Analysis
-
max time kernel
148s -
max time network
154s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
04/11/2024, 00:53
Static task
static1
Behavioral task
behavioral1
Sample
8e57f90d48211fad3d21b9e34f68406e_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
8e57f90d48211fad3d21b9e34f68406e_JaffaCakes118.apk
Resource
android-x64-20240624-en
General
-
Target
8e57f90d48211fad3d21b9e34f68406e_JaffaCakes118.apk
-
Size
1.3MB
-
MD5
8e57f90d48211fad3d21b9e34f68406e
-
SHA1
634cd3c01fdc89615e74ce772e3f9b2b69ad7cb1
-
SHA256
f2f1d992d187bd2d03bfddaa1d6365d6f38298348d25d8dc5dfb3ec8e083a779
-
SHA512
9ee20eb61f3c023ad916000c54f82549791d4f76dabcd28e9c6be56a93c22f3593a5da5b3683eae8a8c97ec8d95ec102b45eabc11451f46272eca0fb0383152f
-
SSDEEP
24576:5oL0otaYtXMj84OIIhKm5ZsG8jro+uojmVmq/13tdHbZKm51Ob83+:yQ7YtahIhKqGpjnbjmVmq/1XHNKmjbO
Malware Config
Signatures
-
pid Process 4941 com.qfry.tguu.iaxg -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.qfry.tguu.iaxg/app_mjf/dz.jar 4941 com.qfry.tguu.iaxg /data/user/0/com.qfry.tguu.iaxg/app_mjf/dz.jar 4996 com.qfry.tguu.iaxg:daemon -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.qfry.tguu.iaxg -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.qfry.tguu.iaxg -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
flow ioc 26 alog.umeng.com -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.qfry.tguu.iaxg -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.qfry.tguu.iaxg -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.qfry.tguu.iaxg -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.qfry.tguu.iaxg
Processes
-
com.qfry.tguu.iaxg1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4941
-
com.qfry.tguu.iaxg:daemon1⤵
- Loads dropped Dex/Jar
PID:4996
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD523ba0b249042b7ba33e92c0199b0ea4a
SHA199b13ee9f7307316c2337953fceed87e9942b794
SHA2561ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
SHA5120cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
-
Filesize
105KB
MD5293ea5f01e27975bed5179ba79d80eac
SHA1c5b0806a537fd1cb753e11f1a9684933317716b8
SHA2568d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
SHA512c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
-
Filesize
28KB
MD5dae68dcffc3d522a79f98ebbc3b6d457
SHA16df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA25656cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
SHA51223b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
-
Filesize
8KB
MD581ca4a114e3c78c17f8bd7f6035cdc8b
SHA15d840294975c802ee7cb11b13cf68cfea7c57f88
SHA2566d6bd896db05e0d780c9f1106643c3e54e0d2556e7cbe05722b668baa1e922fa
SHA5125636d63bf05e6cab186e869039dcdf5f339ab9bc22442b985db100fc3b703fbef83c25ca41a70a62f052840b06cd0cf8d629dbbcb18565c89a0fbebb15259e59
-
Filesize
512B
MD5c5d0389fd22bfd1a2b6c69c59e96c180
SHA1357a64c6c4f79f86f8d81f4606ea83ce274c6ea9
SHA25615462ed28e01b04df931ad15434a6d4f419b4d9b1e46d519c8700a0749d1af4a
SHA5124157f3f628065bb83f20cecfcb9155c76e982438cd7384ce9c94bfbcbf70c021d7f73b6197f373944e9dc401437d1a5720a8d5c58bf6e406a2cd7d728f88fb86
-
Filesize
8KB
MD53b9f0f7543bee7619b47eb38c9e79872
SHA1bc18af3043c65f0b9f95e1f2be93d4858e1a6e2b
SHA256989dab127d8e4caf6a4baa44066ac5c29d78f6e4265f07cb6f5c76e17b88e464
SHA51247ca58a6c7b2a42567e257ada61722662d1e4f7b95862fb449fc8025586e5b4f4a995446836ec656d3b2ece0d7f0d88b319bf2b1ff1f54202141a808db8c90e7
-
Filesize
4KB
MD592db2711e394a3c0e05b3a9aca164f3b
SHA10047f46d260bd0a96c172b53e3d0f1cca8a35ff5
SHA256bd36cb9288c811cd3b233e1542b0f394ad9eecb16f6a17e14f342ba25376044a
SHA5122387b83dcbc7483d44ef32996fde0759f036aa915008f9ec0528038a8ddc0c0aed35e5c70a42f0a3deb15f11fd8aee4f7db17f2faedc029ed09c95c882cd42fa
-
Filesize
8KB
MD54d337c1b8123e67905c5b1cd8c40bde2
SHA1289c212f29bf71cee2c464b86670e1312516d73b
SHA256bcf4cedbfc950badb71e5d1720eddcb2fc5cac085a7f35fcb6c97445953e79db
SHA51217e2af269d4580486c5f1629faf592ea829288555b5dc2d3a042cfcb7917d658a5c0c2d85105a517f66d6f28a71213b0bc8744bdc5b76807014a4281e78c1b1f
-
Filesize
8KB
MD51b6b457f1db6f2346a51630f76bde747
SHA10490a5688cefad199ec4f9ce128d9ce10a466c2c
SHA256c9d70f1223c5586547d962492fc57f37a46cee5dcba2fa59ff013494ab969f39
SHA5123d986672fd1d00b7acc3fc4c687a5381c067dc5fe3adfa13b594c4887a1366de1f5e1d12bc430db2c39c5ec0292db843c6427ce6113f07c47152f9faef1e6b8d
-
Filesize
654B
MD5fcb52bf5e94ee8fa27d124026d123050
SHA1171462143c32edea911fc7d38775c7141d3eb75e
SHA25629622debe1edb0cdb0d7c62fb80630ab3dd8110b34fac1c31ed07b39dca56b01
SHA512f16b955b941b77a50e7e1e8e4b2e7ffc9fe7ddacbacbca1b24191d43d3962b883e01aaeb4b23ab4ab5dd5475de5663566373522bb7a7095ccc0c9e275247c082
-
Filesize
162B
MD51ec2905cf056bf82023245c8b77dcb37
SHA1b02ad143c24717b6534858cdbaf8afde1dc32533
SHA256940c26c54065d9813a9d2d41e12423f33ac4a532f8f05ecd3f10dd6a732a16d1
SHA512b7681c20fd22cbff41b6ca235d75f4382c88429edec64d08684c3fce8272a248a44eebe1d4bc6866222201985b80dbaa3d418315bfa8a25ef41a7e0dccb82379
-
Filesize
352B
MD54e8d162d536908522de46a9fc4cac5a3
SHA135dc26a4ece09498be4f47206142dd8957e36e20
SHA2561bd6f9a5c1c244ad4ae29bad420e7881dcc8acf3896f7834a4b0e0bb74bb9212
SHA512128482e460d11f44014f6d87a9236a5774578a02c76873ce2a052afc2f9f41676a7f8b7f978aa5f38671b29a7a7fa390808b29932fbe62b3f41d0595594313a8
-
Filesize
248KB
MD5a54a18b58c6720991c021f433dfb2a46
SHA1d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA2563dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
SHA512e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc