Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    16/10/2024, 04:06

General

  • Target

    4b54f2170e694d6b89e0ecfd2e44ff74_JaffaCakes118.apk

  • Size

    1.3MB

  • MD5

    4b54f2170e694d6b89e0ecfd2e44ff74

  • SHA1

    48ed996d502b7030f5a9151326d590e6fc2712e0

  • SHA256

    1c3b5517a71d4610f330b94c3c8b977cd97dbdf769cad0e620e8c1cf9eec4376

  • SHA512

    d0de16f7e67e28b5de9e255fe04d67f85cec626dfb52948cf824eeb493bc046f56cf1b6dfa5a4cc77d3000ce5ebb6eb0b354082ce3c5536a1238dd96acb0b00f

  • SSDEEP

    24576:TeaoL0otaYtXMhezuEKvUcGmSL534l40P3o+swjsvwq/13tdHbZKm51Ob83Q:+Q7YtTzTtcdSL5IRPLhjsvwq/1XHNKmo

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.sixz.ewxd.hody
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    PID:4313
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.sixz.ewxd.hody/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4345
  • com.sixz.ewxd.hody:daemon
    1⤵
    • Loads dropped Dex/Jar
    PID:4379

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.sixz.ewxd.hody/app_mjf/ddz.jar

          Filesize

          105KB

          MD5

          23ba0b249042b7ba33e92c0199b0ea4a

          SHA1

          99b13ee9f7307316c2337953fceed87e9942b794

          SHA256

          1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

          SHA512

          0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

        • /data/data/com.sixz.ewxd.hody/app_mjf/oat/dz.jar.cur.prof

          Filesize

          737B

          MD5

          e11ced51cdf1758ccf6755d2a0448e26

          SHA1

          dfde9fe1aac36787799781712382320183811012

          SHA256

          e204188cfc7b969c3d074c7510b037725043cafaea5fdad8c4bab0ac78b3cd62

          SHA512

          53b00852dcd64750e9e9d1fb3d5e93b0c5e90a420e454191fc8c9e5ab7141de08fd94cb418ebb5d8f426c35b5dec7e6c3312bb8cde4bfd2788f00c0599841831

        • /data/data/com.sixz.ewxd.hody/app_mjf/tdz.jar

          Filesize

          105KB

          MD5

          293ea5f01e27975bed5179ba79d80eac

          SHA1

          c5b0806a537fd1cb753e11f1a9684933317716b8

          SHA256

          8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

          SHA512

          c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

        • /data/data/com.sixz.ewxd.hody/databases/lezzd

          Filesize

          4KB

          MD5

          f2b4b0190b9f384ca885f0c8c9b14700

          SHA1

          934ff2646757b5b6e7f20f6a0aa76c7f995d9361

          SHA256

          0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

          SHA512

          ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

        • /data/data/com.sixz.ewxd.hody/databases/lezzd-journal

          Filesize

          512B

          MD5

          605f8c9f4a9b7fe88e4919af4c4e0b27

          SHA1

          8acec1885f45b0081be6702ac255423dc441ad57

          SHA256

          261336de8c3f6aef85495cdaf8c4291a2b73f636b1a1a872de97056f32dc4830

          SHA512

          7b24fe2bc359c31604aab2c9d3a348be2cf3b53f01fc499a056139029cc08201ee926d57d26d61cc54d3753d749491aa7682dd3a085c621185a5b5240503caf3

        • /data/data/com.sixz.ewxd.hody/databases/lezzd-shm

          Filesize

          32KB

          MD5

          bb7df04e1b0a2570657527a7e108ae23

          SHA1

          5188431849b4613152fd7bdba6a3ff0a4fd6424b

          SHA256

          c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

          SHA512

          768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

        • /data/data/com.sixz.ewxd.hody/databases/lezzd-wal

          Filesize

          60KB

          MD5

          dc53613971aed79c3678fc0b8f0af837

          SHA1

          0da906048995185240b53945a4fb2fa550dac8be

          SHA256

          a5ee8f0a054304a92f10045ce4494da77d721667541732783ebf94220a31be3b

          SHA512

          9aff348794c101586b0ed50cd42b648c5dfbfe8356549bb50e0879823ce932d54112649f8ac291e6884609730fcdbecd7b1093f3270111befbbfcdbb6fc4cf26

        • /data/data/com.sixz.ewxd.hody/files/.um/um_cache_1729051726822.env

          Filesize

          679B

          MD5

          0dcbc39fab54f458a01d7d13c29cfb31

          SHA1

          6d9feda22795c454f0f0a2d675536f916e2fa295

          SHA256

          13a59ff72603cc4b44a9d20e61a203fec7929f0cb00a02cf0d9e6dd5dabfedf6

          SHA512

          c14b03e83fb38b31d254b117c497ad1192bf85c39ea3e6c70c9cb9b3f10c12a1b69c9c26ae724b536c3a5311b089b3a1fbbeefb8e63c067fbf9551a9e53a8909

        • /data/data/com.sixz.ewxd.hody/files/.umeng/exchangeIdentity.json

          Filesize

          162B

          MD5

          a8d0f025a1c70c02726dac50c6a13972

          SHA1

          b80c142a8d01823c4029cf537d13de11d325385e

          SHA256

          8d017cb848845e153707c4d21243a97e390af9c34137c2e6c9b77fe46e57e8c1

          SHA512

          c78a3248d43c37b1150f52ee41f4fcb42166c76f878f8dc628f2eb67e1cf7eaf44ad147c7011348a3f6458ce9d421005086929bd55641b121f2d904896bccd98

        • /data/data/com.sixz.ewxd.hody/files/umeng_it.cache

          Filesize

          415B

          MD5

          c594fcb03f79d9d7f4e27339f68e49d8

          SHA1

          1f5f5409416d8fbf4a21224cdaa5e02d7135eab3

          SHA256

          9d04e96c338732cff4f597ac8af891e72004e27b961ffab86a04964cf83ac591

          SHA512

          406d5f799f69442a2654a029d0f7d482cc598b6ddf0cfa0f825905a36bb4433469d2da2da0064b249553f03924acca45ef3eb10678e9505a1b7177b2523da18b

        • /data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar

          Filesize

          248KB

          MD5

          9b47e78a6ff90cce5755ce4742047627

          SHA1

          831b24aa9e116eb8d7065efd430088d419dfd6c7

          SHA256

          30d7699b73fd7f276945415c405c12bff69c5958d12f56265a768443f6fd8cae

          SHA512

          4587a5b26f13cbd0524eade71ed29203fc55029fe150fce850016aa7d9c578623cdc4b6a551bed3dec9e31a39563f8927cfcc9d21e2d83c2c781808b958446fc

        • /data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar

          Filesize

          248KB

          MD5

          a54a18b58c6720991c021f433dfb2a46

          SHA1

          d2ffa07919f92b6e04914e39843f08fdb2a75b68

          SHA256

          3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

          SHA512

          e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc