9fb9892ce36cdb74bacbed245a29771e3195894e37672f21176435ca001e4e97

Analysis

max time kernel
179s
max time network
179s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
20-05-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

611cce73a21b3ef5079548fc40be1179_JaffaCakes118.apk
Size

1.3MB
MD5

611cce73a21b3ef5079548fc40be1179
SHA1

c5d97482ae73f4154309760b7a0eb8966823ee72
SHA256

9fb9892ce36cdb74bacbed245a29771e3195894e37672f21176435ca001e4e97
SHA512

9ae08fcf8ce396f4137c261462477b33b29dee0d14d95ea7d7f97b6e1c7d6da7fbe0901212e6326b541dad59803f6e4902eadcc98edf2f34c5687812a64d9e7a
SSDEEP

24576:CQXoL0otaYtXMwCnEOn8wB7PvQ6jDo+5kjx43q/13tdHbZKm51Ob83K:eQ7YtfCnEQfB7PvQ6jP2jx43q/1XHNKR

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.jkop.cmdn.fqgz

pid process

5149 com.jkop.cmdn.fqgz
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.jkop.cmdn.fqgz

description ioc process

File opened for read /proc/cpuinfo com.jkop.cmdn.fqgz

pid	process
5149	com.jkop.cmdn.fqgz

description	ioc	process
File opened for read	/proc/cpuinfo	com.jkop.cmdn.fqgz

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.jkop.cmdn.fqgzcom.jkop.cmdn.fqgz:daemon

ioc	pid	process
/data/user/0/com.jkop.cmdn.fqgz/app_mjf/dz.jar	5149	com.jkop.cmdn.fqgz
/data/user/0/com.jkop.cmdn.fqgz/app_mjf/dz.jar	5317	com.jkop.cmdn.fqgz:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.jkop.cmdn.fqgz

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.jkop.cmdn.fqgz
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.jkop.cmdn.fqgz

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.jkop.cmdn.fqgz
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.jkop.cmdn.fqgz

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.jkop.cmdn.fqgz
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.jkop.cmdn.fqgz

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.jkop.cmdn.fqgz
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.jkop.cmdn.fqgz

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.jkop.cmdn.fqgz
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.jkop.cmdn.fqgz

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.jkop.cmdn.fqgz

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.jkop.cmdn.fqgz

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.jkop.cmdn.fqgz

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.jkop.cmdn.fqgz

com.jkop.cmdn.fqgz
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5149

com.jkop.cmdn.fqgz:daemon
1⤵
- Loads dropped Dex/Jar
PID:5317

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.jkop.cmdn.fqgz/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.jkop.cmdn.fqgz/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.jkop.cmdn.fqgz/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.jkop.cmdn.fqgz/databases/lezzd-journal
Filesize
8KB

MD5
0a71f1a40e6d99b0d694c28878f991f4

SHA1
84859b6f74ba1e393975b79dd568a57aaa1618ea

SHA256
485fba498e1b133c93f11f0dfa64b1cdfc804c2a9a47d87b0e60b21f528297b9

SHA512
db2251b8ba5c5d847ce9e880315b007a88ed06108d41026205c8c79000bd9e09e211244dbd77f0adacdab1817e06704ed8daa6d4b48f7a8e7885b77e89a4649c

Download Submit
/data/data/com.jkop.cmdn.fqgz/databases/lezzd-journal
Filesize
512B

MD5
93b75a77514300a9844a8cc583d40626

SHA1
0fa36507fd871d0aed67d81d2c48237981175a40

SHA256
c251cf807493f62d1a961424e6ab8a81a15362205343b204c3e96d9fca9e1089

SHA512
0dc5fc5183d590336d53dddaa3dec916eb03fa58ae29ad13ed57aa0ee75ec8630609ef85cf68bfa0dbb219c0d443aba62297a580af2ae132cbc130811a6e2232

Download Submit
/data/data/com.jkop.cmdn.fqgz/databases/lezzd-journal
Filesize
8KB

MD5
177fe09ede54cc2b6abcca517b7e8f65

SHA1
dc207e4afe41a93a65a3fa183ec5955d57aa4060

SHA256
a27074671fd8a3a50f3ff641546cdf93745e096a20109386a56a4c09967ffe08

SHA512
f8869fdd6fdee3f4391334eed5fcb8c68dac18979861a196639cf7089f66eff03ac94ad64acf0eaf7602d30b3e91c0a1e6c0ab7a9789c9113f90e266b8a59121

Download Submit
/data/data/com.jkop.cmdn.fqgz/databases/lezzd-journal
Filesize
4KB

MD5
acba1c06e17f639a35f5ecdd544e6f36

SHA1
838d5dd6986d41825e6c3fb7074c0f96f8c8c054

SHA256
c3da6a7a47a74bf162894c5f216c966885abe3357a35279045429eb6ed53839d

SHA512
e43a134ae6731404423c392e3a30d887cb2291d1d48b7532821ec91117733b995f44428bcd6d3e11e749fc5fa4ba659c5ac6b51bce963280fbd5cb81a78c0ebe

Download Submit
/data/data/com.jkop.cmdn.fqgz/databases/lezzd-journal
Filesize
8KB

MD5
d4b1623c329d1cb5d6d34113378a8b9f

SHA1
6e3740ccd020026c56908d92f901a0669b85a369

SHA256
790599ba3f32e80d03b0b31173b34033539934d8dcbd652d512c749a5ffc222c

SHA512
642cad72b5ed4d866dc2625af39650c5e514d2f92f3aea39903a811f6c0b297602e7c11d6a229aabc1baf7888e7e33b16ffbe5a09b6d18c52e819a6751dfcad1

Download Submit
/data/data/com.jkop.cmdn.fqgz/databases/lezzd-journal
Filesize
8KB

MD5
ba0fc572730c9c3e380f4cd4335b1112

SHA1
9c800b99114c27ac611836e768441dd1e3488bbd

SHA256
63aeac6e6c0aafb8f2ff699afe1c9cec2b5216451a575c7fb4b41da00142db8b

SHA512
38522b48ea0984af1d8bb1694fe20f56347eb94a93d8621ab37309b3ca03efd7899a05ed1da4b925536ccf715928ec92fd1dde81f3cef85b58be942a67a537b9

Download Submit
/data/data/com.jkop.cmdn.fqgz/files/.um/um_cache_1716243994520.env
Filesize
658B

MD5
a23c20475b6f91337d5612504f94a93a

SHA1
195e099b6688644f27c1175cabf3fc60ae1f3341

SHA256
c8e016c9067bd0bc25a0c817c07e8335debdd1d8f9efa97daef389c8ace53c1a

SHA512
92637f6b4b455327260b17f6a946d7d0ed8c89327f4f4998dd8591d34adde5db9b51d259f3a697d4b92495f9911e3fededa42dee260849f6fa341cd249732d5d

Download Submit
/data/data/com.jkop.cmdn.fqgz/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
a17105215b0ad6c239acc9cc445b72b1

SHA1
6fe4f30ef466729e0d77605decaeb32cb486514c

SHA256
ecc92fdc03d1bf0f3b6617b7743e90d3222dfbc264cb85d347cc530ba6f4b394

SHA512
c97acb2393b8ca5a979fcb02ea2efd75c2c571eda842d80b96cc56d985801f7a98fd9a969dfddb29b9412bac8103dd81cbf4ec49a01cae13f2797c37be302789

Download Submit
/data/data/com.jkop.cmdn.fqgz/files/mobclick_agent_cached_com.jkop.cmdn.fqgz1
Filesize
794B

MD5
54d7aa89622545a80dbe6300fd8cc46c

SHA1
120f3bb7c45df0fe411adc682edf3c0a1d1e8aa6

SHA256
10c7a1fc5352e046bc6d0929729be9b231ecd50f7261cf387bbb95d628c0140b

SHA512
e709607040ea7860228c03841f2e53eddba8b1275ee94e0f3d07872c02c875d9a70a5f22564f3a4018bd5c35027667e7393c6660bad0dc0a18ec6c2f553b22b4

Download Submit
/data/data/com.jkop.cmdn.fqgz/files/umeng_it.cache
Filesize
350B

MD5
b3c8379a0bfec96c376224396faa0cd2

SHA1
1dc9be3f069e21abd4977271ace44d52f5c0317f

SHA256
26d4664203b18525a9cf18db6d6724cca88799a65a522a4725e054717430d904

SHA512
c7119216d9295d9ba2faa43b944aae16b166394800c5091184b0dca12e820c37946770c87ad3c0124f25733197eb8146ae17096b682d1bfcf1ba34de9d64127d

Download Submit
/data/user/0/com.jkop.cmdn.fqgz/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit