Analysis
-
max time kernel
149s -
max time network
153s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
16/10/2024, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
4b54f2170e694d6b89e0ecfd2e44ff74_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
4b54f2170e694d6b89e0ecfd2e44ff74_JaffaCakes118.apk
Resource
android-x64-20240624-en
General
-
Target
4b54f2170e694d6b89e0ecfd2e44ff74_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
4b54f2170e694d6b89e0ecfd2e44ff74
-
SHA1
48ed996d502b7030f5a9151326d590e6fc2712e0
-
SHA256
1c3b5517a71d4610f330b94c3c8b977cd97dbdf769cad0e620e8c1cf9eec4376
-
SHA512
d0de16f7e67e28b5de9e255fe04d67f85cec626dfb52948cf824eeb493bc046f56cf1b6dfa5a4cc77d3000ce5ebb6eb0b354082ce3c5536a1238dd96acb0b00f
-
SSDEEP
24576:TeaoL0otaYtXMhezuEKvUcGmSL534l40P3o+swjsvwq/13tdHbZKm51Ob83Q:+Q7YtTzTtcdSL5IRPLhjsvwq/1XHNKmo
Malware Config
Signatures
-
pid Process 4313 com.sixz.ewxd.hody -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar 4345 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.sixz.ewxd.hody/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar 4313 com.sixz.ewxd.hody /data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar 4379 com.sixz.ewxd.hody:daemon -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.sixz.ewxd.hody -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.sixz.ewxd.hody -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
flow ioc 22 alog.umeng.com -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.sixz.ewxd.hody -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.sixz.ewxd.hody -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.sixz.ewxd.hody -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.sixz.ewxd.hody
Processes
-
com.sixz.ewxd.hody1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4313 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.sixz.ewxd.hody/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4345
-
-
com.sixz.ewxd.hody:daemon1⤵
- Loads dropped Dex/Jar
PID:4379
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
Filesize
737B
MD5e11ced51cdf1758ccf6755d2a0448e26
SHA1dfde9fe1aac36787799781712382320183811012
SHA256e204188cfc7b969c3d074c7510b037725043cafaea5fdad8c4bab0ac78b3cd62
SHA51253b00852dcd64750e9e9d1fb3d5e93b0c5e90a420e454191fc8c9e5ab7141de08fd94cb418ebb5d8f426c35b5dec7e6c3312bb8cde4bfd2788f00c0599841831
-
Filesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5605f8c9f4a9b7fe88e4919af4c4e0b27
SHA18acec1885f45b0081be6702ac255423dc441ad57
SHA256261336de8c3f6aef85495cdaf8c4291a2b73f636b1a1a872de97056f32dc4830
SHA5127b24fe2bc359c31604aab2c9d3a348be2cf3b53f01fc499a056139029cc08201ee926d57d26d61cc54d3753d749491aa7682dd3a085c621185a5b5240503caf3
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
60KB
MD5dc53613971aed79c3678fc0b8f0af837
SHA10da906048995185240b53945a4fb2fa550dac8be
SHA256a5ee8f0a054304a92f10045ce4494da77d721667541732783ebf94220a31be3b
SHA5129aff348794c101586b0ed50cd42b648c5dfbfe8356549bb50e0879823ce932d54112649f8ac291e6884609730fcdbecd7b1093f3270111befbbfcdbb6fc4cf26
-
Filesize
679B
MD50dcbc39fab54f458a01d7d13c29cfb31
SHA16d9feda22795c454f0f0a2d675536f916e2fa295
SHA25613a59ff72603cc4b44a9d20e61a203fec7929f0cb00a02cf0d9e6dd5dabfedf6
SHA512c14b03e83fb38b31d254b117c497ad1192bf85c39ea3e6c70c9cb9b3f10c12a1b69c9c26ae724b536c3a5311b089b3a1fbbeefb8e63c067fbf9551a9e53a8909
-
Filesize
162B
MD5a8d0f025a1c70c02726dac50c6a13972
SHA1b80c142a8d01823c4029cf537d13de11d325385e
SHA2568d017cb848845e153707c4d21243a97e390af9c34137c2e6c9b77fe46e57e8c1
SHA512c78a3248d43c37b1150f52ee41f4fcb42166c76f878f8dc628f2eb67e1cf7eaf44ad147c7011348a3f6458ce9d421005086929bd55641b121f2d904896bccd98
-
Filesize
415B
MD5c594fcb03f79d9d7f4e27339f68e49d8
SHA11f5f5409416d8fbf4a21224cdaa5e02d7135eab3
SHA2569d04e96c338732cff4f597ac8af891e72004e27b961ffab86a04964cf83ac591
SHA512406d5f799f69442a2654a029d0f7d482cc598b6ddf0cfa0f825905a36bb4433469d2da2da0064b249553f03924acca45ef3eb10678e9505a1b7177b2523da18b
-
Filesize
248KB
MD59b47e78a6ff90cce5755ce4742047627
SHA1831b24aa9e116eb8d7065efd430088d419dfd6c7
SHA25630d7699b73fd7f276945415c405c12bff69c5958d12f56265a768443f6fd8cae
SHA5124587a5b26f13cbd0524eade71ed29203fc55029fe150fce850016aa7d9c578623cdc4b6a551bed3dec9e31a39563f8927cfcc9d21e2d83c2c781808b958446fc
-
Filesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc