b6201880b8dcc9763269bb47e16f74e897e714c5c3322b14b84c007e7b8813e3

Analysis

max time kernel
151s
max time network
158s
platform
android_x64
resource
android-x64-arm64-20240506-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system
submitted
08/05/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2384a8df754edd0bb50e80e9419347f3_JaffaCakes118.apk
Size 1.3MB
Sample240508-grvqwagh47
SHA256 b6201880b8dcc9763269bb47e16f74e897e714c5c3322b14b84c007e7b8813e3
MD5 2384a8df754edd0bb50e80e9419347f3
SHA1 30ef0c3e7b388929ddb3893e2ace6602123cd8c2
SHA512 50621c94712e7c88cd321c1b84b0a12d01877600b9b4c30a8474d94d5851a23685fc0020aaa6a7ff5fc2609ae10103fea2629441bf218f2776596a2fb97fdfb9
SSDEEP 24576:nRKtoL0otaYtXMsq9sDU0YIVWerxRMjvo+CkjmRaq/13tdHbZKm51Ob83p:n7Q7Yttq94UoWoDMjTDjmRaq/1XHNKmB
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4781	com.vgaw.nsja.mong

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.vgaw.nsja.mong

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.vgaw.nsja.mong/app_mjf/dz.jar	4781	com.vgaw.nsja.mong
/data/user/0/com.vgaw.nsja.mong/app_mjf/dz.jar	4843	com.vgaw.nsja.mong:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.vgaw.nsja.mong

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.vgaw.nsja.mong

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.vgaw.nsja.mong

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.vgaw.nsja.mong

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.vgaw.nsja.mong
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4781

com.vgaw.nsja.mong:daemon
1⤵
- Loads dropped Dex/Jar
PID:4843

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/user/0/com.vgaw.nsja.mong/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar

Path /data/user/0/com.vgaw.nsja.mong/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

tdz.jar

Path /data/user/0/com.vgaw.nsja.mong/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/user/0/com.vgaw.nsja.mong/databases/lezzd
Size 28KB
SHA256 194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
MD5 fdb8a92e5060ce104e8f0faca55a47ce
SHA1 270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA512 ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122
SSDEEP 24:TLj0kSBieszXtUku+haaL6nwyLGSiGQQ:TskS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.vgaw.nsja.mong/databases/lezzd-journal
Size 8KB
SHA256 fea812f54f83d146e3d650981bc8d37fb855e6681b02657131cdcd2e527df6a2
MD5 63ca810e773af63090f22f1e4789a6f6
SHA1 5a5be1133bf285a68c3e549a1d07eb152821b77a
SHA512 3c4843e0bec4b7de2eab4f447d536edc4ce9344684b3879afc0677bc230e54109f8fa2390e9467031c4040a7a11f904ca6adac229fea1b6dc6bd5e72f7fc53fa
SSDEEP 12:7+tvqLWem6QADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbPFB:7+tvqLu6teszXtUku+haaL6nwyLGST
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.vgaw.nsja.mong/databases/lezzd-journal
Size 512B
SHA256 cef582592afd2838644990ba33b05ce032c6c070a0548ad92a0fcd3aba4bfc13
MD5 d57d826682c0572e1708a71c1d6f12c6
SHA1 2a8bcf463aec450478101db337f79ac8a593c9b9
SHA512 fd50188ff72a4407e42b3737b0d1b487da584deda51afb8b2813d2a450ed8f03b5b03908ed65dde05c2381507af5792945dc21707defb0638cebca59c0676f8b
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/user/0/com.vgaw.nsja.mong/databases/lezzd-journal
Size 8KB
SHA256 c557ef749081e91d86d8e38ada742a79ac9732b1f27b4670ac37c20ff14b0ec1
MD5 c85a350d0b1e18fc2d25724860792bfd
SHA1 5c7b06841bf6b3903467d3a5d0a5fda4fdf35f65
SHA512 fc498e34c79b672b54399d5b54e5215eaffc40bcd0750878b4a7f94c073f2a0ea81370bb3f3f657a3485c021e2257ad4dbbae73375057d779db2c7d477b086bc
SSDEEP 6:7+/l9ppuHn1hL+Wg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKo:7+toflqLiuWdYRmBEyPbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.vgaw.nsja.mong/databases/lezzd-journal
Size 4KB
SHA256 ebffabdc2295fb2fdd4a98a1f5f09f31231b688dbb19cca2015163682f5d4ef5
MD5 32b0cf63438008ffeb09b6d118a5cd12
SHA1 6983e83c7042ceb48c1d9965c25663fb4aaece58
SHA512 34fa5d39e3a358559d04f8579203ef2d96cbfeccc4a28da5e8ec1aaecb14cb3657d13e46fa697fa48ee707358d406d397647538688cd7a0a5e1dd75f180fca59
SSDEEP 6:7+/ldN8HPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKbn:7+tSqLJdeWRmBEyPbUn
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.vgaw.nsja.mong/databases/lezzd-journal
Size 8KB
SHA256 01d11ce7d39e28306856b960b4a68d19229b22f7e6ab21052bdb1ebfa9b98623
MD5 8dba4fd02555a0d252d77355e9649130
SHA1 af0ac51d7d995a1b853b8c74854793988b363557
SHA512 2b2f286968eb65d6d90e2a74f4a41a0378f8918caa761b02ec262b1498c291dfbb91f68c7b393e17ac8793ecd9bd5d75ac3b13c8e41e14c67d3e16b683915e75
SSDEEP 6:7+/l994Pg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKm0//yU:7+toqLmqKRmBEyPbX0yU
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.vgaw.nsja.mong/databases/lezzd-journal
Size 8KB
SHA256 de59eb425bcc5e34b846d194da8fed4751bcd7589cf648ad72efbe080dba17ff
MD5 bf7f09c08c9662266c6954c3f3d6b3c8
SHA1 fb1f571310cf9e06132fa4a9d72fe82b601ade34
SHA512 a3f967722689688ac8ea507f8910d4190ad8c1a8c8a3029d4256b2f8bd9704ddf2525a3c05b702ea1eabb072d9784baf175a48322fff44c2fc1615550bb680e0
SSDEEP 12:7+tMpnqLyKPjSyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbDxAx:7+tcqLy2TUku+haaL6nwyLGSFW
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1715148288947.env

Path /data/user/0/com.vgaw.nsja.mong/files/.um/um_cache_1715148288947.env
Size 652B
SHA256 9649578f68e6eb3e86098583b7f83225264741df7539d42de4c36de3d4aa16e3
MD5 0c6177a1d093987a4911da1e1118b734
SHA1 2c9c39b613c271f4eb4e9cd209bddfc2acb29bb4
SHA512 0933beeb4a85d14e76f2ce591d9ed4635215d99ca3059ed524d2e4a327b4e9943cd7531039480fb4ef36ffd776ddcd46409b74946b71251f9e4b52c8e6edacc2
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.vgaw.nsja.mong/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 6a8bbebaf3b14a1579d13e3180436890aa87c0da974ad51747b06f8f19be80fd
MD5 1a08680d83ff091f7af31f887f7fda33
SHA1 3e1b49b93d6f56b0a1b93ef1a5c4431317214a4e
SHA512 a43e53115d9ab073e42a417c6f99e794b57cf8886233a70ada2987d98afc48057e72861a7a9c0db327b345e6cbf33086219bdaac2f7e8018c5f7f494a36a37f0
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.vgaw.nsja.mong/files/umeng_it.cache
Size 352B
SHA256 57ffae8f251e7083ef548ec2d30e325dc94879a551d0ab9700c68318fae7ad31
MD5 2b572c3e5fe5d65ff99b028ad9557d0b
SHA1 80d74333db8cb42ed9f9cb5c69d7b90f6352e3fa
SHA512 54d0a6fe5f4df46088ba824db73da58abc0bfd4798f88a79bb963bb737bdaf868f131603125e48beeb4ced0ad88c559aebd289538d3756e0137c496b36779b72
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads