Analysis
- max time kernel
149s - max time network
152s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
11/09/2026, 21:09
Behavioral task
behavioral1
Sample
jaffacakes118_61f2738d1f37de84204a1f914c92a7d0f70acc8138146cd9f614cd8845791248.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_61f2738d1f37de84204a1f914c92a7d0f70acc8138146cd9f614cd8845791248.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
jaffacakes118_61f2738d1f37de84204a1f914c92a7d0f70acc8138146cd9f614cd8845791248.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target jaffacakes118_61f2738d1f37de84204a1f914c92a7d0f70acc8138146cd9f614cd8845791248.apk
- Size 15.7MB
- Sample260911-zzfk2adf89
- SHA256 61f2738d1f37de84204a1f914c92a7d0f70acc8138146cd9f614cd8845791248
- MD5 8cd06a6a8a43086f3619fab880aaf0ba
- SHA1 3e9b2f27380e43b410c95e4d682bc52cdd38ea7a
- SHA512 27f0c159608405575004071fc3929cb25e7856546ea1ec58e2da933a2888bc8aeab050e3bfa11e6828d631a86a298cffaefafaa505f005261182542643f263e1
- SSDEEP 12288:PsZOBkzs/HtNzfN/E3p9/s4Noltpk9ktoipOxp0UOv3VcPtSTLYC:/Nzq/s4ulfk9kex0U6KC
- TLSH T1DDF6BF03F34A9CBBD8F252318D61BB29671A8CA9DB6741C38C9D3B7C5CB60C14675AE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
pid Process 4874 knowledge.focus.recognize - Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId knowledge.focus.recognize Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId knowledge.focus.recognize - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock knowledge.focus.recognize - Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS knowledge.focus.recognize - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule knowledge.focus.recognize
Processes
-
knowledge.focus.recognize1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
PID:4874
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-12.txt
- Size 45B
- SHA256 a196e815b2de1dd08ac2af8d528b253354d123fe7e71d97d4064293130ea8f94
- MD5 8c4c3280084e48f81906bf835191e2e9
- SHA1 6a7237101fe86bca811974a49b2094647ecba2a2
- SHA512 afa927de977ca2565aaa749767b99efc8e2f0d2e7f623e08eb68bc4081e3858a4a26c3688096f8a06ea6693f1e0d967941e84731972e6c7c6797a88fdbbcbb0d
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-12.txt
- Size 25B
- SHA256 2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
- MD5 ba30336bf53d54ed3c0ea69dd545de8c
- SHA1 ce99c6724c75b93b7448e2d9fac16ca702a5711f
- SHA512 eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-12.txt
- Size 296B
- SHA256 dfff4a003547fd9f1956b73ec15efba13c2b1942fe7a87969c905eb72891006e
- MD5 0a6f1fb8071f4784f57eb92e01c96543
- SHA1 c28b3a4e952019df5ac7e6be760093ff3e2f813a
- SHA512 a4e66764ce4195c3dc5ef7eda82617309e521f2adf6a28a0618b9d6f8ff506c8e198e5448763c29f5d6dc07fc80e8d90e573c6e0fc5bbec158c144b1c13722d4
- TLSH T18EE07D501B4528D7A438C195178D2901DE32611074DB612052139E03F23D76AFE58D4E
- MD5 SHA1 SHA512 TLSH
- Path /storage/emulated/0/Config/sys/apps/log/log-2026-09-12.txt
- Size 45B
- SHA256 90093f121a24a59e684e2e5d3a15616d5e1aae8e1ddd2a5d97171e6cbb42c7a4
- MD5 312c6cc3848ef6cd83e382d31e3d12a4
- SHA1 8093601fe55b403a40710939cfdf37666e1e75f3
- SHA512 be4fa79b29bd62c781d432267374f9af7ea89f0e5e921bbea7d7e2abe661dad4b1cb9d2e35a486bd10926385c8362a82211ec2ff6195a5045222d82230f7514d
- MD5 SHA1 SHA512