43418cddea37347f61fc1d2b3f7e897034c0dec8c72c4372d815a1d5776499f3

Analysis

max time kernel
178s
max time network
180s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
15/05/2024, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
46b50a2a8362e110b60802730492e47a_JaffaCakes118.apk
Size 1.3MB
Sample240515-seqf6sef4y
SHA256 43418cddea37347f61fc1d2b3f7e897034c0dec8c72c4372d815a1d5776499f3
MD5 46b50a2a8362e110b60802730492e47a
SHA1 1052b9404887c6f6f8c79f64a97fb1d18ad6c0a9
SHA512 85d139755011f61ea1fe88e0bc7567c8265597e2bea0456760b700d50619b58ad7cc01fa8bee84640aed848b864942ee513d68c0acccba11f67a3078781ce610
SSDEEP 24576:EXqVoL0otaYtXMueqHJCddRtLKaAENssuvo+kQj0vAq/13tdHbZKm51Ob83O:EBQ7YtZeqpCddRNKaVNsHTpj0vAq/1XK
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4532	com.izmk.jpdl.cfjv

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.izmk.jpdl.cfjv

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.izmk.jpdl.cfjv/app_mjf/dz.jar	4532	com.izmk.jpdl.cfjv
/data/user/0/com.izmk.jpdl.cfjv/app_mjf/dz.jar	4600	com.izmk.jpdl.cfjv:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.izmk.jpdl.cfjv

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.izmk.jpdl.cfjv

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.izmk.jpdl.cfjv

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.izmk.jpdl.cfjv

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.izmk.jpdl.cfjv
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4532

com.izmk.jpdl.cfjv:daemon
1⤵
- Loads dropped Dex/Jar
PID:4600

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/user/0/com.izmk.jpdl.cfjv/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar

Path /data/user/0/com.izmk.jpdl.cfjv/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

tdz.jar

Path /data/user/0/com.izmk.jpdl.cfjv/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/user/0/com.izmk.jpdl.cfjv/databases/lezzd
Size 28KB
SHA256 194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
MD5 fdb8a92e5060ce104e8f0faca55a47ce
SHA1 270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA512 ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122
SSDEEP 24:TLj0kSBieszXtUku+haaL6nwyLGSiGQQ:TskS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.izmk.jpdl.cfjv/databases/lezzd-journal
Size 8KB
SHA256 4fd7f334868cd9f8334a41ee0569c55545c5490cdffd0f457590b98abc8a4288
MD5 f2d6a9c2d42b4f5e091f445092e630b5
SHA1 53b0bfd32ed9da89dd4db65c4219e2a6efd02e7b
SHA512 97e5913aa7b2fe37bc35eb729791862fae6aa4fde44e7062206ec00c9ca46cccf3a90833d699b185c04daa78a36bc5bf41a9365fcc58aa2a102b6131729fc614
SSDEEP 12:7+tN/qLWem6QADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPb9D:7+t5qLu6teszXtUku+haaL6nwyLGSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.izmk.jpdl.cfjv/databases/lezzd-journal
Size 512B
SHA256 e5a609b50ea01c35d0d688730f822344e4535518b85aacaaa21289e2f0651582
MD5 8724fa49f25759dbeb17e2cd13bca59d
SHA1 79e90377370054ac156b222b6849d9bccac867b5
SHA512 319cc28ca85946d49a14a68ed4d8a415d3e310c7331d6b56921d0909e7e762d3157a8f3ed370465960debab0acb11ef21a6f138a5fde3b871e97d42849bb89d0
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/user/0/com.izmk.jpdl.cfjv/databases/lezzd-journal
Size 8KB
SHA256 b8fd5521246670e64af0f3d7f8954d30e843465b36b3e90c5f212903d04bcd77
MD5 bc0024642f877cfa51681fb0d8cd0446
SHA1 bfef4136a449a1b928d495e94fcd52def7f1531c
SHA512 6ff350550252735b1143e310f667897096949b777105b1a705abb52d348f7e0372838c9245af71d7407aa9f3c5965ee1b111080c71709007b072da64f7cd5c9b
SSDEEP 6:7+/l9akgn1Csg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKU:7+tUpqLiuWdYRmBEyPbf
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.izmk.jpdl.cfjv/databases/lezzd-journal
Size 4KB
SHA256 5d490df7d70ae8666e8b6341eb50fe7cdecd8224ec96e173cb5c985406a2e58f
MD5 0b4e9f1d96fda9f43ad078db9d20dc8f
SHA1 afbae4471061ed5ab0305815548de282732d79d0
SHA512 e8af2b5945f9c380a27beb63c12182ad4fadf713d9d745579abafd80bda26872e0bf6c8d3e9a6c114b5d11ba914a2f7a4d57abd6208fd45855b85eb8aec15885
SSDEEP 6:7+/lXbuHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKhD:7+tXbuvqLJdeWRmBEyPb8D
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.izmk.jpdl.cfjv/databases/lezzd-journal
Size 8KB
SHA256 0c1259985ea8ccc72e8475c98e06b4b629638de6f496c8167c1d7383baf888a0
MD5 87e70dc5dfd16343be0c425e69add86d
SHA1 eb17755147f6697b9a42fca511cb6f128fa3d4ee
SHA512 7c9dcbb9a61070d5baadf71988e490d58c168804bef368e00335116210128e87a124afd1199977d1b34c2d33619ae0225cd507c4d50abfe9c9505404ec021701
SSDEEP 6:7+/l9ZOPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKIU/xn:7+t7iqLmqKRmBEyPbJ0xn
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.izmk.jpdl.cfjv/databases/lezzd-journal
Size 8KB
SHA256 9d33b15df524eb115877a1e57b218769cfb51c3501643e72654b6b3dd769c854
MD5 f7aeb7277b66cedf1f08a6e8de55f970
SHA1 9ff6868b66fa7b784c1911f1b059f860d9b7c25f
SHA512 f4564126f64413ec9b5de1cba118dc1d9b1795086c46e99df98dae9b876c0fec30cbddd184c79ba8cacb7ad62c55a7e3689d097f29de662189061c46114b8942
SSDEEP 12:7+tF4nqLyKPjSyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbpo7:7+tCqLy2TUku+haaL6nwyLGSu
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1715785475826.env

Path /data/user/0/com.izmk.jpdl.cfjv/files/.um/um_cache_1715785475826.env
Size 651B
SHA256 6e49fa45b153cee0fdae6dd6c4dc8d35ba4a793387672fd856b059a366210d78
MD5 0db4252063b4da336e9bd754355a98cc
SHA1 4d40b4c97114d858e0804c4b2aba59fd5cd02fc1
SHA512 85150b826c69105db09dcc49b50d31ea996524eee43e4098577da48b49f37a8d2d29823d669190ab06e1eb1c78eecf0990ba3276758e5c4169ccf95d69497aab
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.izmk.jpdl.cfjv/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 89209f213e12e449d3572362c8ee0f9c7523057ba416fe1d94f7de4f0c10a179
MD5 1ff09b2b158335e01015f8a9a0aa9cc9
SHA1 fb0508a1022bb4537b965b9c8657d3aa871921ec
SHA512 cde8f8bb8ffb7a81a38d16fc05f848aeebb13b026cd1b8594f864d83f91efb799412bd2b3f2da115614bbf2674d41c99d8e5e5429a9b610b418dad49e817e1ba
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.izmk.jpdl.cfjv1

Path /data/user/0/com.izmk.jpdl.cfjv/files/mobclick_agent_cached_com.izmk.jpdl.cfjv1
Size 797B
SHA256 3d56689d7a4693ed2257c9f84dfea0f7e6df222153a2923bad86ad3ad7573b0e
MD5 2aa143abace338f5c83fb6d15700e4b9
SHA1 d9caffd9366a655b25e4c307b8d85f19c3d171e1
SHA512 db5216f3817dd8b3bcb401d81069a2adac2fd4837f24ce6007d3d66ac18a8166d06febaa864bc76889c1869726f6925995e025f5edd5bd44cccc31e603c4e0b2
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.izmk.jpdl.cfjv/files/umeng_it.cache
Size 352B
SHA256 b3e652fd22c6d8373f80898276e84e930367078abe5ee408f884c278a5847798
MD5 f8d5b161c3cb2f7d10c22f44924115dd
SHA1 58e3542709b86b126da36b46c21bb4b97dc2b5b1
SHA512 f72251a80a21f4590892be86a63c7c8f103bf3f16e2290383d11f9360f4d35da1420525defb8fb8e4c477b8307356344820a73291d1318f0af38b6d45594389e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads