ea77c0682849789c7de49ab8825c25c446cc7ebb4ee3a0dcd8

          SHA512

          acf6d3988318b3cd540b3ab93581b880266de61c53347de160d4434c2dddac1956bd767f78d8b78e8aa8f4b55f3e56f1da3d48dc516d4979c4a8803167df565e

        • /data/user/0/com.clul.ifoe.zzhm/databases/lezzd-journal

          Filesize

          512B

          MD5

          a8dc6fe37742476993df793697893906

          SHA1

          f7490525f5e96499a6218027e5a556586b0048f6

          SHA256

          bb4dec56d2d955cd4ef50d66c2437acec861f2d9dcc1a4aa4c299f26332a4549

          SHA512

          b1da1d4c341498d4862f0ce8afb52c24f700887661d97b902d64bcb8d1ed661b95b705cf1187be49f79ba585e658467a4ce7735cf93a7af118ea784facaa807f

        • /data/user/0/com.clul.ifoe.zzhm/databases/lezzd-journal

          Filesize

          8KB

          MD5

          2357940868ab27e23e88298e08590c2c

          SHA1

          8f962d630d567018de21dd4034938c77b124c8cc

          SHA256

          051d46024ea2fe1c57d2c2805f72a02e76bd40915b610dc3ea1b04c20218388b

          SHA512

          78bef62cf4c6b5589470baa89bf8e6849c891247cca43d2e6b9f955bc64499c7ac79b1c9d55364c0448f14969bcb713afafd3946615ec3db2c3b43c9abe8a789

        • /data/user/0/com.clul.ifoe.zzhm/databases/lezzd-journal

          Filesize

          4KB

          MD5

          daa2dc1d510aea705c9683b48b84c762

          SHA1

          71ee61eaddad17c54904dfe8a8416a6b9837d8f9

          SHA256

          d160271a3e271cd7cbacbb16fd41d5b2cfeed643429a7c386adb2f35d0175602

          SHA512

          fd16cb7b68805149abcc822111f0cb5030acdce9e503af1cf13a5188c52ce4513773612e413a46bb3fd6825aea63c8e61833b9dc9ca7f07f9cf61d992fdf9d1f

        • /data/user/0/com.clul.ifoe.zzhm/databases/lezzd-journal

          Filesize

          8KB

          MD5

          58bc66dce6cdac091794cf25e6d8744d

          SHA1

          eac17436d6bff9d51ce0f4cdfa6a39b2868020b8

          SHA256

          df0a688ee2f966a071ca3b45897488949fff975e1be075141a4aabca0f678f10

          SHA512

          7c379f4b58c50c5d7961916874cb1e917a9e02b720d6f5ee9539430ba9cb332ec31a73226c9a1be3ac2eb8f7c7a5ba5f8140c848ae3d624c73a40f742506d15d

        • /data/user/0/com.clul.ifoe.zzhm/databases/lezzd-journal

          Filesize

          8KB

          MD5

          e9f21fe02e27151f0b13324e33c5fb05

          SHA1

          3adb5e83c899e466db614b4dce45ba42dbe7e5b4

          SHA256

          55b7ae6d5c7bbd0f54cd7ab8d47817dcbcdbe85ea84f4c44ae78e880a2988753

          SHA512

          92dce9d981300193ff3e116dd1c2cefc5f6af86f97842b418f1979d09823440b62154e5d43920520788969429f2a682bfee009de57b4b658d35d9b1c62a432c9

        • /data/user/0/com.clul.ifoe.zzhm/files/.um/um_cache_1729049240728.env

          Filesize

          654B

          MD5

          437333a36a60eb01645b6ef75660ae67

          SHA1

          4956294a7b841b827c334a645802e215a9e7a79b

          SHA256

          016c1a5bfec9b524ed38afe6b96ba4b95a3cfdf0ac7b102de09bc1cf77f83347

          SHA512

          84fff3a816f7dd6a59865ef8ae3c76745173830b06595756a0c71f3516121e5b945cc8e265fe944bcc941d51de19fbfeeda93665a5768d44e4e87635a6002379

        • /data/user/0/com.clul.ifoe.zzhm/files/.umeng/exchangeIdentity.json

          Filesize

          162B

          MD5

          01f2a7ad15a2e1293cde4e043f35832f

          SHA1

          1b6b6e18ecf47f796b40afe8385298f6df39124b

          SHA256

          3a7c980ef74b87db7cb79a20dfa2a6eff10153237b537ac8af96524077b21835

          SHA512

          4686e7437bb32cedb010b5f2c2805169b08fecfb0d1ee441fcfcf4b7b147f8e15bd26fc4e8eab204d9f79dd909ab8f5964697e21c98fc0847af2ba989fb3b0b9

        • /data/user/0/com.clul.ifoe.zzhm/files/umeng_it.cache

          Filesize

          348B

          MD5

          63a6c97d62629e45cd348fd6541e1357

          SHA1

          9dd2c02b55176bb70bb8e2f70123b4b5d540abc3

          SHA256

          32136481071b80a9f3268ecc2b6fe3be6c4c7e49acf0ee2f658116edf8285f4f

          SHA512

          fbb5cb41b6cefc30c48dd5571559244747e4ed8110e0289b530a8c84a102a26f6db1c35f212212ee7434d03b70b58bb541b184fef4a2a79725f43b8734385ab7