477d5262ee3a49ffcb3585602d188f7069f66dd8cf4a06e89e36c96482a53f33

Analysis

max time kernel
178s
max time network
162s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
20-05-2024 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

612bbfbfe1acc6b3a4c94bd322929c09_JaffaCakes118.apk
Size

1.3MB
MD5

612bbfbfe1acc6b3a4c94bd322929c09
SHA1

74d21ddc51cb37346f67009ec9f95c3cb7b5d380
SHA256

477d5262ee3a49ffcb3585602d188f7069f66dd8cf4a06e89e36c96482a53f33
SHA512

bcf57c0f213755780ffb6c20d69c30088f7eb538a87aa91764096fde74fdde4ffc43e880e89a036eee2c5b9726b0ee318ae854261dc586f7d40ca0e32af18282
SSDEEP

24576:ssQXoL0otaYtXMKCnEOn8wB7PvQGjXo+Fgjh8bq/13tdHbZKm51Ob83k:soQ7YtBCnEQfB7PvQGjrGjh8bq/1XHNS

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.cwut.bpbp.pvmx

pid process

4294 com.cwut.bpbp.pvmx
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.cwut.bpbp.pvmx

description ioc process

File opened for read /proc/cpuinfo com.cwut.bpbp.pvmx

pid	process
4294	com.cwut.bpbp.pvmx

description	ioc	process
File opened for read	/proc/cpuinfo	com.cwut.bpbp.pvmx

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.cwut.bpbp.pvmx/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&com.cwut.bpbp.pvmxcom.cwut.bpbp.pvmx:daemon

ioc	pid	process
/data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar	4327	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.cwut.bpbp.pvmx/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar	4294	com.cwut.bpbp.pvmx
/data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar	4364	com.cwut.bpbp.pvmx:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.cwut.bpbp.pvmx

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.cwut.bpbp.pvmx
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.cwut.bpbp.pvmx

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.cwut.bpbp.pvmx
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.cwut.bpbp.pvmx

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.cwut.bpbp.pvmx
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.cwut.bpbp.pvmx

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.cwut.bpbp.pvmx
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.cwut.bpbp.pvmx

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cwut.bpbp.pvmx
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.cwut.bpbp.pvmx

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cwut.bpbp.pvmx

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cwut.bpbp.pvmx

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.cwut.bpbp.pvmx

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cwut.bpbp.pvmx

com.cwut.bpbp.pvmx
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4294

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.cwut.bpbp.pvmx/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4327

com.cwut.bpbp.pvmx:daemon
1⤵
- Loads dropped Dex/Jar
PID:4364

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cwut.bpbp.pvmx/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.cwut.bpbp.pvmx/app_mjf/oat/dz.jar.cur.prof
Filesize
683B

MD5
83960f6c91df99600621a7fd48c8213b

SHA1
758add6c2951ab30d4fbb14d9d3e98af3e200724

SHA256
7c25ac65f3be6c6276df6703e4503ed6ab3d595a515af56c793251bf970ea897

SHA512
d61c4b7622ca66134353d7073fb944f45821839be9e63088e1558b0f7e241274c26c7537f583006253dda53c1fb95bdc8912f249b71968ac660accaf881ab515

Download Submit
/data/data/com.cwut.bpbp.pvmx/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.cwut.bpbp.pvmx/databases/lezzd
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal
Filesize
512B

MD5
d75bd3bd99210d40d25275157c259782

SHA1
bf0510a45e12b7f678d8a5ae343459e2416245f9

SHA256
de93306b7453372d70936553ae778a0595edaf61c967e84672d573010b33eff4

SHA512
a7f253ff771cde99e2b3aacae435b0777fe32b2d60947ea83cc233d5e28fc296808afd106517230cfc5f14fc926ec4f407c11c8e7fc17921a6fd3d2ebb820a66

Download Submit
/data/data/com.cwut.bpbp.pvmx/databases/lezzd-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.cwut.bpbp.pvmx/databases/lezzd-wal
Filesize
60KB

MD5
0ce9ffa14fb7bb78e62e49824eb813ab

SHA1
2fa0d265eb0ed47d58a865cfb458042b72b99885

SHA256
4901e423e93bf806aaeb1d0f04ef640e5f8881db82665397d48a53cd5ab0a671

SHA512
54f57c9e7659e7f0f81a177dd1ab42f93d595c9af7e6cc34515220c4e608c871f6b738401532e4c4763b29738afa81f80e8dc90a03fa8f65bc8274481163e2c9

Download Submit
/data/data/com.cwut.bpbp.pvmx/files/.imprint
Filesize
1016B

MD5
31d7c246ca60252a64dd869f0dc2d1ca

SHA1
f1a2a09982487349014a1bb8824ef1336f6e5e31

SHA256
6a3439756b36a53cdea5bd410d1509fba43dd3b5d738b0ad9bb83ec07cbe5a29

SHA512
60fe18131b410bf7432872fc36a8724240b0d99e91cfc6e11b1595913f8e58ab9397c5fb743305aad44c86e0b31f05160467bec8388d3786c3124ce417e3ae78

Download Submit
/data/data/com.cwut.bpbp.pvmx/files/.um/um_cache_1716245040118.env
Filesize
678B

MD5
5da7aa820caf40fbe105c32c8c4eaf1b

SHA1
0e3faa78e7f48fe96121d805522446fc3779d3b7

SHA256
49d7b7255e8a6b7a3e2b9bacfce0e0beb26c73ce39252a8b685f98e7059001a6

SHA512
1763d252078e1e24edad1a7425ba4d95171ca864a7cfbff753f7c2f5fc5b923f2cda7bfea07c2e53b14acb022f7308a2a83a86a3df5b700b0a8d5db372e985d5

Download Submit
/data/data/com.cwut.bpbp.pvmx/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
da69cb8611f6afae4507b81a8af35486

SHA1
7bb2c2e9016767caa4aad85cba4e00c8f189eff7

SHA256
0f26a5dc417e2b98f0540e69d1d31e773ce3ab317e2995d5ee8b4777892d9ec8

SHA512
8cedcad920fe629d74071b9cf318ad9412e648c08f4199a864937f3a8bcb03cdbc1db44f0ace124831c91eff7b3a8ab0363665f7ea9368875c04e51ac4e3014c

Download Submit
/data/data/com.cwut.bpbp.pvmx/files/mobclick_agent_cached_com.cwut.bpbp.pvmx1
Filesize
1KB

MD5
64b28680a2a990f02e45ddf6ac479af1

SHA1
3504b46c0fc3830ad6b702135a5e87e9f89b0685

SHA256
5bb1462ad90d16c7f8f9c55502fbbe38becacaafd899dfc40fab5b9a9ae93b0e

SHA512
c617897af9432a06642f9bc13d44425d5c56a8c483042f9bb7ab78d6d8987c8c0a96385021a630e739cfc673c677b66b357457a564c8553bb8f31a71027244df

Download Submit
/data/data/com.cwut.bpbp.pvmx/files/umeng_it.cache
Filesize
415B

MD5
ba1f504ede2981e8eac2f4a3e6e3bd8f

SHA1
7b1b007f782cccdce4abdbb83b372393151cce34

SHA256
bf9275e6672001207dd45a1bd41d019c836313a8ddd490f9dd694f7ab3e5595e

SHA512
4ee178d9dab48aec7f18d8b88336145cf6160405cdb6d0f1993493e79080abb02ac5ee135c4682829b48a9c3415fc33fba714acba121a7116a0760cf22d3266a

Download Submit
/data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar
Filesize
248KB

MD5
9b47e78a6ff90cce5755ce4742047627

SHA1
831b24aa9e116eb8d7065efd430088d419dfd6c7

SHA256
30d7699b73fd7f276945415c405c12bff69c5958d12f56265a768443f6fd8cae

SHA512
4587a5b26f13cbd0524eade71ed29203fc55029fe150fce850016aa7d9c578623cdc4b6a551bed3dec9e31a39563f8927cfcc9d21e2d83c2c781808b958446fc

Download Submit
/data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit