Analysis
-
max time kernel
149s -
max time network
154s -
platform
android_x64 -
resource
android-33-x64-arm64-20240624-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system -
submitted
17-10-2024 16:09
Static task
static1
Behavioral task
behavioral1
Sample
528f837d06eeed41f47ad96a4764a574_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
528f837d06eeed41f47ad96a4764a574_JaffaCakes118.apk
Resource
android-33-x64-arm64-20240624-en
General
-
Target
528f837d06eeed41f47ad96a4764a574_JaffaCakes118.apk
-
Size
17.3MB
-
MD5
528f837d06eeed41f47ad96a4764a574
-
SHA1
9ba9372885dc1c3fb44da3d2cfe2cc86079bb4fd
-
SHA256
812a154d46d5fc703bc0b56eae32c2403038fa4c4e0086b3c85f1c8922f895ec
-
SHA512
b6be4ce593473181dac781d7ef87db567c9b6e4b8583c4c13807307927b554a24f19fc1fb00580931b43705efc296cae80be16fac95d4ad259eef7d195b5c6b3
-
SSDEEP
393216:QoTnf9Up7mFTyhmJt0pvtLuwpATWOve2bop1CLf:QoD7TyhkAvtjEy2qif
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.didapinche.booking:remote Framework service call android.app.IActivityManager.getRunningAppProcesses com.didapinche.booking Framework service call android.app.IActivityManager.getRunningAppProcesses com.didapinche.booking:pushservice -
Requests cell location 2 TTPs 2 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.didapinche.booking Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.didapinche.booking:remote -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
flow ioc 17 alog.umeng.com -
Queries information about active data network 1 TTPs 3 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.didapinche.booking Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.didapinche.booking:pushservice Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.didapinche.booking:remote -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.didapinche.booking:remote -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.didapinche.booking -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.didapinche.booking
Processes
-
com.didapinche.booking1⤵
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4317
-
com.didapinche.booking:pushservice1⤵
- Queries information about running processes on the device
- Queries information about active data network
PID:4378
-
com.didapinche.booking:remote1⤵
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4442
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
525KB
MD53b914b0ebfb7d90aaa23047029c1c03c
SHA152c9c1b0519ac98108b9f9f232247051013009f5
SHA25642af57df34872c3f7192bb4ab4a2f018dc6feb7df051aa8e9eb4dbbbe9c0e8ff
SHA5124b60dbb48811efb3d9b0e4a950bd79940736c2e8692964c1da2653b139d74bd223c4ed5fddd821160dbd9a0cbaffa8b1ae5aa0f055e441fbbb536d6ae766b6bb
-
Filesize
248KB
MD546a9f9a5221dbe4ff71bfcd2ee045c5c
SHA1915cb3bc2f0096dede38afc1cd7f09c8782360a9
SHA256ad3067eb308a9420b727b4f24dc5134bc75b36bdda7a7a7c5651090698dd10a9
SHA512185530752b639d743f99e28369f75626900420dccf598a639065ecb08c562ff98c4a1f6abbec9724d1684ed053774d60402cd2f20e3586a534c8715e7cec2ac2
-
Filesize
166KB
MD53f1348cd6165c9a66a9892565c917ca1
SHA196f0c939438c494cf3fd89246d458e92c0c7203b
SHA2565fbe3817e4047e14c40b567be4955d7579c8bf7b7824bf8370f5e194ebf9767a
SHA512405c3d1d5f4899cf723509f8e293f2ca1d95a79f7892e93401309372335a6a286f2eae9ee9312f69af10c5bcabd091cd90608898a129542b0abe0617c500d023
-
Filesize
4KB
MD56a86f30539dfc9332cd235fc48fcb62c
SHA15c202003f6346edb85175b8df7c460793f5512c6
SHA25634bfd1e28c3625f50a23240c4b08ac50a90fd35c5e5f88aed1cf36fa8fe5e18f
SHA512f63edb8270e6cd35e5c6896e2b9153144af0d29303e367a4fa81941b1b2bb0de57fa484badb7ec7f05ebdfa67d77b00c3651572c5f05e9314389887f5546d235
-
Filesize
69KB
MD5cc964618151d66392da580d25a20a00c
SHA122bcf80def5a8468698aedb7c5bb3e37ab83f1fb
SHA2567a4d69e0a507896a9783dfbd3e25fbf3f8a4f0c014519b2178649e101c0f64dc
SHA5125f68d781906d9a4d77b401d183211819b7326a58121ee4de2f8df767ea15033913821283ec293d7b3b45238087af46c0c13806f733bfa3e30c1d23944f61b081
-
Filesize
28KB
MD54a5738275ba2210055579a5cb2b8f245
SHA18684e24b58caa38f49e0e3dc58722d542517020f
SHA25616969d55c6f0e55c63c8e9a0c98011387ea74d1deb141cae8d781ef910a74eef
SHA512768e58b37fb90f36df11e66494ad15f059bb7e0bbf7e76e17471babd8bf97d07b6c7974628a944e2f564bfb9dbb188a6192a3c03f32547eb48ea67edf2b95488
-
Filesize
8KB
MD5a3c056084e58ede04ae5a9330871cf98
SHA1457a7dc42a52906697b60d2aee7fa5f8fc5bb4f8
SHA2564567de43676bfdc64ed6522788e2f6109174e28ae3840355f6e2961ab8c51e3d
SHA512921f0604721190550b889abc651a40d59d47bf63b7851284f6cd17146c5dc7fd3c1489ec2d83a0003c66f537bc95126399bbe5cdea63336fd0447690ecb5cffb
-
Filesize
8KB
MD5ddd7e53ff02475b2117fe19cc54c9466
SHA166046ef0082662bbe82a1a1c1480eabbf4f264c0
SHA2560da8722c19125ba25ccd927d4529cb4410cd2b690870383fd64f1b3bb3294dbd
SHA51220cdf299572b310f50eb28c7fae6213fd7d00482065b0c702ae766b785feb42967ed6d8d2f4eb9ea96e30dd9c8530811100b47f94faea05cc474901e7cd72d0d
-
Filesize
69KB
MD565685a117c72fe8fbf5a92b07073c99e
SHA1b115b527f74e4c291edcaab19b316a446aca8f5b
SHA25619bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8
SHA512e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253
-
Filesize
10KB
MD5d606889b89cbf6d268dba90428770a42
SHA1bf63aa70ab6710fca011ca4f08441a96bbe8179c
SHA2560de803351f26a1cafa39e95ed9a9424ce719c5867daf8311635603b61f8c463f
SHA5121149a8a49dad287d558eb4c5e4a1a6c1d82ea115b3f9d3d9b7599f2bff5e33e46a8dcaec2f24f69db5129c5b1685b4c1193d33c7128ce47a902162f84d45f145
-
Filesize
1KB
MD51c6abcbbd253448057930ad1cc59ac75
SHA1a5845d1c4bc87b8b4785b456d76edcb8309eda4e
SHA256a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136
SHA51271aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631
-
Filesize
80KB
MD5cf2cea7e9b08ffeccdad60248f536765
SHA161f97840aaf57a7d1c9ce994a5176ccfcdd7188c
SHA256b761bcedaf9a60a17270a5e5b5ac7fb2d333d66a7023a105e9c07c50eae55be1
SHA512c24815df7cd1dba14a84805b4684e43d6d20fbbaadcdaf8e85ac533941ff1331ff78e697c240f401e4e0386495b6f311200c28d112064efeb9785b72edc79009
-
Filesize
1KB
MD5610037449ad684c0b673644ee9a850cb
SHA1a6344f521a801c81f593326da05948b7130635f9
SHA2566858cc3baa71f5b067886390b75ac24105c7ba4624f59edcbe322cafd906ce87
SHA512eaef02b527876ab8da2fb5caf5c2ecf3859397f4a07613a9fc6c2667170670f638953cba307b01ed352da6ea53c16c7ed63a7620b695a1dbcf1da5a01007d3b2
-
Filesize
76B
MD5a1e24bf05d889aadac34f13ac439c872
SHA14c9445bb8fd263695e747417b49d1d56cc9a28bf
SHA256d5932357831ea0e2c441a29c2fded36422a0a3bc963c5233478b3d8071f7b054
SHA512456a63c92a513e0a8c3ed46eb082c0d30066c263f475c7307ee065bbeba3177915e6c73533bb92fafbe187bc59ada26c211246d7908e68bba6c92b3865e0ac62
-
Filesize
8KB
MD56225bb44b95d17124a36422aa9ae2d51
SHA19d4ccdd975dfee92469d38e71e25bbe38a48cd97
SHA25604f7424f64997bd8e0febf355deb27bccf37b02503f5f3eedc30d3dae9fa2b3b
SHA512525bb4ebab53adfd00f8310ae584f30528876dbbd542390bafca43eabb6f035883a352719db98a6c22e3e11f3abdd9e19873d5fa2bf419bfcbbb82f47d8f1aa0
-
Filesize
8KB
MD535b4dc8dab8405329f4d01b7433ae746
SHA1c8acff7850b6712c0323fdddd2fa15819b38b2f8
SHA2563a798e8f5ecc379965f5fad112c8a5c53b589182925eab4ed34f0dd5e39adfb1
SHA51225c08c65bb875cddc251acb1a9ec7394d2ab7e8da847209bd01c81500daf75c2073de58bc4a5ebb6c5dcebdfa7d7ff0dcebf6830566c6401027260dd3ed768c5
-
Filesize
512B
MD51d145596d8068b7d804ab27958c6c683
SHA10f19c2a8948f55aed50cc0a4db46cf26e4f34d5c
SHA25669a3020740bb114c5f791d062e2f5861c33b8032a38e2e965d000e5e85e3021b
SHA512019024be64468d8279a8d4987ca3a73e96bb50a3e57e8bd84171d21650dc379eca176878bb4779c1cb5d31c75c53d6f413d37a96cc73bf2901296f43b10e2e36
-
Filesize
512B
MD5d1ea100b07561436c72c754d05399f23
SHA1a43951a12092adbf9a0e8670e824bf77dcbb6454
SHA256a2ee575af85078ecb249580d56cbc716a40f15f47b2180a48b12d906ceabea0c
SHA5128597e4ddd6a7ca699ca6cfe77a2f869c65c13e171910d894acb70402b667e8d27b7e906b96c3f65321ba5f693aeb9a74b1c83160e89fac6c3c87a87c59c7fcec
-
Filesize
8KB
MD5085caed685ea5f564ce7456c6df6822e
SHA19f96356ee1f604101ef608f09fc74e9c2602061b
SHA256c633ae098d272097d79b45e4502f38e64d75ebd10f357fb1f7d3036d6c0b612f
SHA512e29608c9b5e27cd403ab8aca369c7524d38a4fc0677c26a5574ef24bdc358bd41a94c2620c7789d79868e28d898de36ce135d7142e45971d2470d6462f562322
-
Filesize
8KB
MD5ed5c0b80725d55b8c2a61b5501ae67c5
SHA109df4a7af2966fc0f9c32614ce7b5355abf9d80d
SHA256675791b38f993e64af70092794add349ea599716283f7e956bf6d3a48c0b9f4d
SHA512c02a7827380843d7b63d89b3e8f81867f1ec57f2d0d5642021a8ef1dd21a20854029bf91b1d87d13ada52717cff62ac08fa9721b4fdef7ebc964eb62d2afd135
-
Filesize
8KB
MD52985a1f7213d6861f8ef2333896ffd84
SHA1f1d200a2579b4c6f81b8a30adc139610bdc90a78
SHA256338bb1ccd1855c6ee48734033e8622cebc99080c62669cd19d049dd618da0fea
SHA512315ce347d825540e12949b4f19d7a9bcbade054fd1699290c69b67b66dbab0aabf72d562ed81f3063eb80d4d11c5fb3e51476ef5056df3cc37f35484b6ff213d
-
Filesize
245B
MD5ab2db2c27dd5586b42a3f70d09c62265
SHA17b63a8892a6a55ffa50501d39605d0509eb10211
SHA2566a8ef2f0eebfb591075abab5c25bb78477dbff043369e575f27efa2c34f9162c
SHA512049761d7a979dde7e709a408dae106bbdd77540f5e3832ba2d705a3ac74f0b01b9a1cead4e9394bde07d5cf93da14983c87ba5deaeea268939e2279ed8931ebb
-
Filesize
512B
MD5272d42a72c2c7a60094c4eef909039b5
SHA15331b97970e9920e46735b0de38a7334f2ad509f
SHA256ebd127d1647bbcf1fecc9e6d40c69f7e439f7c6ac4a74ac674b68009d72e4745
SHA51291630c3e87951a364d6738973b3318ee1ae321bb2d98a6fc9050c630325a7de75f4312d7466c1cc2c588b568104d63e8e7d5a2b21ce57ff148ef4cdb26f95efc
-
Filesize
3KB
MD597bd456dfffc63dfc302ac5a9155a9de
SHA11e45b4d92f5a9ec1aa671bc4ebdb149fbf310a73
SHA2561ec007120bde38e6e9c67aaf046cea1a58b7672d01dfdc6a606e1540d33e8f9d
SHA5120a51529ef3bc79620f7a98732286e0831beeb165645345342384516f70275fa6d222dcbf4886b6c98040f00c828fb3ec5915d4b5fd39f2e6d895974d62a6748d
-
Filesize
28KB
MD5f8df032b186b8daec21b955238836997
SHA16670b787d78d0391ca067ee9d89c1fc99ab248b8
SHA2560eb2691193d5b1af9ae73ce1110ea204d7895f5a39d8d5155f6de13dd3d1d283
SHA51297472fd05b640d30f6e8d2a722e57a1d670e77391506c54b8e55ddb6109a21acee6a74af8c5098467317fd9292460e54ddfcdcf46e44684ebe7798f7890bbfe8
-
Filesize
159B
MD536e4469e16db97d861ca584c05cd7f7c
SHA140a34b6ac6376901cd2c0554c4048a184bae0fde
SHA256a4e731b1caf257967073dc919a9bdf7cbffcea3d7a5f7d6de435621879570b43
SHA5121874ad3e4ead53e556d285751dbf4b46b72f619151d073ae13edf14ab3514ff9691be83d2f2eeec2939b70dc0eb0c4fdb74e35a844054eef31093e7a118060bd
-
Filesize
442B
MD5b3cae4e9b384d242f29918acaed1cf72
SHA1fedd865f1f76ad359358743835451f4dbd889aab
SHA2564ef88ff5e1e6d96e45b31713b46b369faab7f3466e3615ac3e9d4cd685c37f4f
SHA512d9872a55989d35979429bb990a1bb7806357e0bf239fec092e7fdd97ed5705b7dd8832040e74eeafd9fa363cfb050fc26fd4886b829b01cd72825f8bc336da7a
-
Filesize
2KB
MD5203f763b7355fe7324714abefb099293
SHA136cb7d31e13323c93a75248ad53b3f89472dfcc2
SHA2561588d56c3aa5f782d22fb8db40f28ee07999f54825e8d8f38a958109411a1cd6
SHA51205946a7c99c9b0f219ef662bc270c2ee31b65039174036e46ccf96f8da49499ebba94f9ed27619e0b1fd065f1954117967196831ac0a9c7070fdcf7d6577b023
-
Filesize
9KB
MD5265b7c92d91615bad2b06e02b1521abc
SHA1df4306f4d03512926182b7b214880a846438fc6c
SHA25636208d23d24f88fbfa5425f555a5aa658750cff2058357a48865079a1c470b88
SHA51208cc57fea96859a49737b0a42821fbdafa06fdd059e1834bb36077e1d558f06160741cb2b7df3546862455efbf9ce000a2a143a6588d11776e4f21fa82f66194
-
Filesize
32KB
MD5d1f1c867f1c2525d678960e41abaaab8
SHA17053992d0128b0d3b0601b7877223732594a53da
SHA256a13a99fc4c81f7e4623cb0c6e2cb62312a398bfe3dd2643f00e8d8f6e5a81e12
SHA5123e96c13364badc187f1b9e6cf79ef2b1fe9bb94e4c335879f3baf676da568500c6c589cbb6fbebd8afd8b86a71ca662ce1ea511e72ec184e536ec8a1aae414cc
-
Filesize
96B
MD5643bba3f6a041a83bc8ef237d175289a
SHA133a6aaac589111bc1a1fa4240a77127407d5d864
SHA256b176607ac6cd6cc21a5e52c318ffdd17a5be360f539422256bd6f4ef44d5f549
SHA512c8c337ee60acae833c63550e09df4fb49e23c858d102547af3063eec6137d88ac9600ed979f4c64d708a4e019c3fad6ec980e667f3e0227ade2ba7d0c18bae8e
-
Filesize
8KB
MD5f65eeb80081ffa0c1c3c0e194e5dd50d
SHA160651f21b3f9a90f9645e980ad25fa018b27f4bc
SHA256a071a7716b7b35c775dd06b06094c232b6e0a153dc453fff3cde50140159d2f6
SHA512ed8ead4eeb183b1d8aec5164f29cccda179a174c500980aeae523aedf785913b698dd0663586c48b2ddee3a21eced806732f1d5f103e9e25882e31a6b6564b46
-
Filesize
4KB
MD56606996f33565ffe3c7f4e6c32257a66
SHA1ac40a462a7ed492d5b0f195d6a2b4343ba7d8720
SHA256c250d338d9234dd768e97ced92a5b547af8ce235a162384036266a954da65873
SHA512c500c1ccdfc74d486f94250b8a5d895fd3707dc34753effea14a9835e90da7eb7b4c4b75be24888caacda71f393c07ff9f7bb68705bfe8293cfd19c230a8271c
-
Filesize
24B
MD5161557b06b4a4d3ce095528dea370eb7
SHA18bfe9c4d916fe58d856b5a6ecaf8cd9ea4df2c9f
SHA256f054ef19481234ee5b2db1d1c681839dab235a857ed3a4bc02efa8f785f478d4
SHA51296ce8aedbdbb387438efc86aaabd13a6378628bfae203d2bc25ea1cd7daa6ddbd6dd2c81d631fbdc9b653a93011d3c80f0c085580275b683d5e0bce077e6e449
-
Filesize
88B
MD55dc5fa34acc6df81ff87ad935be649b1
SHA1397e4359d194934b270bf3cb42e58d1ddce6e1da
SHA256cbf6e87deb8adb2299214d6822397480b50d74c712fa5432b75c911dd39e5b7c
SHA512012e4e32250d524da5feaa4456805d3af40ab400a417d50c970d4b6fa750d5d66c755a3efab73028d91b7d5d6fe9b43905d6a17d9a40be90aca26fa916141b85