Analysis
-
max time kernel
149s -
max time network
153s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
16/10/2024, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
4b54f2170e694d6b89e0ecfd2e44ff74_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
4b54f2170e694d6b89e0ecfd2e44ff74_JaffaCakes118.apk
Resource
android-x64-20240624-en
General
-
Target
4b54f2170e694d6b89e0ecfd2e44ff74_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
4b54f2170e694d6b89e0ecfd2e44ff74
-
SHA1
48ed996d502b7030f5a9151326d590e6fc2712e0
-
SHA256
1c3b5517a71d4610f330b94c3c8b977cd97dbdf769cad0e620e8c1cf9eec4376
-
SHA512
d0de16f7e67e28b5de9e255fe04d67f85cec626dfb52948cf824eeb493bc046f56cf1b6dfa5a4cc77d3000ce5ebb6eb0b354082ce3c5536a1238dd96acb0b00f
-
SSDEEP
24576:TeaoL0otaYtXMhezuEKvUcGmSL534l40P3o+swjsvwq/13tdHbZKm51Ob83Q:+Q7YtTzTtcdSL5IRPLhjsvwq/1XHNKmo
Malware Config
Signatures
-
pid Process 4970 com.sixz.ewxd.hody -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar 4970 com.sixz.ewxd.hody /data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar 5024 com.sixz.ewxd.hody:daemon -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.sixz.ewxd.hody -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.sixz.ewxd.hody -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
flow ioc 25 alog.umeng.com -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.sixz.ewxd.hody -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.sixz.ewxd.hody -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.sixz.ewxd.hody -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.sixz.ewxd.hody
Processes
-
com.sixz.ewxd.hody1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4970
-
com.sixz.ewxd.hody:daemon1⤵
- Loads dropped Dex/Jar
PID:5024
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
Filesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
Filesize
28KB
MD5dae68dcffc3d522a79f98ebbc3b6d457
SHA16df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA25656cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA51223b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
-
Filesize
8KB
MD586b51bb13907a4d10f484c909a3b013f
SHA1a968def6a18ed2a8fb8a94820ded12dba816c3c9
SHA256b2cafeb893f591b87d2f56fd4ed8bb71e7965a2ae1381e9e734221a9bb761bcb
SHA5122af3afb05eccced3cdabe086cb75397d3f52612c602414e04c9faf180757f1bc73f495d6f884b7a4ed8dfd3bdfd7ebc633eb770737c95e132d23901289451c54
-
Filesize
512B
MD5288ef4c606352d225878f88c8be29d62
SHA1a44cf94cbd07073b49d6149eb8c6388a77fd4596
SHA256f9e12d4e6683d84216f76dcfa8578434c3ef21cb562b22a6948ae798d9b808ba
SHA51244895b7840d7d0672e83bf8454c931864cc3bf8f29034b52321356ad5308c59280010ccea2b647dc2bc5a2236ce76987b315963c2d2236dacaadc558229a53bc
-
Filesize
8KB
MD5015a2cba9c8068a37b6df0b41a48e904
SHA139578782c2a317673f98f6413a3330f983bf9195
SHA25647586904fe9d080083297e158898d2d5c9873ab043b3152bf52df4e816b5ce5c
SHA5125aa6d0290adf562ebe73f004578760934cab5882842ab595c47a1f27f83ade184862f62de09ba08059dbc5379726c3edcf63fe95f82a51f4fe4e422a2fd750aa
-
Filesize
4KB
MD58720ec0aa920c368374dbbf7b0428e86
SHA123405da8ef4fd5fbd5ddbf590afda8175df12f3a
SHA2567f118a5d27e5d602b84afc43f1abbf44904a1072207e931cbcb5a45c65200a23
SHA5122a08b44133c2caf1386a52132f9abf0be3f692ebdaef85ec08d85c8f784993fa337d3be9450c5b1709ba6b0294470386aa3f06fc92d1b883a6d599a6f88fca58
-
Filesize
8KB
MD527e4498a8167c5b595f8fa1759675096
SHA113d751bb874eda866ac61578af84895e2930cd69
SHA25689bda10b961aa214937615fe95fbe10ce3041745f010dacfeaf3a03be3e5d2e5
SHA51254b60488c34d19d3ddcb80d7c8489a5348da6128ad5dfff84658e6d11431a549cb9abdf1e3a70f617e9a4aeea93acc12177852ae245fee444292a4efe92b1a8d
-
Filesize
8KB
MD55133d8ac8c989e4668e983ea68b32649
SHA18ee2a8533c60dea9b4c6066581d347f7f9129ef7
SHA256b2ddd2b086bc359750811d19582626ffe489db123b0ae77ac9cf25acca210f6b
SHA5124408d72abf2926e33c29d5b22bdc8f9fce95e9f72392044b29d72909adc08d098d4ddeb417f16bf532994adb393d0eb0699f0878cae235b945df4f96710059b5
-
Filesize
655B
MD5b47f6db91830bf1f53a319a2090dead2
SHA141dc0b3b65cc2055f4c51f321639984c863e593a
SHA256d2069d8595c55d2263fc4885329c5c19c769c2e93959dbc70841dbd5b1ae700d
SHA51236a460471efb2a8e38ca2f8edab129fddc0c784f91aa355c280a6bbdc3a22b6fabf1bc5c22e51b4e49e8af8701b1f095bfc9b7a73b5468fc214b8d65fcf520f4
-
Filesize
162B
MD5d7a0bb80feb3f96df919e3f3423715d4
SHA16b938b13a810ae158a5902626ae38ae5386d0320
SHA2560f758542f872e31d1b166c0a4b8c77552093eb1f65856bffa64c015f0aabfa19
SHA5121fbf94cbadd1986d7a805407744a00cfbba66123f299e7ddf95a399a25a26c2531ae2765f2fd10c5b457d376d76dc60c0cedcf169969dd72034ec8df86c104a1
-
Filesize
350B
MD519c7bbfc400fcaa8edea9387e40c1e4d
SHA14ad1298dbff098445245a43e7785dd58e17c3104
SHA2567527e191cacab7a2ffda0b80dcd07e716d6758bfeac954828a275373caa6f2f5
SHA512b16593479893c9967a24cd82495752e0d512ffcd6c5091bfcef88166c87fc13036c3ca705d574da308494ba4cc87d7f711ed7278be2f6e95c9052eaecb2ef67d
-
Filesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc