General
- Target jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.hz.f4d4f237f6096bc56026901e40e95396
- Size 5.4MB
- Sample261015-dcxp5sc13r
- SHA256 a6e19294a385dae41d080e83cc35f504f2a6b96d8d636ee252d39dcb73bab9a5
- MD5 f4d4f237f6096bc56026901e40e95396
- SHA1 08871b850687db0d362b85b24ad7dbb73d320598
- SHA512 3db5f83c4f50a22055201efd518aa0515bae8189390644ac464694d9a40d19c51da78ce22e20a38563b0610b58b589cb18b94ebff1bb3cc561f807431d4676d7
- SSDEEP 98304:En3Pl0395CAh9crGWoEkhBhU9tZ11ARlEMM2yhNHeTsckw/HAqbKyZmF8bYKXjOQ:En3afPhq6eYBh2tZ1SzHM54TWw/HR68x
- TLSH T1954633A1B78ED85FD93794348AA5818241489E20C78EE7BB151271141CF27F9EF0DFAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.hz.apk
Resource
android-x86-arm-20260325-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.hz.apk
Resource
android-x64-arm64-20260325-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.hz.f4d4f237f6096bc56026901e40e95396
- Size 5.4MB
- SHA256 a6e19294a385dae41d080e83cc35f504f2a6b96d8d636ee252d39dcb73bab9a5
- MD5 f4d4f237f6096bc56026901e40e95396
- SHA1 08871b850687db0d362b85b24ad7dbb73d320598
- SHA512 3db5f83c4f50a22055201efd518aa0515bae8189390644ac464694d9a40d19c51da78ce22e20a38563b0610b58b589cb18b94ebff1bb3cc561f807431d4676d7
- SSDEEP 98304:En3Pl0395CAh9crGWoEkhBhU9tZ11ARlEMM2yhNHeTsckw/HAqbKyZmF8bYKXjOQ:En3afPhq6eYBh2tZ1SzHM54TWw/HR68x
- TLSH T1954633A1B78ED85FD93794348AA5818241489E20C78EE7BB151271141CF27F9EF0DFAE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2