b6201880b8dcc9763269bb47e16f74e897e714c5c3322b14b84c007e7b8813e3

Analysis

max time kernel
150s
max time network
158s
platform
android_x64
resource
android-x64-20240506-en
resource tags

androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system
submitted
08/05/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2384a8df754edd0bb50e80e9419347f3_JaffaCakes118.apk
Size 1.3MB
Sample240508-grvqwagh47
SHA256 b6201880b8dcc9763269bb47e16f74e897e714c5c3322b14b84c007e7b8813e3
MD5 2384a8df754edd0bb50e80e9419347f3
SHA1 30ef0c3e7b388929ddb3893e2ace6602123cd8c2
SHA512 50621c94712e7c88cd321c1b84b0a12d01877600b9b4c30a8474d94d5851a23685fc0020aaa6a7ff5fc2609ae10103fea2629441bf218f2776596a2fb97fdfb9
SSDEEP 24576:nRKtoL0otaYtXMsq9sDU0YIVWerxRMjvo+CkjmRaq/13tdHbZKm51Ob83p:n7Q7Yttq94UoWoDMjTDjmRaq/1XHNKmB
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5046	com.vgaw.nsja.mong

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.vgaw.nsja.mong

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.vgaw.nsja.mong/app_mjf/dz.jar	5046	com.vgaw.nsja.mong
/data/user/0/com.vgaw.nsja.mong/app_mjf/dz.jar	5125	com.vgaw.nsja.mong:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.vgaw.nsja.mong

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.vgaw.nsja.mong

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.vgaw.nsja.mong

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.vgaw.nsja.mong

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.vgaw.nsja.mong

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.vgaw.nsja.mong
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5046

com.vgaw.nsja.mong:daemon
1⤵
- Loads dropped Dex/Jar
PID:5125

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.vgaw.nsja.mong/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdz.jar

Path /data/data/com.vgaw.nsja.mong/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.vgaw.nsja.mong/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.vgaw.nsja.mong/databases/lezzd-journal
Size 8KB
SHA256 975b16223694053032e686a392256fa25014c41773456e164e8cf2f75d285c07
MD5 0658f833048eb7bca6448170fb9bb15b
SHA1 7cc2c4fdf21118fcd8753a4099230f827077e489
SHA512 4d0285452c8a36b4d5c36fccb29597a100554e45bb21a3508ae61d72569e7ae55d2ff9a8afe28a05457bade53c764508287048eed378779202bdbc143e30c99f
SSDEEP 12:7+tXqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbq5:7+tXqLGqteszXtUku+haaL6nwyLGS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.vgaw.nsja.mong/databases/lezzd-journal
Size 512B
SHA256 41353d1803a05dff8f1ff0f777141a47580effccc329de8a78ee1e66153816b6
MD5 d2affb4c1532fc752096591e7927b2a5
SHA1 2ecfba72e08ee5f1a9326a4bba74f9bf8e614dcf
SHA512 8b8044db9f190e83c2a14a5321f16793f29d74138b8405a94836ae9c91733cdcf5f42d94c7c8f5e68c78da593083f1a60c7af2aa21d1a823700d82f180d3dbaa
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.vgaw.nsja.mong/databases/lezzd-journal
Size 8KB
SHA256 8e0833917bf749bbb385017d3433b7593fe6a90371542ea3f1ce70bbcc8cff2a
MD5 f30cde4409ce45ac21e8f00b0936b972
SHA1 ca497c57acc1e35d25f37c48e24e2e0639e4a57f
SHA512 d701eda44a5210a7f369393032c92fd28858a07451f6a4fe62dc8c6e008a3679c83b33d76966d808d116faf38966944ab3baa02b22c7491d922e381283f97078
SSDEEP 6:7+/l90nn1skg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKW:7+tjkqLiuWdwRmBEyPbl
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.vgaw.nsja.mong/databases/lezzd-journal
Size 4KB
SHA256 2b47455d25697643eb178f8c6339a1610649d94e74c5406010731df070d5a029
MD5 791636afba440f65516b738bfa16a73a
SHA1 a3775b46c4325062b7390abe70e9e6dd5e5df057
SHA512 ab7d4ea8313e78870563c354c8e0d3d9c0dfb50fb92e6123a47a0e0ae3de51910a504caea58f17adbc80a59d7ec4752c6f83473534f21cdb8927a752ce2846f3
SSDEEP 6:7+/lxPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKUl:7+t9qLJdTRmBEyPbZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.vgaw.nsja.mong/databases/lezzd-journal
Size 8KB
SHA256 f3896ccd52014daa784447feb2e15b68deea8395b68d5c2048a78cdbf7181f1b
MD5 7a547628a7813f57fcf67fe9b6bab91d
SHA1 b5a864af2a6aee53cac87384a42cec5512bd9698
SHA512 2ebc3157a75561c7907f31de7a3dffa114ba699344efe821d7753eec8b8d6a4be3a0a78b7631816b78064bd8686a5ddf9891bd27a61ff486b7bc5eebffd65d27
SSDEEP 6:7+/l9pEPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKIM/X:7+tIqLmqCRmBEyPbkX
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.vgaw.nsja.mong/databases/lezzd-journal
Size 8KB
SHA256 844a445529dcf901475249724ec57aada383a6637f3d2132b3f77c05cecaa11e
MD5 d3df7f6aa0eb7dedb13b563be9aea114
SHA1 29ac1ca7ea39f54363cddacf1c65875b6a98a02c
SHA512 0b7cdc7c11d21b8f574b54655e69fb4896bba59094737857c4fb0f849378ebc407d7bd302ea1e3499f5c85a292d0723906ad3587cf0d39ba1e30864d945c661f
SSDEEP 12:7+tCnqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbO03:7+tmqLy9yUku+haaL6nwyLGSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1715148287936.env

Path /data/data/com.vgaw.nsja.mong/files/.um/um_cache_1715148287936.env
Size 657B
SHA256 d184974805c47d689db9a3963b416f0e52b53953207911ace1de42388bb31eea
MD5 cb9e59cf2b50a5bf4830e0a914204479
SHA1 b7f8a58998b2029b8b0eeb2eaf6ad90de7a58253
SHA512 c881923ee2a21507ef7816db49f201bc28639eea15938a8dbe82515ff9b9abb98ff59afe1c9860e6c906d980fac1d5e585b1dae9c35f98054b275e032f963fbe
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.vgaw.nsja.mong/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 fd46dd421a7532791708283e018f5660d6eeaf53388797c18dae757115895c4b
MD5 2bd40dca6616920708127d9ed097940a
SHA1 c5b1056b0a9efcd2158940e4c7e21e824ef45abf
SHA512 53e6541b113e9ced8d39f1788f466704629195886a7025f17cb1ea755a64e91f906bfcf85c04353af6e999b9b0dfff882a66a1d1630f89aa1c5722c71e3075b2
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.vgaw.nsja.mong/files/umeng_it.cache
Size 352B
SHA256 c05d2f75d3d96c60e1e35ba9369869b8b0766a05752ac906d0582f5736357cac
MD5 bbb0e24cf11bb73ed1f6234d1cf35bfb
SHA1 6d0e94c21e7839ffe1b1a70582279ab445799cdc
SHA512 a5b651625cb4de6686ced49fa888489afda54b8a77057e08527ee7584f52ee5e3ed9bbd87c2f923166d3ba132df072d84c950a0a918f35926906dc180be90e4b
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.vgaw.nsja.mong/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads