Overview

overview

7

Static

static

6

528f837d06...18.apk

android-9-x86

7

528f837d06...18.apk

android-13-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    17/10/2024, 16:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    528f837d06eeed41f47ad96a4764a574_JaffaCakes118.apk
  • Size 17.3MB
  • Sample241017-tmalcsxbpl
  • SHA256 812a154d46d5fc703bc0b56eae32c2403038fa4c4e0086b3c85f1c8922f895ec
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
bankercollectiondiscoveryevasionimpact

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 3 IoCs
    discovery
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.didapinche.booking
    1⤵
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4317
  • com.didapinche.booking:pushservice
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    PID:4378
  • com.didapinche.booking:remote
    1⤵
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4442

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ResPack.rs
        • Path /data/user/0/com.didapinche.booking/files/cfg/a/ResPack.rs
        • Size 525KB
        • SHA256 42af57df34872c3f7192bb4ab4a2f018dc6feb7df051aa8e9eb4dbbbe9c0e8ff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        mapstyle.sty
        • Path /data/user/0/com.didapinche.booking/files/cfg/a/mapstyle.sty
        • Size 248KB
        • SHA256 ad3067eb308a9420b727b4f24dc5134bc75b36bdda7a7a7c5651090698dd10a9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        satellitestyle.sty
        • Path /data/user/0/com.didapinche.booking/files/cfg/a/satellitestyle.sty
        • Size 166KB
        • SHA256 5fbe3817e4047e14c40b567be4955d7579c8bf7b7824bf8370f5e194ebf9767a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        trafficstyle.sty
        • Path /data/user/0/com.didapinche.booking/files/cfg/a/trafficstyle.sty
        • Size 4KB
        • SHA256 34bfd1e28c3625f50a23240c4b08ac50a90fd35c5e5f88aed1cf36fa8fe5e18f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DVDirectory.cfg
        • Path /data/user/0/com.didapinche.booking/files/cfg/h/DVDirectory.cfg
        • Size 69KB
        • SHA256 7a4d69e0a507896a9783dfbd3e25fbf3f8a4f0c014519b2178649e101c0f64dc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DVHotMap.cfg
        • Path /data/user/0/com.didapinche.booking/files/cfg/h/DVHotMap.cfg
        • Size 28KB
        • SHA256 16969d55c6f0e55c63c8e9a0c98011387ea74d1deb141cae8d781ef910a74eef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DVHotcity.cfg
        • Path /data/user/0/com.didapinche.booking/files/cfg/h/DVHotcity.cfg
        • Size 8KB
        • SHA256 4567de43676bfdc64ed6522788e2f6109174e28ae3840355f6e2961ab8c51e3d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DVVersion.cfg
        • Path /data/user/0/com.didapinche.booking/files/cfg/h/DVVersion.cfg
        • Size 8KB
        • SHA256 0da8722c19125ba25ccd927d4529cb4410cd2b690870383fd64f1b3bb3294dbd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DVDirectory.cfg
        • Path /data/user/0/com.didapinche.booking/files/cfg/l/DVDirectory.cfg
        • Size 69KB
        • SHA256 19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DVHotMap.cfg
        • Path /data/user/0/com.didapinche.booking/files/cfg/l/DVHotMap.cfg
        • Size 10KB
        • SHA256 0de803351f26a1cafa39e95ed9a9424ce719c5867daf8311635603b61f8c463f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DVHotcity.cfg
        • Path /data/user/0/com.didapinche.booking/files/cfg/l/DVHotcity.cfg
        • Size 1KB
        • SHA256 a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136
        • MD5 SHA1 SHA512
        Submit Download

        DVVersion.cfg
        • Path /data/user/0/com.didapinche.booking/files/cfg/l/DVVersion.cfg
        • Size 80KB
        • SHA256 b761bcedaf9a60a17270a5e5b5ac7fb2d333d66a7023a105e9c07c50eae55be1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        jpush_stat_cache.json
        • Path /data/user/0/com.didapinche.booking/files/jpush_stat_cache.json
        • Size 1KB
        • SHA256 6858cc3baa71f5b067886390b75ac24105c7ba4624f59edcbe322cafd906ce87
        • MD5 SHA1 SHA512
        Submit Download

        firll.dat
        • Path /data/user/0/com.didapinche.booking/files/lldt/firll.dat
        • Size 76B
        • SHA256 d5932357831ea0e2c441a29c2fded36422a0a3bc963c5233478b3d8071f7b054
        • MD5 SHA1 SHA512
        Submit Download

        ofl_location.db-journal
        • Path /data/user/0/com.didapinche.booking/files/ofld/ofl_location.db-journal
        • Size 8KB
        • SHA256 04f7424f64997bd8e0febf355deb27bccf37b02503f5f3eedc30d3dae9fa2b3b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ofl_location.db-journal
        • Path /data/user/0/com.didapinche.booking/files/ofld/ofl_location.db-journal
        • Size 8KB
        • SHA256 3a798e8f5ecc379965f5fad112c8a5c53b589182925eab4ed34f0dd5e39adfb1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ofl_location.db-journal
        • Path /data/user/0/com.didapinche.booking/files/ofld/ofl_location.db-journal
        • Size 512B
        • SHA256 69a3020740bb114c5f791d062e2f5861c33b8032a38e2e965d000e5e85e3021b
        • MD5 SHA1 SHA512
        Submit Download

        ofl_statistics.db-journal
        • Path /data/user/0/com.didapinche.booking/files/ofld/ofl_statistics.db-journal
        • Size 512B
        • SHA256 a2ee575af85078ecb249580d56cbc716a40f15f47b2180a48b12d906ceabea0c
        • MD5 SHA1 SHA512
        Submit Download

        ofl_statistics.db-journal
        • Path /data/user/0/com.didapinche.booking/files/ofld/ofl_statistics.db-journal
        • Size 8KB
        • SHA256 c633ae098d272097d79b45e4502f38e64d75ebd10f357fb1f7d3036d6c0b612f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ofl_statistics.db-journal
        • Path /data/user/0/com.didapinche.booking/files/ofld/ofl_statistics.db-journal
        • Size 8KB
        • SHA256 675791b38f993e64af70092794add349ea599716283f7e956bf6d3a48c0b9f4d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ofl_statistics.db-journal
        • Path /data/user/0/com.didapinche.booking/files/ofld/ofl_statistics.db-journal
        • Size 8KB
        • SHA256 338bb1ccd1855c6ee48734033e8622cebc99080c62669cd19d049dd618da0fea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        umeng_it.cache
        • Path /data/user/0/com.didapinche.booking/files/umeng_it.cache
        • Size 245B
        • SHA256 6a8ef2f0eebfb591075abab5c25bb78477dbff043369e575f27efa2c34f9162c
        • MD5 SHA1 SHA512
        Submit Download

        ver.dat
        • Path /data/user/0/com.didapinche.booking/files/ver.dat
        • Size 512B
        • SHA256 ebd127d1647bbcf1fecc9e6d40c69f7e439f7c6ac4a74ac674b68009d72e4745
        • MD5 SHA1 SHA512
        Submit Download

        log1.txt
        • Path /storage/emulated/0/Android/data/com.didapinche.booking/files/MiPushLog/log1.txt
        • Size 3KB
        • SHA256 1ec007120bde38e6e9c67aaf046cea1a58b7672d01dfdc6a606e1540d33e8f9d
        • MD5 SHA1 SHA512
        Submit Download

        log1.txt (deleted)
        • Path /storage/emulated/0/Android/data/com.didapinche.booking/files/MiPushLog/log1.txt (deleted)
        • Size 28KB
        • SHA256 0eb2691193d5b1af9ae73ce1110ea204d7895f5a39d8d5155f6de13dd3d1d283
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        conlts.dat
        • Path /storage/emulated/0/Android/data/com.didapinche.booking/files/baidu/tempdata/conlts.dat
        • Size 159B
        • SHA256 a4e731b1caf257967073dc919a9bdf7cbffcea3d7a5f7d6de435621879570b43
        • MD5 SHA1 SHA512
        Submit Download

        llg.dat
        • Path /storage/emulated/0/Android/data/com.didapinche.booking/files/baidu/tempdata/llg.dat
        • Size 442B
        • SHA256 4ef88ff5e1e6d96e45b31713b46b369faab7f3466e3615ac3e9d4cd685c37f4f
        • MD5 SHA1 SHA512
        Submit Download

        llg.dat
        • Path /storage/emulated/0/Android/data/com.didapinche.booking/files/baidu/tempdata/llg.dat
        • Size 2KB
        • SHA256 1588d56c3aa5f782d22fb8db40f28ee07999f54825e8d8f38a958109411a1cd6
        • MD5 SHA1 SHA512
        Submit Download

        llg.dat
        • Path /storage/emulated/0/Android/data/com.didapinche.booking/files/baidu/tempdata/llg.dat
        • Size 9KB
        • SHA256 36208d23d24f88fbfa5425f555a5aa658750cff2058357a48865079a1c470b88
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ringtone.mp3 (deleted)
        • Path /storage/emulated/0/Android/data/com.didapinche.booking/files/ringtone.mp3 (deleted)
        • Size 32KB
        • SHA256 a13a99fc4c81f7e4623cb0c6e2cb62312a398bfe3dd2643f00e8d8f6e5a81e12
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lcvif.dat
        • Path /storage/emulated/0/baidu/tempdata/lcvif.dat
        • Size 96B
        • SHA256 b176607ac6cd6cc21a5e52c318ffdd17a5be360f539422256bd6f4ef44d5f549
        • MD5 SHA1 SHA512
        Submit Download

        ls.db-journal
        • Path /storage/emulated/0/baidu/tempdata/ls.db-journal
        • Size 8KB
        • SHA256 a071a7716b7b35c775dd06b06094c232b6e0a153dc453fff3cde50140159d2f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ls.db-journal
        • Path /storage/emulated/0/baidu/tempdata/ls.db-journal
        • Size 4KB
        • SHA256 c250d338d9234dd768e97ced92a5b547af8ce235a162384036266a954da65873
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cache_6fbbfd045ce44f13874ecb499d218455.db
        • Path /storage/emulated/0/dida/cache/cache_1/cache_6fbbfd045ce44f13874ecb499d218455.db
        • Size 24B
        • SHA256 f054ef19481234ee5b2db1d1c681839dab235a857ed3a4bc02efa8f785f478d4
        • MD5 SHA1 SHA512
        Submit Download

        cache_140c1f12feeb2c52dfbeb2da6066a73a.db
        • Path /storage/emulated/0/dida/cache/cache_2/cache_140c1f12feeb2c52dfbeb2da6066a73a.db
        • Size 88B
        • SHA256 cbf6e87deb8adb2299214d6822397480b50d74c712fa5432b75c911dd39e5b7c
        • MD5 SHA1 SHA512
        Submit Download