Analysis
-
max time kernel
148s -
max time network
153s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
25-11-2024 23:07
General
-
Target
9e70048f38afc7538818be9574b91749_JaffaCakes118.apk
-
Size
636KB
-
MD5
9e70048f38afc7538818be9574b91749
-
SHA1
ad52388b5c91c024c11eb544b454b21eb5b08710
-
SHA256
c88128e20249c5df95d9e03582e4123bb401c81e04418fd5580defd4d3d68c3a
-
SHA512
075f013dba5e25bf615414ae7091f2898eccd17b0a6419a3d129d22a6982f69a8fd849d411b59c9cb7f761af842cd324b02fc9aaf1c2ee69bcf559609620d2a6
-
SSDEEP
12288:L4LUaxJLby1pXCikYPgaH9OIpleFxoMtE94vvQe6ERylTgg:b6L+/CiJPz9IiMSiydV
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Processes
-
com.xicq.fcyk.qhqr1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xicq.fcyk.qhqr/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.xicq.fcyk.qhqr/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
com.xicq.fcyk.qhqr:daemon1⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD57f1e0fe2e6a0618b6c84d48ea0586b6d
SHA1dea54fa91f9f431b85e8c4048244a1c3c4b16665
SHA2564225d0ce3922e9bfd5828c3507b26226b8f08f3b03d8fcf594dbf36835a9519e
SHA5127a9e77b9ee66c7cc5d406389c8dd4f344b02c8449cfcd581586d16ce895ed0fa77f6fc8c767c32b92e75863d8133422b4ed3057f54999c3fef031146602e5df6
-
Filesize
645B
MD58ec22e3ce0fb0bf55670158bb8a53d42
SHA179259c1ff1c1db8d5b4f37838cdda6d03c0baa95
SHA256c3f199804a05134be82e470c1ba388edd01436b7f3b82c48683843a7af535c0e
SHA512a5e576feb2dcaf3654d4bdce0db55676a517e7ffdb433d06326d143b91bd03697911a3452c004927a21d9889eb509ae4a71f3ab6a9535a46c253bca2e4238359
-
Filesize
105KB
MD5fc1eb8c18ddc0f8727b5fb5eba8ca870
SHA1af6d64fe2432bece4c523066a57f35be8f175a48
SHA2567f4e38a3ac4fae5a400648d200d8b9897dc28606722dba44c43e5582182e5fe9
SHA51225e5c0eafb925a6b3c6d9f8622b95d07fd8e63be2689859733b10ed65fa7f7e56e5453da64d9bd7bd7c3345f6c1a90a5dd34de9b0788f4ba080689758d5d4e66
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5227f77bc1a388a721e7df4004434d2e6
SHA1d621fa1bb17daadc497a20633716520a7fc37ac6
SHA2563c25ae0386038c7acf1e2f91f2563efcc6551b327382e3c5299d3a25057b914f
SHA512fd492577e2030d5576725f222d6238a4fc9474c9575d2b8454493875432a78f1f56bce85c12c6625932f8f79809af69ed187b68b5c3c2013d7f9f0a768c4a131
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
60KB
MD50d18f6899688749ebe8609cc5c86f3b3
SHA1c97021168da6a66a2c919b3b4f0fecd4fcf3309b
SHA256c8773b649f267ec88874594e5d678be2b79bd2008a7eb2fe0d298ec1eb99bf4b
SHA512e9cbcf2d215a579beb64fab47c82d79d82ffe269899ccc07fe105a1e754592079389e06e25319bcc2883d816ee16f5153cd866f2a1a2221ef88b220b2f1a699c
-
Filesize
682B
MD5c8a3a2769a06f02d3598c961e1c7cc2a
SHA122a94b7b9788b9b04e5aae35f25acdbb5681e2eb
SHA25682867562b177d3733c6bbbb6ed91d1232331c3fa38f1a61e61db4dec92f8e6db
SHA51209b12763aa8bb52d13d2f0dee10c413f07ae39c8c39004052cb420ae2fa983ab31f91c38719c7a73b1d46376630b6d0ab7d3ba4bfb180394f497aa516a90ac16
-
Filesize
162B
MD512d2f52f446de128aea6e3ee8e7000c9
SHA12d7e8e2fb964dd5d221eb611366557f8e6d0cb4d
SHA2560ca91da6d1d8c3d07b4e0ff369c3ae943825071035b5057ef5bf2eeb1a2a0363
SHA51264d082e6d63dcba0403a25604c2dc908c7d7290b656592ba928e83e985253441d854ca30f6be201132efbea3c0c241af80b517d4c7a4780d7733ab1b0218ba9b
-
Filesize
867B
MD53102a36bc5a40bf78c5d264308b47cff
SHA140eb161a47d41484b1a44764f0f4a7cb0d428881
SHA256adad0ce49c2c2364bcb82ff7cc8100b5473d9566812ee5e9d17e3bad94f46d02
SHA5120d5a5ac5fe3fddff2d0eebe3cfa0d4fa3b8fc05ac7094c6972a3a8c22d2cca0339ede68522131d2e3ffc6711f062c1b631ee49c39d52770e2716b89c117d2a46
-
Filesize
415B
MD5a3b8a4cdffe0147bad8ae2954f92919e
SHA16bbf15d2631ca08aca48542823a4804685ed1f7b
SHA256cea94a93b8edeccbe798e88c3a03af8b04e991834bcd81686fb348bc34203a04
SHA5124883916236d09853f83074678fdf7ca89c117a485a082368fa3eeabf1b5225881bb9ef8cf0432491aa6d50fa967f57b4fabb6af21b60d9f624eac1b37c1bed57
-
Filesize
249KB
MD5eb4b1f8a3354e8b5c30a253c771196ab
SHA15c721a6d50b607c91d6b900b4a21a09680f6149e
SHA256dee0215de8f0bf8acfc41aa199e605f30178a969cb5821a977e865b69773b3e2
SHA512a7ce9f9612de9c987392c28f2ded37dbe991f3b61022ac5ad797230c294606a69030182a62df3f8ce98ee50b42a4a38eda9bc297332cc4b46b3f478cae6fe1b6
-
Filesize
249KB
MD5789a4162427149dd5e519f917ead0e29
SHA1d2bd738c28ec21c0441c6daaefc206a6a76f8e1c
SHA256830643d652f95c85fa7665c202f93822b08f106cfeae9202a8a7d894292a36c0
SHA512b6a8d5c20792cea1035a7f7684bc03b3f184a0bbba3f5c322b26cc75fd50002e749882d6ac6177a93115ce93b1b3d4721f4449d2007ad700e0633a11579f7e37