Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    17-10-2024 16:09

General

  • Target

    528f837d06eeed41f47ad96a4764a574_JaffaCakes118.apk

  • Size

    17.3MB

  • MD5

    528f837d06eeed41f47ad96a4764a574

  • SHA1

    9ba9372885dc1c3fb44da3d2cfe2cc86079bb4fd

  • SHA256

    812a154d46d5fc703bc0b56eae32c2403038fa4c4e0086b3c85f1c8922f895ec

  • SHA512

    b6be4ce593473181dac781d7ef87db567c9b6e4b8583c4c13807307927b554a24f19fc1fb00580931b43705efc296cae80be16fac95d4ad259eef7d195b5c6b3

  • SSDEEP

    393216:QoTnf9Up7mFTyhmJt0pvtLuwpATWOve2bop1CLf:QoD7TyhkAvtjEy2qif

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 3 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.didapinche.booking
    1⤵
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4317
  • com.didapinche.booking:pushservice
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    PID:4378
  • com.didapinche.booking:remote
    1⤵
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4442

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.didapinche.booking/files/cfg/a/ResPack.rs

    Filesize

    525KB

    MD5

    3b914b0ebfb7d90aaa23047029c1c03c

    SHA1

    52c9c1b0519ac98108b9f9f232247051013009f5

    SHA256

    42af57df34872c3f7192bb4ab4a2f018dc6feb7df051aa8e9eb4dbbbe9c0e8ff

    SHA512

    4b60dbb48811efb3d9b0e4a950bd79940736c2e8692964c1da2653b139d74bd223c4ed5fddd821160dbd9a0cbaffa8b1ae5aa0f055e441fbbb536d6ae766b6bb

  • /data/user/0/com.didapinche.booking/files/cfg/a/mapstyle.sty

    Filesize

    248KB

    MD5

    46a9f9a5221dbe4ff71bfcd2ee045c5c

    SHA1

    915cb3bc2f0096dede38afc1cd7f09c8782360a9

    SHA256

    ad3067eb308a9420b727b4f24dc5134bc75b36bdda7a7a7c5651090698dd10a9

    SHA512

    185530752b639d743f99e28369f75626900420dccf598a639065ecb08c562ff98c4a1f6abbec9724d1684ed053774d60402cd2f20e3586a534c8715e7cec2ac2

  • /data/user/0/com.didapinche.booking/files/cfg/a/satellitestyle.sty

    Filesize

    166KB

    MD5

    3f1348cd6165c9a66a9892565c917ca1

    SHA1

    96f0c939438c494cf3fd89246d458e92c0c7203b

    SHA256

    5fbe3817e4047e14c40b567be4955d7579c8bf7b7824bf8370f5e194ebf9767a

    SHA512

    405c3d1d5f4899cf723509f8e293f2ca1d95a79f7892e93401309372335a6a286f2eae9ee9312f69af10c5bcabd091cd90608898a129542b0abe0617c500d023

  • /data/user/0/com.didapinche.booking/files/cfg/a/trafficstyle.sty

    Filesize

    4KB

    MD5

    6a86f30539dfc9332cd235fc48fcb62c

    SHA1

    5c202003f6346edb85175b8df7c460793f5512c6

    SHA256

    34bfd1e28c3625f50a23240c4b08ac50a90fd35c5e5f88aed1cf36fa8fe5e18f

    SHA512

    f63edb8270e6cd35e5c6896e2b9153144af0d29303e367a4fa81941b1b2bb0de57fa484badb7ec7f05ebdfa67d77b00c3651572c5f05e9314389887f5546d235

  • /data/user/0/com.didapinche.booking/files/cfg/h/DVDirectory.cfg

    Filesize

    69KB

    MD5

    cc964618151d66392da580d25a20a00c

    SHA1

    22bcf80def5a8468698aedb7c5bb3e37ab83f1fb

    SHA256

    7a4d69e0a507896a9783dfbd3e25fbf3f8a4f0c014519b2178649e101c0f64dc

    SHA512

    5f68d781906d9a4d77b401d183211819b7326a58121ee4de2f8df767ea15033913821283ec293d7b3b45238087af46c0c13806f733bfa3e30c1d23944f61b081

  • /data/user/0/com.didapinche.booking/files/cfg/h/DVHotMap.cfg

    Filesize

    28KB

    MD5

    4a5738275ba2210055579a5cb2b8f245

    SHA1

    8684e24b58caa38f49e0e3dc58722d542517020f

    SHA256

    16969d55c6f0e55c63c8e9a0c98011387ea74d1deb141cae8d781ef910a74eef

    SHA512

    768e58b37fb90f36df11e66494ad15f059bb7e0bbf7e76e17471babd8bf97d07b6c7974628a944e2f564bfb9dbb188a6192a3c03f32547eb48ea67edf2b95488

  • /data/user/0/com.didapinche.booking/files/cfg/h/DVHotcity.cfg

    Filesize

    8KB

    MD5

    a3c056084e58ede04ae5a9330871cf98

    SHA1

    457a7dc42a52906697b60d2aee7fa5f8fc5bb4f8

    SHA256

    4567de43676bfdc64ed6522788e2f6109174e28ae3840355f6e2961ab8c51e3d

    SHA512

    921f0604721190550b889abc651a40d59d47bf63b7851284f6cd17146c5dc7fd3c1489ec2d83a0003c66f537bc95126399bbe5cdea63336fd0447690ecb5cffb

  • /data/user/0/com.didapinche.booking/files/cfg/h/DVVersion.cfg

    Filesize

    8KB

    MD5

    ddd7e53ff02475b2117fe19cc54c9466

    SHA1

    66046ef0082662bbe82a1a1c1480eabbf4f264c0

    SHA256

    0da8722c19125ba25ccd927d4529cb4410cd2b690870383fd64f1b3bb3294dbd

    SHA512

    20cdf299572b310f50eb28c7fae6213fd7d00482065b0c702ae766b785feb42967ed6d8d2f4eb9ea96e30dd9c8530811100b47f94faea05cc474901e7cd72d0d

  • /data/user/0/com.didapinche.booking/files/cfg/l/DVDirectory.cfg

    Filesize

    69KB

    MD5

    65685a117c72fe8fbf5a92b07073c99e

    SHA1

    b115b527f74e4c291edcaab19b316a446aca8f5b

    SHA256

    19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8

    SHA512

    e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253

  • /data/user/0/com.didapinche.booking/files/cfg/l/DVHotMap.cfg

    Filesize

    10KB

    MD5

    d606889b89cbf6d268dba90428770a42

    SHA1

    bf63aa70ab6710fca011ca4f08441a96bbe8179c

    SHA256

    0de803351f26a1cafa39e95ed9a9424ce719c5867daf8311635603b61f8c463f

    SHA512

    1149a8a49dad287d558eb4c5e4a1a6c1d82ea115b3f9d3d9b7599f2bff5e33e46a8dcaec2f24f69db5129c5b1685b4c1193d33c7128ce47a902162f84d45f145

  • /data/user/0/com.didapinche.booking/files/cfg/l/DVHotcity.cfg

    Filesize

    1KB

    MD5

    1c6abcbbd253448057930ad1cc59ac75

    SHA1

    a5845d1c4bc87b8b4785b456d76edcb8309eda4e

    SHA256

    a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136

    SHA512

    71aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631

  • /data/user/0/com.didapinche.booking/files/cfg/l/DVVersion.cfg

    Filesize

    80KB

    MD5

    cf2cea7e9b08ffeccdad60248f536765

    SHA1

    61f97840aaf57a7d1c9ce994a5176ccfcdd7188c

    SHA256

    b761bcedaf9a60a17270a5e5b5ac7fb2d333d66a7023a105e9c07c50eae55be1

    SHA512

    c24815df7cd1dba14a84805b4684e43d6d20fbbaadcdaf8e85ac533941ff1331ff78e697c240f401e4e0386495b6f311200c28d112064efeb9785b72edc79009

  • /data/user/0/com.didapinche.booking/files/jpush_stat_cache.json

    Filesize

    1KB

    MD5

    610037449ad684c0b673644ee9a850cb

    SHA1

    a6344f521a801c81f593326da05948b7130635f9

    SHA256

    6858cc3baa71f5b067886390b75ac24105c7ba4624f59edcbe322cafd906ce87

    SHA512

    eaef02b527876ab8da2fb5caf5c2ecf3859397f4a07613a9fc6c2667170670f638953cba307b01ed352da6ea53c16c7ed63a7620b695a1dbcf1da5a01007d3b2

  • /data/user/0/com.didapinche.booking/files/lldt/firll.dat

    Filesize

    76B

    MD5

    a1e24bf05d889aadac34f13ac439c872

    SHA1

    4c9445bb8fd263695e747417b49d1d56cc9a28bf

    SHA256

    d5932357831ea0e2c441a29c2fded36422a0a3bc963c5233478b3d8071f7b054

    SHA512

    456a63c92a513e0a8c3ed46eb082c0d30066c263f475c7307ee065bbeba3177915e6c73533bb92fafbe187bc59ada26c211246d7908e68bba6c92b3865e0ac62

  • /data/user/0/com.didapinche.booking/files/ofld/ofl_location.db-journal

    Filesize

    8KB

    MD5

    6225bb44b95d17124a36422aa9ae2d51

    SHA1

    9d4ccdd975dfee92469d38e71e25bbe38a48cd97

    SHA256

    04f7424f64997bd8e0febf355deb27bccf37b02503f5f3eedc30d3dae9fa2b3b

    SHA512

    525bb4ebab53adfd00f8310ae584f30528876dbbd542390bafca43eabb6f035883a352719db98a6c22e3e11f3abdd9e19873d5fa2bf419bfcbbb82f47d8f1aa0

  • /data/user/0/com.didapinche.booking/files/ofld/ofl_location.db-journal

    Filesize

    8KB

    MD5

    35b4dc8dab8405329f4d01b7433ae746

    SHA1

    c8acff7850b6712c0323fdddd2fa15819b38b2f8

    SHA256

    3a798e8f5ecc379965f5fad112c8a5c53b589182925eab4ed34f0dd5e39adfb1

    SHA512

    25c08c65bb875cddc251acb1a9ec7394d2ab7e8da847209bd01c81500daf75c2073de58bc4a5ebb6c5dcebdfa7d7ff0dcebf6830566c6401027260dd3ed768c5

  • /data/user/0/com.didapinche.booking/files/ofld/ofl_location.db-journal

    Filesize

    512B

    MD5

    1d145596d8068b7d804ab27958c6c683

    SHA1

    0f19c2a8948f55aed50cc0a4db46cf26e4f34d5c

    SHA256

    69a3020740bb114c5f791d062e2f5861c33b8032a38e2e965d000e5e85e3021b

    SHA512

    019024be64468d8279a8d4987ca3a73e96bb50a3e57e8bd84171d21650dc379eca176878bb4779c1cb5d31c75c53d6f413d37a96cc73bf2901296f43b10e2e36

  • /data/user/0/com.didapinche.booking/files/ofld/ofl_statistics.db-journal

    Filesize

    512B

    MD5

    d1ea100b07561436c72c754d05399f23

    SHA1

    a43951a12092adbf9a0e8670e824bf77dcbb6454

    SHA256

    a2ee575af85078ecb249580d56cbc716a40f15f47b2180a48b12d906ceabea0c

    SHA512

    8597e4ddd6a7ca699ca6cfe77a2f869c65c13e171910d894acb70402b667e8d27b7e906b96c3f65321ba5f693aeb9a74b1c83160e89fac6c3c87a87c59c7fcec

  • /data/user/0/com.didapinche.booking/files/ofld/ofl_statistics.db-journal

    Filesize

    8KB

    MD5

    085caed685ea5f564ce7456c6df6822e

    SHA1

    9f96356ee1f604101ef608f09fc74e9c2602061b

    SHA256

    c633ae098d272097d79b45e4502f38e64d75ebd10f357fb1f7d3036d6c0b612f

    SHA512

    e29608c9b5e27cd403ab8aca369c7524d38a4fc0677c26a5574ef24bdc358bd41a94c2620c7789d79868e28d898de36ce135d7142e45971d2470d6462f562322

  • /data/user/0/com.didapinche.booking/files/ofld/ofl_statistics.db-journal

    Filesize

    8KB

    MD5

    ed5c0b80725d55b8c2a61b5501ae67c5

    SHA1

    09df4a7af2966fc0f9c32614ce7b5355abf9d80d

    SHA256

    675791b38f993e64af70092794add349ea599716283f7e956bf6d3a48c0b9f4d

    SHA512

    c02a7827380843d7b63d89b3e8f81867f1ec57f2d0d5642021a8ef1dd21a20854029bf91b1d87d13ada52717cff62ac08fa9721b4fdef7ebc964eb62d2afd135

  • /data/user/0/com.didapinche.booking/files/ofld/ofl_statistics.db-journal

    Filesize

    8KB

    MD5

    2985a1f7213d6861f8ef2333896ffd84

    SHA1

    f1d200a2579b4c6f81b8a30adc139610bdc90a78

    SHA256

    338bb1ccd1855c6ee48734033e8622cebc99080c62669cd19d049dd618da0fea

    SHA512

    315ce347d825540e12949b4f19d7a9bcbade054fd1699290c69b67b66dbab0aabf72d562ed81f3063eb80d4d11c5fb3e51476ef5056df3cc37f35484b6ff213d

  • /data/user/0/com.didapinche.booking/files/umeng_it.cache

    Filesize

    245B

    MD5

    ab2db2c27dd5586b42a3f70d09c62265

    SHA1

    7b63a8892a6a55ffa50501d39605d0509eb10211

    SHA256

    6a8ef2f0eebfb591075abab5c25bb78477dbff043369e575f27efa2c34f9162c

    SHA512

    049761d7a979dde7e709a408dae106bbdd77540f5e3832ba2d705a3ac74f0b01b9a1cead4e9394bde07d5cf93da14983c87ba5deaeea268939e2279ed8931ebb

  • /data/user/0/com.didapinche.booking/files/ver.dat

    Filesize

    512B

    MD5

    272d42a72c2c7a60094c4eef909039b5

    SHA1

    5331b97970e9920e46735b0de38a7334f2ad509f

    SHA256

    ebd127d1647bbcf1fecc9e6d40c69f7e439f7c6ac4a74ac674b68009d72e4745

    SHA512

    91630c3e87951a364d6738973b3318ee1ae321bb2d98a6fc9050c630325a7de75f4312d7466c1cc2c588b568104d63e8e7d5a2b21ce57ff148ef4cdb26f95efc

  • /storage/emulated/0/Android/data/com.didapinche.booking/files/MiPushLog/log1.txt

    Filesize

    3KB

    MD5

    97bd456dfffc63dfc302ac5a9155a9de

    SHA1

    1e45b4d92f5a9ec1aa671bc4ebdb149fbf310a73

    SHA256

    1ec007120bde38e6e9c67aaf046cea1a58b7672d01dfdc6a606e1540d33e8f9d

    SHA512

    0a51529ef3bc79620f7a98732286e0831beeb165645345342384516f70275fa6d222dcbf4886b6c98040f00c828fb3ec5915d4b5fd39f2e6d895974d62a6748d

  • /storage/emulated/0/Android/data/com.didapinche.booking/files/MiPushLog/log1.txt (deleted)

    Filesize

    28KB

    MD5

    f8df032b186b8daec21b955238836997

    SHA1

    6670b787d78d0391ca067ee9d89c1fc99ab248b8

    SHA256

    0eb2691193d5b1af9ae73ce1110ea204d7895f5a39d8d5155f6de13dd3d1d283

    SHA512

    97472fd05b640d30f6e8d2a722e57a1d670e77391506c54b8e55ddb6109a21acee6a74af8c5098467317fd9292460e54ddfcdcf46e44684ebe7798f7890bbfe8

  • /storage/emulated/0/Android/data/com.didapinche.booking/files/baidu/tempdata/conlts.dat

    Filesize

    159B

    MD5

    36e4469e16db97d861ca584c05cd7f7c

    SHA1

    40a34b6ac6376901cd2c0554c4048a184bae0fde

    SHA256

    a4e731b1caf257967073dc919a9bdf7cbffcea3d7a5f7d6de435621879570b43

    SHA512

    1874ad3e4ead53e556d285751dbf4b46b72f619151d073ae13edf14ab3514ff9691be83d2f2eeec2939b70dc0eb0c4fdb74e35a844054eef31093e7a118060bd

  • /storage/emulated/0/Android/data/com.didapinche.booking/files/baidu/tempdata/llg.dat

    Filesize

    442B

    MD5

    b3cae4e9b384d242f29918acaed1cf72

    SHA1

    fedd865f1f76ad359358743835451f4dbd889aab

    SHA256

    4ef88ff5e1e6d96e45b31713b46b369faab7f3466e3615ac3e9d4cd685c37f4f

    SHA512

    d9872a55989d35979429bb990a1bb7806357e0bf239fec092e7fdd97ed5705b7dd8832040e74eeafd9fa363cfb050fc26fd4886b829b01cd72825f8bc336da7a

  • /storage/emulated/0/Android/data/com.didapinche.booking/files/baidu/tempdata/llg.dat

    Filesize

    2KB

    MD5

    203f763b7355fe7324714abefb099293

    SHA1

    36cb7d31e13323c93a75248ad53b3f89472dfcc2

    SHA256

    1588d56c3aa5f782d22fb8db40f28ee07999f54825e8d8f38a958109411a1cd6

    SHA512

    05946a7c99c9b0f219ef662bc270c2ee31b65039174036e46ccf96f8da49499ebba94f9ed27619e0b1fd065f1954117967196831ac0a9c7070fdcf7d6577b023

  • /storage/emulated/0/Android/data/com.didapinche.booking/files/baidu/tempdata/llg.dat

    Filesize

    9KB

    MD5

    265b7c92d91615bad2b06e02b1521abc

    SHA1

    df4306f4d03512926182b7b214880a846438fc6c

    SHA256

    36208d23d24f88fbfa5425f555a5aa658750cff2058357a48865079a1c470b88

    SHA512

    08cc57fea96859a49737b0a42821fbdafa06fdd059e1834bb36077e1d558f06160741cb2b7df3546862455efbf9ce000a2a143a6588d11776e4f21fa82f66194

  • /storage/emulated/0/Android/data/com.didapinche.booking/files/ringtone.mp3 (deleted)

    Filesize

    32KB

    MD5

    d1f1c867f1c2525d678960e41abaaab8

    SHA1

    7053992d0128b0d3b0601b7877223732594a53da

    SHA256

    a13a99fc4c81f7e4623cb0c6e2cb62312a398bfe3dd2643f00e8d8f6e5a81e12

    SHA512

    3e96c13364badc187f1b9e6cf79ef2b1fe9bb94e4c335879f3baf676da568500c6c589cbb6fbebd8afd8b86a71ca662ce1ea511e72ec184e536ec8a1aae414cc

  • /storage/emulated/0/baidu/tempdata/lcvif.dat

    Filesize

    96B

    MD5

    643bba3f6a041a83bc8ef237d175289a

    SHA1

    33a6aaac589111bc1a1fa4240a77127407d5d864

    SHA256

    b176607ac6cd6cc21a5e52c318ffdd17a5be360f539422256bd6f4ef44d5f549

    SHA512

    c8c337ee60acae833c63550e09df4fb49e23c858d102547af3063eec6137d88ac9600ed979f4c64d708a4e019c3fad6ec980e667f3e0227ade2ba7d0c18bae8e

  • /storage/emulated/0/baidu/tempdata/ls.db-journal

    Filesize

    8KB

    MD5

    f65eeb80081ffa0c1c3c0e194e5dd50d

    SHA1

    60651f21b3f9a90f9645e980ad25fa018b27f4bc

    SHA256

    a071a7716b7b35c775dd06b06094c232b6e0a153dc453fff3cde50140159d2f6

    SHA512

    ed8ead4eeb183b1d8aec5164f29cccda179a174c500980aeae523aedf785913b698dd0663586c48b2ddee3a21eced806732f1d5f103e9e25882e31a6b6564b46

  • /storage/emulated/0/baidu/tempdata/ls.db-journal

    Filesize

    4KB

    MD5

    6606996f33565ffe3c7f4e6c32257a66

    SHA1

    ac40a462a7ed492d5b0f195d6a2b4343ba7d8720

    SHA256

    c250d338d9234dd768e97ced92a5b547af8ce235a162384036266a954da65873

    SHA512

    c500c1ccdfc74d486f94250b8a5d895fd3707dc34753effea14a9835e90da7eb7b4c4b75be24888caacda71f393c07ff9f7bb68705bfe8293cfd19c230a8271c

  • /storage/emulated/0/dida/cache/cache_1/cache_6fbbfd045ce44f13874ecb499d218455.db

    Filesize

    24B

    MD5

    161557b06b4a4d3ce095528dea370eb7

    SHA1

    8bfe9c4d916fe58d856b5a6ecaf8cd9ea4df2c9f

    SHA256

    f054ef19481234ee5b2db1d1c681839dab235a857ed3a4bc02efa8f785f478d4

    SHA512

    96ce8aedbdbb387438efc86aaabd13a6378628bfae203d2bc25ea1cd7daa6ddbd6dd2c81d631fbdc9b653a93011d3c80f0c085580275b683d5e0bce077e6e449

  • /storage/emulated/0/dida/cache/cache_2/cache_140c1f12feeb2c52dfbeb2da6066a73a.db

    Filesize

    88B

    MD5

    5dc5fa34acc6df81ff87ad935be649b1

    SHA1

    397e4359d194934b270bf3cb42e58d1ddce6e1da

    SHA256

    cbf6e87deb8adb2299214d6822397480b50d74c712fa5432b75c911dd39e5b7c

    SHA512

    012e4e32250d524da5feaa4456805d3af40ab400a417d50c970d4b6fa750d5d66c755a3efab73028d91b7d5d6fe9b43905d6a17d9a40be90aca26fa916141b85