8318e1990b8d6f2f03684ff7ee1ef0a6097b0fa4e7455196a0b64c1293771b7b

Analysis

max time kernel
151s
max time network
157s
platform
android_x64
resource
android-x64-20240506-en
resource tags

androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system
submitted
11/05/2024, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32e1781c3f693c936584933439d330bc_JaffaCakes118.apk
Size 1.3MB
Sample240511-ftc36shf98
SHA256 8318e1990b8d6f2f03684ff7ee1ef0a6097b0fa4e7455196a0b64c1293771b7b
MD5 32e1781c3f693c936584933439d330bc
SHA1 78543c7500133889e88640e511443b64aa495777
SHA512 eadbf89d2256d52e362e6f00f5a9776ad8fce6a17a78ec99cc59e6c09da8fa1ac42761f4adb663c5f4bce841d2bfdeba24a31173de41ddea82bbd4aa596fee46
SSDEEP 24576:xoL0otaYtXMZM6c7T61VaxP5PFA1rypzLo+kgj4LQq/13tdHbZKm51Ob835:qQ7YtOcX61icdyFH5j4LQq/1XHNKmjbp
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5088	com.dmls.ilex.hhdt

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.dmls.ilex.hhdt

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dmls.ilex.hhdt/app_mjf/dz.jar	5088	com.dmls.ilex.hhdt
/data/user/0/com.dmls.ilex.hhdt/app_mjf/dz.jar	5157	com.dmls.ilex.hhdt:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.dmls.ilex.hhdt

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dmls.ilex.hhdt

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dmls.ilex.hhdt

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dmls.ilex.hhdt

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dmls.ilex.hhdt

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.dmls.ilex.hhdt
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5088

com.dmls.ilex.hhdt:daemon
1⤵
- Loads dropped Dex/Jar
PID:5157

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.dmls.ilex.hhdt/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdz.jar

Path /data/data/com.dmls.ilex.hhdt/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.dmls.ilex.hhdt/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.dmls.ilex.hhdt/databases/lezzd-journal
Size 8KB
SHA256 c6fb22f5f7c5b37937a3b63765770051c9bd1ceafdc282b3a753459d37b754ce
MD5 9d26398a0f1849ce65a7bca1a85de904
SHA1 52f0258a53aad9c36bf511887dbf3229dd8d6fea
SHA512 32476de5223d19a61b63fbcbbf11878499f3ffcc092ebf0c871cde285771b5141bfa1fc0f1781a850871e8d14483f8d000be9e640d9470b18a487763dce96943
SSDEEP 12:7+tDqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbZV:7+tDqLGqteszXtUku+haaL6nwyLGSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.dmls.ilex.hhdt/databases/lezzd-journal
Size 512B
SHA256 7186339e15e941fac966125141257afc2a9e7d12aff1e54bd66082e79e32e608
MD5 5dcc41175e6da5fc8fdba69e55a1f10a
SHA1 e4f6c1e2487f2bbd7922b62b41a3a83e70268d7c
SHA512 5ae4b2a8bb68902acdcdebb458dabdc70c2cb160831f62222f81a31b0b5651e5211d3ef87fc54d23a0fab5d4998be0a31d096f98f70444e46ce2570f717941f9
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.dmls.ilex.hhdt/databases/lezzd-journal
Size 8KB
SHA256 7dbf7e1b4274dfcb189ff2e9cc261e5c07eb16a8517d551db567c257a546c84f
MD5 f18f8924dbf1ecc6266302135c025156
SHA1 b302c6a8e26f5b43e4356606437e1ae501de56ba
SHA512 d03a4bd4348d11471046fb1db41d73c0f5886157f817ab3e9f47b34ad19cec0244e7178d93298af141a3dc40b5077e25f9cda7dd26da45fd92dbb3c3da8e39c8
SSDEEP 6:7+/l9Ygn1w/ng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKJ:7+tAfqLiuWdwRmBEyPbi
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.dmls.ilex.hhdt/databases/lezzd-journal
Size 4KB
SHA256 b83b8351d5194db9c1633a73884638a9daedc8dd92149cba6a81a19ea9a7b890
MD5 92dbfc4ad9146870dce190074854e855
SHA1 8896f9252f4ba06a544a5850b47c4710a5b57f87
SHA512 5941762aa38a7f80ed4c79ad731aedc46e7fa9d5b304221e4fbc1316a96a086dd0fd766ad136d85da9d9d8b34bf37b0591905b95a3922f423fd49018c71bcb30
SSDEEP 6:7+/lJd84Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKg:7+tP8wqLJdTRmBEyPbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.dmls.ilex.hhdt/databases/lezzd-journal
Size 8KB
SHA256 cea2c2fce3c59d194f35dbc0d0218562b99bf7f8184b9e7c499e4740acabfb29
MD5 17b9b59cf3bab1ba34657323c3517c7e
SHA1 34f2aea6513327423f554e17658bcc1ce13b7d6e
SHA512 5225e8d45162f32a716937fd3a89b92ca8f07716469093add61ba2c8081e7a38a00c718e179c41b6097aab8d00b55263abdcb3d3e8d391c109de98d225be31ff
SSDEEP 6:7+/l9S7FPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKVl//aoH:7+tcFqLmqCRmBEyPb4lX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.dmls.ilex.hhdt/databases/lezzd-journal
Size 8KB
SHA256 3349f657c407b77381690eda218eda53bd7958a4ae7ce15353c8b68f6634127e
MD5 dfa598521e9bc524ef0086107bb11af7
SHA1 c4246ad84bde030312a4ce0d95a639b92d173fcc
SHA512 10e14157e0ab07d78f10fa1406f9ae49f318db8aff94f483f73d6c67c906de094043ef475f1ea595c48b7ca408bcffd2a842fd174304a9e8aec75badf6c8982c
SSDEEP 12:7+tbnqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbnyJA:7+tLqLy9yUku+haaL6nwyLGSyq
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1715404288286.env

Path /data/data/com.dmls.ilex.hhdt/files/.um/um_cache_1715404288286.env
Size 654B
SHA256 d59632604f23116ea05daf5be72d94d2b439a2d2e6f972688a9063755a9e8cea
MD5 44f1840966a3c773417a8c91ca4ad4c8
SHA1 90875a5d8377be0ab4caf4f7845e9edf1a9ec6c1
SHA512 0406bfcfd97a8761302ac0be778d08150a63a015be1e3aa2333adcf50f02a4b019608f8da122be04f7cc89dcaf9d9950cb09eb5e45c44f4beb8a0b62680cab0d
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.dmls.ilex.hhdt/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 8c71446e518bf763b2b96dc02943462dd464ca3ca4f1a2533922a471b245d18a
MD5 215a702260661701469ef2c5b7877d17
SHA1 93b49870f5654aa6e9738507876619f9f33a0a00
SHA512 24df32e49e4a620df20b291a2047d9c0142738bf46acd517fc7d774d2a921c9d59d257da25b08db5527c924071012ecf009ac6d5618b0bbd14bfe89bb7bbe43d
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.dmls.ilex.hhdt/files/umeng_it.cache
Size 350B
SHA256 e6891d081737953a2ea5c750f4f8eabaea71aef50dea96b4ee77ac8f88278e4c
MD5 17b23c2649a7cdc64cba8e37b244c050
SHA1 305170de84cddb1fb0269902db3f031c640d2118
SHA512 31a137205e3c4b975e39993415e8a482885a35ae3ed8589cff2c182366af4f2f45c65da53de8caa85c8240b4833eb21fd4a0ccba4bcb93bd330a70c596f6bc66
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.dmls.ilex.hhdt/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads