Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    16/10/2024, 04:06

General

  • Target

    4b54f2170e694d6b89e0ecfd2e44ff74_JaffaCakes118.apk

  • Size

    1.3MB

  • MD5

    4b54f2170e694d6b89e0ecfd2e44ff74

  • SHA1

    48ed996d502b7030f5a9151326d590e6fc2712e0

  • SHA256

    1c3b5517a71d4610f330b94c3c8b977cd97dbdf769cad0e620e8c1cf9eec4376

  • SHA512

    d0de16f7e67e28b5de9e255fe04d67f85cec626dfb52948cf824eeb493bc046f56cf1b6dfa5a4cc77d3000ce5ebb6eb0b354082ce3c5536a1238dd96acb0b00f

  • SSDEEP

    24576:TeaoL0otaYtXMhezuEKvUcGmSL534l40P3o+swjsvwq/13tdHbZKm51Ob83Q:+Q7YtTzTtcdSL5IRPLhjsvwq/1XHNKmo

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.sixz.ewxd.hody
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Checks CPU information
    PID:4474
  • com.sixz.ewxd.hody:daemon
    1⤵
    • Loads dropped Dex/Jar
    PID:4540

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/user/0/com.sixz.ewxd.hody/app_mjf/ddz.jar

          Filesize

          105KB

          MD5

          23ba0b249042b7ba33e92c0199b0ea4a

          SHA1

          99b13ee9f7307316c2337953fceed87e9942b794

          SHA256

          1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

          SHA512

          0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

        • /data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar

          Filesize

          248KB

          MD5

          a54a18b58c6720991c021f433dfb2a46

          SHA1

          d2ffa07919f92b6e04914e39843f08fdb2a75b68

          SHA256

          3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

          SHA512

          e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

        • /data/user/0/com.sixz.ewxd.hody/app_mjf/tdz.jar

          Filesize

          105KB

          MD5

          293ea5f01e27975bed5179ba79d80eac

          SHA1

          c5b0806a537fd1cb753e11f1a9684933317716b8

          SHA256

          8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

          SHA512

          c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

        • /data/user/0/com.sixz.ewxd.hody/databases/lezzd

          Filesize

          28KB

          MD5

          fdb8a92e5060ce104e8f0faca55a47ce

          SHA1

          270d7ca30673e18cec1d2b9add71cba96dc426fe

          SHA256

          194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a

          SHA512

          ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

        • /data/user/0/com.sixz.ewxd.hody/databases/lezzd-journal

          Filesize

          8KB

          MD5

          0f4709fd3fb91c69021d3d152d396ec1

          SHA1

          bccc3823bab60557807115ae1aed53950f95c844

          SHA256

          3d2bc8d8be09cd32354a31b6f758644b22b5f047a92accd2b02c6854750b0661

          SHA512

          cb0196614389d3b3911f3cdaa0d4e693631a03dd73d3ebc0bf656bff03d7cb778b237198f497206f0892ad9bb6dad9f8895386c3311a255eac4e1c0f03043c1f

        • /data/user/0/com.sixz.ewxd.hody/databases/lezzd-journal

          Filesize

          512B

          MD5

          531e9ac00e9d01828105c7aa9a8115e5

          SHA1

          aa3b21c0196c01adc12519be56a6ec4e342bfcfb

          SHA256

          ef35b51c6fc670f7e231358ca2ccc196d05c3141e03a494fa896bd2eaed8502f

          SHA512

          bfb97cf89afa97bc6dd0177d81c4753bb5b2c37796fde2d038b89ce80418cfb2fb054a7b1639ada2b409c254b4ea217175273fe001b246cb02124d672487487f

        • /data/user/0/com.sixz.ewxd.hody/databases/lezzd-journal

          Filesize

          8KB

          MD5

          5e4b5dea093ec6e68010ea574aeb021c

          SHA1

          8ddfd50915cd389e528ee51ab058ee3f3fba870e

          SHA256

          7a490ed3dd0ef6c001bc6f365e711f978912a7ab872ed03e91a410151d1a6bca

          SHA512

          de0ef0ff8bd6223a5608df89bcb4d33cbcaa9a76e8d86593ac6e495e29d404b43278b9ef4a0a6cb6385fc99b16c52fce4f0d2f320912b1a25b81efc71993dde6

        • /data/user/0/com.sixz.ewxd.hody/databases/lezzd-journal

          Filesize

          4KB

          MD5

          2bf8c7aa1a3853f64cd7d0d76fce59e4

          SHA1

          bb5a75e08a00ab9e282cd9417eb6b76a9471ba0f

          SHA256

          986f94e34f5858c7973849d76d7e9246a3a3351961e29f78a251661f342d5161

          SHA512

          e7a7a0fa23f0d6f5731d2886c5ba0dbcf73d5e68ead8b66460c18bd52c7676e14f795926b212eb65a6d6bbb6227abac51d093d99fbe72abdf77dba51f0b3065d

        • /data/user/0/com.sixz.ewxd.hody/databases/lezzd-journal

          Filesize

          8KB

          MD5

          3f89ab45ca04265569312e27fab5fe30

          SHA1

          06b371b19e27562e091faefd16d00ef0a9bced5e

          SHA256

          e0fc3cfba617df349b01f20a4cf9154e58471f38ac4371cf615bcf8d65658bc6

          SHA512

          bacff933b40c9f2652d59f6ab6f8d83730d22954caecf13fbee16325c339a3f8cb76be8bec1dbbd9cf6135be60f7c980cfe97d0989cea73d3d32f64761970ab9

        • /data/user/0/com.sixz.ewxd.hody/databases/lezzd-journal

          Filesize

          8KB

          MD5

          b07e9edce6c51021a8985c836831cdbe

          SHA1

          72c8ad5628c4041d4bc5ba8c587b6bf7e5722fbb

          SHA256

          480c4ac5d4b66e63139ae71de793b075a20bffa563b5982e5fc841b8307b8a56

          SHA512

          d79e23d662ae89f8f4ac31aca5e1ce01dbc184b15131ef38e7406ed2ae5900dfea4f00791da07a1ab68d0f0e7fbe92faf7d949262bc36f7945f55c6047d96726

        • /data/user/0/com.sixz.ewxd.hody/files/.um/um_cache_1729051728066.env

          Filesize

          650B

          MD5

          3ed958917c575c743a5af45ad35e7b95

          SHA1

          066098475593d6e3ccaefe7f053c060a9726c5a0

          SHA256

          0b29029ca019579e803ca08e74f59f4f571ac262a1b5b98537c50803270884b1

          SHA512

          94b7fd69906851444a4508adeedfc261812d3adde5022d4af67c3b5da520aa605ff95bd895c3e936a05f538972d8b7e5fba795a86e163b49b592b45134315b9d

        • /data/user/0/com.sixz.ewxd.hody/files/.umeng/exchangeIdentity.json

          Filesize

          162B

          MD5

          967062468effb7f0f1f6d0ceb363a493

          SHA1

          7d0ac754c0825cab1cbacf435d250cad61fce622

          SHA256

          e8610d15d5045eae8a2f4b8a8d1d8f137faba18e00c5d679ce99475642a5d70a

          SHA512

          53bf3ef3d0c14906d2f57a0e34c72529e96694ca0347cd60b6a649a99b7a4c12023c29f7959ba6af6c04156ae1efd9706ec1ae1e4c0cc05e89cce1876414811b

        • /data/user/0/com.sixz.ewxd.hody/files/umeng_it.cache

          Filesize

          346B

          MD5

          d9dc11d5533fe5953612c3b79a342019

          SHA1

          b009abc9cb25d4671405a5b0f82335b4e350e0cf

          SHA256

          cae5b41fd472ffc13be5d3b547de199de431d51f694074073445fb6174e4babe

          SHA512

          97125e8d81b12994101d661fbb08f59545fd7d9ab2a3a80928dcaa25ef60fd82aae5bba549102b67267073af8321e294f6cc319972c98460331347c64244d5cd