jaffacakes118_base[.]apk

General

Target
jaffacakes118_base.apk
Size 2.9MB
Sample261006-jsnp3adh43
SHA256 7303761333f194d788b03943404c409e4a6c167e5c633055ba9bdefb6c3f730b
MD5 58d8fdd7e2e102b2c7b5429b2075de61
SHA1 87f34c4477c290f9742e14f02e75a034afd07c5c
SHA512 1870f00da32d2b7f4db69af6d5b2e682ae9bbcd0fc6cb4d0c29a57a3ae40910842ab1da422b2b6407131f65cdc51c595bac0f25ceb4b54ceef7d571389dce0aa
SSDEEP 49152:fRtk4PA1LWb5aCcMtmxVXqLjlEMVx47gqEqmC2ViKWoqiA6K6SJrj4L:fRt3PA1L4a3MtWV6Ljase79FmCgiKhqO
TLSH
T1F6E51233FA66994AC5B5CF7116346636100E8C34834F635B785DBBBE27BF9E80E84684
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 16 IoCs

description	ioc
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows the app to answer an incoming phone call.	android.permission.ANSWER_PHONE_CALLS
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_base.apk

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_base.apk

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_base.apk

File Explorer

jaffacakes118_base.apk

.apk 2.9MB

jaffacakes118_base.apk

SHA256 7303761333f194d788b03943404c409e4a6c167e5c633055ba9bdefb6c3f730b
MD5 58d8fdd7e2e102b2c7b5429b2075de61
SHA1 87f34c4477c290f9742e14f02e75a034afd07c5c
SHA512 1870f00da32d2b7f4db69af6d5b2e682ae9bbcd0fc6cb4d0c29a57a3ae40910842ab1da422b2b6407131f65cdc51c595bac0f25ceb4b54ceef7d571389dce0aa
SSDEEP 49152:fRtk4PA1LWb5aCcMtmxVXqLjlEMVx47gqEqmC2ViKWoqiA6K6SJrj4L:fRt3PA1L4a3MtWV6Ljase79FmCgiKhqO
TLSH
T1F6E51233FA66994AC5B5CF7116346636100E8C34834F635B785DBBBE27BF9E80E84684
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

3d8e2dc126621962e328d537260dfaa8338c44ab

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Kids Safety 10-12-2022 08:10:02,OU=Kids Safety 10-12-2022 08:10:02,O=Android Monitoring,C=IL

Chains

Jan 1, 0001

com.oxesirqx.dzidsfzx

Android Permissions

jaffacakes118_base.apk

Permissions

com.oslxurqn.vlahxvac.permission.C2D_MESSAGE

android.permission.READ_CONTACTS

android.permission.READ_SMS

android.permission.CALL_PHONE

android.permission.READ_PHONE_STATE

android.permission.ANSWER_PHONE_CALLS

android.permission.PROCESS_OUTGOING_CALLS

android.permission.READ_LOGS

android.permission.READ_CALL_LOG

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.SDCARD_WRITE

android.permission.INTERNET

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_CALENDAR

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.RECORD_AUDIO

android.permission.CAMERA

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.GET_TASKS

android.permission.BIND_DEVICE_ADMIN

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_SUPERUSER

android.permission.SYSTEM_ALERT_WINDOW

android.permission.PACKAGE_USAGE_STATS

android.permission.USES_POLICY_WIPE_DATA

android.permission.BLUETOOTH_ADMIN

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

com.oxesirqx.dzidsfzx.permission.C2D_MESSAGE

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_base.apk

File Signature issue

com.oslxurqn.vlahxvac.dLJHGCwzLx

com.oSvJgiCyTqqxfHwEgRyq.UMEbqfgNGeOOmJkoE.EzmIcXRbMPLw

com.jvxGoxVPOfrK.OuBIzBOINQvT.wCbUvXSmcmUi

com.CmcclGXZbMtEPQEwAcc.kWzEfRRCndfT.xuiJsMsgkT

com.jYMwOqNeFNJh.vVtcGGZwIzjQfXjGvC.rdcHZMUcRToJTCUnekh

com.MKXhKGBAlW.HAZdBcNuHdo.kJBuIUHIBufFgMRVY

com.CNqjmonDyMcVRk.VXwTypiyUsHGzIfOQ.zRFsIpIHwLPkiNIQSv

com.oslxurqn.vlahxvac.JElMIbvKAU

com.oslxurqn.vlahxvac.rKDfPwtLkA

com.oslxurqn.vlahxvac.epomdiaulr.tLzSmCNbXO

com.oslxurqn.vlahxvac.core.eLrtVsCECS

com.oslxurqn.vlahxvac.core.HecSrasdRb

com.oslxurqn.vlahxvac.WfXqLJiLeW

com.oslxurqn.vlahxvac.TEjTWvfGyQ

com.oslxurqn.vlahxvac.yFfifPFMtI

com.oslxurqn.vlahxvac.NfkxAMBcET

com.oslxurqn.vlahxvac.ZgVvLqhbRo

org.appspot.apprtc.HYZhIFLhNc

com.oslxurqn.vlahxvac.bIZoBzTTzS

com.google.android.gms.common.api.GoogleApiActivity

com.google.firebase.messaging.FirebaseMessagingService

com.duqIgmtCLzYfDgIWpRuQ.sBvJZMCipOnd.nRkqtSMPKWM

com.IvXXMHRwtgxeO.ivuYmOcmphnT.FFCToeuKdquqrOGTHz

com.XlmNlfpygxpFbGY.DCxRYOmIhUuIQQ.PsTZESMuBQZp

com.oslxurqn.vlahxvac.core.rWVDJrMiRf

com.oslxurqn.vlahxvac.core.ozOaaqVFNm

com.oslxurqn.vlahxvac.securechannel.BCuVRUpeRX

com.google.firebase.iid.FirebaseInstanceIdService

com.oslxurqn.vlahxvac.fZgDArvajr

com.oslxurqn.vlahxvac.dPgOuOpYRf

com.oslxurqn.vlahxvac.core.listener.HngvykIwYE

com.oslxurqn.vlahxvac.core.listener.XoqVpWIpgY

com.oslxurqn.vlahxvac.util.cBAdXNQTKB

com.oslxurqn.vlahxvac.core.listener.qIsCdRCkPK

com.QBScRUNyciI.jWGQlgmRGYuMZMO.JqSJpXajvLmqR

com.nCvWJaDgpSk.qViWItSIyhGxTTnYvJs.IFgXOPypsGxMejxcNkhq

com.oslxurqn.vlahxvac.core.XlCrhrKnfZ

com.oslxurqn.vlahxvac.core.xmTsZrRQFk

com.oslxurqn.vlahxvac.core.tzdHdvwgLY

com.oslxurqn.vlahxvac.ZKZLIXUnrg

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.oslxurqn.vlahxvac.core.HvsPMWUTHL

com.google.firebase.provider.FirebaseInitProvider

Android Permissions

jaffacakes118_base.apk