14e4e6112ade7224ac5fcf612a536601db5b24ea87c97a753175c44e9b8e9560

Analysis

max time kernel
178s
max time network
172s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
20-05-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6057c23c1a28a8e0111bc472b542b042_JaffaCakes118.apk
Size

637KB
MD5

6057c23c1a28a8e0111bc472b542b042
SHA1

a79b3d0ad77085cb45dd7684e820daa614acf9c0
SHA256

14e4e6112ade7224ac5fcf612a536601db5b24ea87c97a753175c44e9b8e9560
SHA512

158f4e6b93487ee1fc6612f97d77758974d3f7bd73746c9728af6c25a40220677dbcfeef8413c5dcdb168ee69d2afd5aba7a65f87be621855d675c399c598940
SSDEEP

12288:TI4L4oQI8Y0FotaKIUtrbMDp3zE1aaTJE5+/u9cejETeFxNM2f94vvQe6ERylT4O:+oL0otaYtXMDp3o1aKJY+/ufEWrMwiyh

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.zpba.malp.slga

pid process

4261 com.zpba.malp.slga
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.zpba.malp.slga

description ioc process

File opened for read /proc/cpuinfo com.zpba.malp.slga

pid	process
4261	com.zpba.malp.slga

description	ioc	process
File opened for read	/proc/cpuinfo	com.zpba.malp.slga

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.zpba.malp.slga/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&com.zpba.malp.slgacom.zpba.malp.slga:daemon

ioc	pid	process
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar	4329	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.zpba.malp.slga/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar	4261	com.zpba.malp.slga
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar	4371	com.zpba.malp.slga:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.zpba.malp.slga
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.zpba.malp.slga
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.zpba.malp.slga
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.zpba.malp.slga
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.zpba.malp.slga
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.zpba.malp.slga

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.zpba.malp.slga

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.zpba.malp.slga

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.zpba.malp.slga

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.zpba.malp.slga

com.zpba.malp.slga
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4261

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.zpba.malp.slga/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4329

com.zpba.malp.slga:daemon
1⤵
- Loads dropped Dex/Jar
PID:4371

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.zpba.malp.slga/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.zpba.malp.slga/app_mjf/oat/dz.jar.cur.prof
Filesize
547B

MD5
1ea39eaa8f4460fd72b2dbe255983cc9

SHA1
39dbde1e442d8a81fdda8484b63af5a6d50c77ba

SHA256
db56e380cd9cb8b4ba74f37eb6b2a7f18c903a765d444716a7bfac49152f027e

SHA512
b2403592f0c650e8b7ef3d366e032f7b9c292f9d3bd938409e5cad2ee220b9b3e0ab2dce5632ce0af37a5d705303d86a2064eec4803352b92bca848e23d807fc

Download Submit
/data/data/com.zpba.malp.slga/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal
Filesize
512B

MD5
2e4f3380e6be14ccba9b96d11952e99c

SHA1
09fda80a4c0ca6123361195b86f6bea96e36166c

SHA256
720fc41da81e56a2398e1797979622afa201846185a0c2d1e7e86dedf5a74373

SHA512
00606956839ab734083e7a65fb62aec3524952e08372f15fb9bcda3f7d148871b7460627e9981fa02665db3638cca80da8b7433ef7d426d42c0fd3cd68287a88

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-wal
Filesize
60KB

MD5
166fc06a0538f3460a308716f5a83f38

SHA1
d59c549a37d786205cdcd21125af93de1446e942

SHA256
082876c91d13557c838b198c613e2d8975002385513f9d2ff5433338a0033402

SHA512
1439b666a22a4855cb0cd2eba3de002f5f7e84f8bcb75052c0fecd1cf798867ed713fddd8a58bb5f8e0c284441169c336865e8efe89704b781fbd7b20196ef29

Download Submit
/data/data/com.zpba.malp.slga/files/.imprint
Filesize
1019B

MD5
1c87ffd1e6149b48184c16d7e8bba803

SHA1
77b37d035575bb40678db620540350957c7e0ad4

SHA256
725c82c94e1afcff5c191f4948ea403c5a22243abf092cfac94cdea05e8768e6

SHA512
1322ec7b3ee3d68078e8e7c258165486e42b2cc91bf2b4d3f5c9ff19f1df9905860496954c562b67ea97e3de0f2f6e565d3bb160d8639d691f597a57c2b2eefd

Download Submit
/data/data/com.zpba.malp.slga/files/.um/um_cache_1716226651431.env
Filesize
678B

MD5
0156e1704b2ce2b1a17c9022e80443ff

SHA1
14e4375bb7d50d99998b28cdaff7fd253c6198f6

SHA256
bd74d60f570cbc2669fa5b14315ca09e8c20fa29e8a134eba7c35cc7ed5a7f27

SHA512
215912058b695969e5264bc4da89200e3eb8344bd619e69652dc98f52c97d767be389f592f8942527902f72ce8cab31c70bb867d70879fc7ce0972ae548dba86

Download Submit
/data/data/com.zpba.malp.slga/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
ee5dfb58a8b648644ef1aa4f826952be

SHA1
2c94e7c8f9ef437c7b8a5e36b3fbd44818761475

SHA256
f9f4c45173c4deedfd28e607064880e4ba1952ff232a68afc4c94f91898136a1

SHA512
3450827959393d9a684023ede0eef99388f47776d88e9c593155c02c34947d4cac50511b62826c3974e777c31e5aff49eb498e7d144d7714a4bdc62e482c7577

Download Submit
/data/data/com.zpba.malp.slga/files/mobclick_agent_cached_com.zpba.malp.slga1
Filesize
867B

MD5
28ddd562f3039d1307ca6fee19407c28

SHA1
5e5190256d400d02dca1ef7acf9f68c366249c81

SHA256
bbc7cb9ab55e07295f6d012e672f3ea215aff81176b200aa7a0a15c2bfc520e9

SHA512
7065576e271b8a83ad7b007be72423d1043a630c9457ae810666da00b7af147207f846240779751e7b22282542b458e8ac95362b9ca292c53ab57c53f1b2cabc

Download Submit
/data/data/com.zpba.malp.slga/files/mobclick_agent_cached_com.zpba.malp.slga1
Filesize
1KB

MD5
9e7ed0b98cdc051ba88da7da22e233ff

SHA1
84dd152b76a6375b927a00c5b2c1abb22ebb5837

SHA256
68ee6e1a779ff669e8d800ea5440561e035540ce328dbddf93bb5ab5c15f242b

SHA512
5b6ff7db166d50561cfb82ac44357c68e49490aae8c1963173cae2fc8b84e73baae9a3a842cab2f1678b3287092eb7bb474b8006f96fe9e7ebcc625103f66c4f

Download Submit
/data/data/com.zpba.malp.slga/files/umeng_it.cache
Filesize
415B

MD5
9fab40bcb640329a1e687bf8df1e5547

SHA1
8b2020138591cef8e7c31e7a0da1577cd19d579c

SHA256
79a921ad125fe5895118381214aac38561052395b4e464832a01209d05d7ce4f

SHA512
f21cd011051b67d2476529fbc9987fd66e9f76fc7acd979e2fe09c91b7f98e28260c4f9b1b010d008a638977fd4dcb1b4e0e5bc1d81aa5c63dff46f66ff3df8b

Download Submit
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar
Filesize
248KB

MD5
9b47e78a6ff90cce5755ce4742047627

SHA1
831b24aa9e116eb8d7065efd430088d419dfd6c7

SHA256
30d7699b73fd7f276945415c405c12bff69c5958d12f56265a768443f6fd8cae

SHA512
4587a5b26f13cbd0524eade71ed29203fc55029fe150fce850016aa7d9c578623cdc4b6a551bed3dec9e31a39563f8927cfcc9d21e2d83c2c781808b958446fc

Download Submit
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit