477d5262ee3a49ffcb3585602d188f7069f66dd8cf4a06e89e36c96482a53f33

Analysis

max time kernel
179s
max time network
181s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
20/05/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
612bbfbfe1acc6b3a4c94bd322929c09_JaffaCakes118.apk
Size 1.3MB
Sample240520-2mlydsaa75
SHA256 477d5262ee3a49ffcb3585602d188f7069f66dd8cf4a06e89e36c96482a53f33
MD5 612bbfbfe1acc6b3a4c94bd322929c09
SHA1 74d21ddc51cb37346f67009ec9f95c3cb7b5d380
SHA512 bcf57c0f213755780ffb6c20d69c30088f7eb538a87aa91764096fde74fdde4ffc43e880e89a036eee2c5b9726b0ee318ae854261dc586f7d40ca0e32af18282
SSDEEP 24576:ssQXoL0otaYtXMKCnEOn8wB7PvQGjXo+Fgjh8bq/13tdHbZKm51Ob83k:soQ7YtBCnEQfB7PvQGjrGjh8bq/1XHNS
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5108	com.cwut.bpbp.pvmx

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cwut.bpbp.pvmx

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar	5108	com.cwut.bpbp.pvmx
/data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar	5196	com.cwut.bpbp.pvmx:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.cwut.bpbp.pvmx

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cwut.bpbp.pvmx

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cwut.bpbp.pvmx

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cwut.bpbp.pvmx

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cwut.bpbp.pvmx

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.cwut.bpbp.pvmx
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5108

com.cwut.bpbp.pvmx:daemon
1⤵
- Loads dropped Dex/Jar
PID:5196

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.cwut.bpbp.pvmx/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar.cur.prof

Path /data/data/com.cwut.bpbp.pvmx/app_mjf/oat/dz.jar.cur.prof
Size 724B
SHA256 8628b7439382f5cf1d2ffc743a19cfb34ab6444186c21755c919b23586967cad
MD5 df1ff980a354417d0c471130c49de84a
SHA1 ec6f5a0c8501b74abb9b35ee5e72cc245be59a6f
SHA512 4b1761a91eb352dcafad7e33405e9416028ad859e975a16d8a72cda68e9f6a10ba09de0e77e9a6d7518dc747d33546d31f9aa63803b319676bf0fa092e19e889
MD5 SHA1 SHA512

Submit Download

tdz.jar

Path /data/data/com.cwut.bpbp.pvmx/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.cwut.bpbp.pvmx/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal
Size 8KB
SHA256 bd996d6c369671982c9853a6bdb5d9e19a1ffdb5b031df7af3adaf4eb6c1800c
MD5 31c8cb3ce6a07a3e2d9b5a58b91eec56
SHA1 cb219f0a331235c342c4b0a1857d5b537841aa47
SHA512 1ffaf90d396efe97b6c4bf788c2c71b7915dac6f47a39c91afe61e7885fdb847e0561f85800011c65c780b801a82a1e05657e44e5fd230b82dc429c6188ec87c
SSDEEP 12:7+tsLqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbDT:7+t8qLGqteszXtUku+haaL6nwyLGSP
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal
Size 512B
SHA256 ce9f7fb96cb1654aa30d6dfcf682d88de79a930808e1684d4057e569a573c757
MD5 43b42c18318f8aff5cabf30250456f52
SHA1 3eec7ba686c5df9fb6ee03ef71a68a08276c53dc
SHA512 9784bb23cd4ce70fdb20b776f8763bd175837899547f4f350a4fda79d0dfc8b10d2e1e648c19b3653aec17de2adb0cda0dd25567c93328495d1d7b4942f7a591
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal
Size 8KB
SHA256 e065980b5fd603edc14a10b1431f222ebcaffcb75fe1a294e8dc48c41e19abc1
MD5 322432635247e6e5d35505283ece1b1b
SHA1 c80042ef9e8306f9b0d60b8585851a35c9718516
SHA512 5ee5826a906e5d8cca1645f644425eaaf980a999982775e5ba0e77a8b09802c158f7055b9357a92fed8da712b3bc9cd9d77e005e61eb7c835b75d331b43c5153
SSDEEP 6:7+/l9lcn19g9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK+fB:7+tgqLiuWdwRmBEyPbPfB
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal
Size 4KB
SHA256 430b735b3aae6e9b2acff84c82893ea79d7a398abe60ee79029d7b90165987d9
MD5 0e973db48a374961d1ae130e75fe9163
SHA1 fb8908b1f1e7af333b5fb7cda6a485d756dd381c
SHA512 3b90d6d44a7be248d7962f7a2bd7a4268ccc351795973634e07da33e568f3631c46718c71624985d53b3b035111c32ff6101bc21cf0c3d8e6e867ce8e47d6fce
SSDEEP 6:7+/l4SOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKyg:7+t4SiqLJdTRmBEyPbDg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal
Size 8KB
SHA256 96102d63e087889bb9c35171300caba1c843bf20ab0fdc44e6b91af19c0bc4b3
MD5 f1b91faeead131668f25f02fe69aaa5f
SHA1 aad96cdacc63635c3db2fba380d50b558638fb2c
SHA512 3d21c3d82131a1da1a40e9d29fd8dfb0837876979598722faf222f3fa3fbd50b1b82eeb93a43bfaf015f2cc2f60414a9b54e5f63eab9b3ebf89f71c40adcd341
SSDEEP 6:7+/l9GPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuK5YK//X:7+toqLmqCRmBEyPbkX
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal
Size 8KB
SHA256 a98218891458f24f6664544a805d962c3036601f510137eda0d611506cbef66d
MD5 627f5ac36365b2e7afa0c551791d504d
SHA1 625a6de923d30bfc6cffc33a08a11fc59f14291b
SHA512 14888472d8ea8fb103df1ceef092bd3c54da12863e9c863c52d1ea0a9c9bc4c2c35a0afc3bd1c046ab8fd51cc55c34bc0d7824400747bc1ca8a21401040ee105
SSDEEP 12:7+tKvnqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbb9S+:7+tKvqLy9yUku+haaL6nwyLGSD
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/data/com.cwut.bpbp.pvmx/files/.imprint
Size 945B
SHA256 899bde61deb1cc6db85121862c995d343bd6ab9649d9402f9bdc88387a4bf373
MD5 9cfa130ffc5e58261efbbb72d30f7ae9
SHA1 fbb95672f2d21a5bae5192d09def44193e979d08
SHA512 135cbaf3a0b05e6ecd15dfdcea5b48b01c7904d798f895fca8f316ca15a242f0c188d168eac617b5ca58523f7a0f2293d070515bfedb77ac1c7d57407d057439
MD5 SHA1 SHA512

Submit Download

um_cache_1716245100101.env

Path /data/data/com.cwut.bpbp.pvmx/files/.um/um_cache_1716245100101.env
Size 1KB
SHA256 e99cedbdc20e4cddbd797fbe41bcc537c2f95f0108f41678ef959a261d230729
MD5 4a0c798cb71e814eb2acb7ad078a13ca
SHA1 5568a50ad49e33b29621c3aa72ff844fadb2e563
SHA512 40bbceffda73b17e8491a8c75dea6ef11b7027f95674f48893482bad5b10bcd419dc6b19de06559268c238fb6099dcf4fb0f480e4819e48bbc62b3d7b098de3a
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.cwut.bpbp.pvmx/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 f5167b2ae8e087235c3800f030b54cf9c5b267b67f11e1fc39b4d259b4ad4f5e
MD5 2bf7aa8877499a3dd964ab00f33087ad
SHA1 079ff0a9af06979a8607be54fb2379754cb41a44
SHA512 1e31c0f907cd2193201b4484f673e7cdd5956603154adf5acb9ee5aa220ce27d0b65c4e53b1680411ff4afe0ebbe86eb19534213f06dd22b05af515f9ffd89f4
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.cwut.bpbp.pvmx/files/.umeng/exchangeIdentity.json
Size 204B
SHA256 9cc047f6596465c457b4d80a26ff87fb25d9008118cbe104041f2fff71c68984
MD5 a70c1a6acf22b4abac7d5733c48eae4a
SHA1 d031b7d780046e91b94ad15db201b99a612670c4
SHA512 f923d5c87ddbc5bdf3877dc8271d9eea4d423cdafd1cf3f5c8704aa3ffed2baed9eae3e2ece2f79efade0ed99b5efd79b9353899d2c915a63645922cb55e03b1
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.cwut.bpbp.pvmx/files/umeng_it.cache
Size 352B
SHA256 3126db9a632f03c48854ce961acca6a5f186c5d80c8e5cbc0fdd2e43311a99a6
MD5 957d07a64f499d29052adbba16b732bb
SHA1 2d2c83043816627461ca662df4fe4be9c374565e
SHA512 c2becab4dabaeafa24db3de0ec0e4b4c8c560761fe934024d4d8293424e06a15b1b5eef7c0547a7721fd06f3e304009b80697e5999b5338f2d4fe02f863f07af
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.cwut.bpbp.pvmx/files/umeng_it.cache
Size 179B
SHA256 91ce18fbdc43c48cd955c5af811131edc3b495c228de08741acbb898593f8bfa
MD5 f7087e9223ca04419d0091e2f883eccc
SHA1 3fcf26254e4540408a40d585d245e878738a69cb
SHA512 352cb930afdbd64bac0b270ae6e98d793f086fa85e40ade055a16129d4addf3ebad7abfd0c070604359fd3ec1282879b0b28b9257fe217665a2b8eb72a29dcd4
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads