2bada6ba786f32af4f310c52c836782949efea6f29fe8931f0615b7c4ff64edd

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Dowgin.i.apk
Size 3.2MB
Sample261015-dba5raev9t
SHA256 2bada6ba786f32af4f310c52c836782949efea6f29fe8931f0615b7c4ff64edd
MD5 fe27959bcd82e3508df54347eaf1c8d5
SHA1 1f8e537cfb59b6e371733bef5e52fdb2496ebe97
SHA512 f299ae5311473a6ae3b0f56dd186f1b149621f3994cde086cc6e0a9989797b047f2bd79a9a89557f96dd42a6f530be9c5edf7fb3987677e566664f5a50270490
SSDEEP 98304:3ijBkkvkuJSHix6eBMcaTnG+Vgxcn4sEC/7g6sBSqZ/:SlV8uQCxbSG+AATg5XZ/
TLSH
T117E51286F366B816C4F7C23A92B56372711DCC558787FB9F0688B7782AFB4D84904AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
8	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cameraapp.secreteye

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cameraapp.secreteye

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Hides multimedia files using a .nomedia file 1 TTPs
Android's media scanner ignores any directory that contains a .nomedia file. This hides your photos, videos, and audio from the gallery and other apps.
defense_evasion

Conceal Multimedia Files
T1628.003

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cameraapp.secreteye

com.cameraapp.secreteye
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:5116

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1628

Conceal Multimedia Files

1

T1628.003

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.imprint

Path /data/data/com.cameraapp.secreteye/files/.imprint
Size 771B
SHA256 c6bff3ac37ddb7416c0dbcc100e6bccccc48d85765a1e566269558cae69020eb
MD5 3aa7c8ed4e622d1097541f67650104f0
SHA1 80d08ccfefa677feba9f4a65c4a08d3d258444ac
SHA512 eb3f4d082e935610515454b74443408fc1deb5b912208cec06b2da87697805678826641f8d3a35053fb8d174691ea549c9d30025dc71553cebfb8602aca7d991
TLSH
T13801B8BA1490FDD2E49FD22B056A661B573455F6CDC12C88137BE0EB476A039FB60C0A
MD5 SHA1 SHA512 TLSH

Submit Download

gaClientId

Path /data/data/com.cameraapp.secreteye/files/gaClientId
Size 36B
SHA256 d86fd75564cd6c72f880fc1aa2d1c06c5e98b904a8b4cc68d2501fbe1de358d6
MD5 79ac62d696b0c8e694cd866c7727edf6
SHA1 b4586e27b129511ca41f8756d499c9f9eb0f5601
SHA512 9890da2101643bb4ccff0dc18c728ca4c5ac1c946b9ac04f7bdfbdf35bd5252a2d721d69cd495c9e714bf1706b9612461aca0b61ee8c3149cae308e1b36035da
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.cameraapp.secreteye2015032208

Path /data/data/com.cameraapp.secreteye/files/mobclick_agent_cached_com.cameraapp.secreteye2015032208
Size 4KB
SHA256 20618caed416d7a145f8f572d127a9266cf44684f253df707e7048dea7d4dfc9
MD5 c9b44c65e1abba77749ea09b50d32b11
SHA1 6f9356901b1ee724291f834ff28cc0cb4a7d55eb
SHA512 0194ec88da96b52f674502434db838a0eb21d0efbfd8786d08459cd1b8df478ea7b0e913fc3f430bddab219669ac3fef0d9dc7c5a5916968bb7bfb294324d13e
SSDEEP 96:HMOumuZuWDPMEc1DfLdy5c1DfLdyc1Mc1+c1uvcNOyZB8VZ2Z/ZcZVnKvQsqWaia:sOumAtPMb7Z7PDNjkYRKVwTVExx
TLSH
T113A1FEEE47302A63831D542BB82C27092F51D3FBF0E38BE5991654D773B640DA2D4E85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umeng_it.cache

Path /data/data/com.cameraapp.secreteye/files/umeng_it.cache
Size 148B
SHA256 221fdf8026bf9fa340d74aed9f2ba3481011540c575d288fbe40b03003255c9f
MD5 822bb30544b0050baf6cf9680cb3caff
SHA1 5c92d7789becfe389fdb3f8a5891749fa5db888c
SHA512 070f200fa7270d40e0d41e89fd59b55e1113f913f3765d4036e3fd87fd5a6f1ff8ae2c34497d41f79b1ec79413d70a5d8fc8f8ba798f4d4dd1cca0edfc1b372f
TLSH
T114C04C1EB7743414D55670B260967727BA21EF0141F206CA7515C1DC2934F07ED599C7
MD5 SHA1 SHA512 TLSH

Submit Download

umeng_it.cache

Path /data/data/com.cameraapp.secreteye/files/umeng_it.cache
Size 76B
SHA256 ed86d54940c02d1d35116a86bc7398f8aa9b104f7c5cc7bfcc683cff67dcad6b
MD5 6eef4f6b518fca41c83aeb95f1b434c7
SHA1 a037853cc25aaa3380f5ab05275e074d19d3999e
SHA512 65f80dd0287481f1921d9fe33880d09f2a0c7df0432593f7028edc4836c430d4c078bdd5fbf3b253d57591e37e2bfdbe6b0e328eff14f9ee1d2342e1282897bf
TLSH
T136A0112AA3302000C80230B220823323BA20EE0000F2028AB00080EC2A38A02C808883
MD5 SHA1 SHA512 TLSH

Submit Download

journal.tmp

Path /storage/emulated/0/Android/data/com.cameraapp.secreteye/cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads