14e4e6112ade7224ac5fcf612a536601db5b24ea87c97a753175c44e9b8e9560

Analysis

max time kernel
178s
max time network
186s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
20-05-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6057c23c1a28a8e0111bc472b542b042_JaffaCakes118.apk
Size

637KB
MD5

6057c23c1a28a8e0111bc472b542b042
SHA1

a79b3d0ad77085cb45dd7684e820daa614acf9c0
SHA256

14e4e6112ade7224ac5fcf612a536601db5b24ea87c97a753175c44e9b8e9560
SHA512

158f4e6b93487ee1fc6612f97d77758974d3f7bd73746c9728af6c25a40220677dbcfeef8413c5dcdb168ee69d2afd5aba7a65f87be621855d675c399c598940
SSDEEP

12288:TI4L4oQI8Y0FotaKIUtrbMDp3zE1aaTJE5+/u9cejETeFxNM2f94vvQe6ERylT4O:+oL0otaYtXMDp3o1aKJY+/ufEWrMwiyh

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.zpba.malp.slga

pid process

5113 com.zpba.malp.slga
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.zpba.malp.slga

description ioc process

File opened for read /proc/cpuinfo com.zpba.malp.slga

pid	process
5113	com.zpba.malp.slga

description	ioc	process
File opened for read	/proc/cpuinfo	com.zpba.malp.slga

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.zpba.malp.slgacom.zpba.malp.slga:daemon

ioc	pid	process
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar	5113	com.zpba.malp.slga
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar	5214	com.zpba.malp.slga:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.zpba.malp.slga
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.zpba.malp.slga
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.zpba.malp.slga
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.zpba.malp.slga
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.zpba.malp.slga
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.zpba.malp.slga

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.zpba.malp.slga

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.zpba.malp.slga

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.zpba.malp.slga

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.zpba.malp.slga

com.zpba.malp.slga
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5113

com.zpba.malp.slga:daemon
1⤵
- Loads dropped Dex/Jar
PID:5214

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.zpba.malp.slga/app_mjf/ddz.jar

Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.zpba.malp.slga/app_mjf/oat/dz.jar.cur.prof

Filesize
734B

MD5
ad70d5493c5d67325ade40bfa925e7ca

SHA1
0b82a38ca1b2da0c4df4935d75ad36e3481aa616

SHA256
3053a0ea90d74afa8ad601c8b8b4d183a8a8b22e46efaa2ddcd4b7db54f7d9bc

SHA512
0b3af28049c57740b0186b8c53d8ad8c76d182245c98a19ebced66cd151194ed59cdd4217313be181ec2dbc65eadd0bad1efcff5a8f4b48c729349649274672d

Download Submit
/data/data/com.zpba.malp.slga/app_mjf/tdz.jar

Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd

Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal

Filesize
8KB

MD5
c7751a9f733c6c101016f1be4c6c3cd4

SHA1
b8ff34b4a888b14592fce7ccc74b9b6bc8434607

SHA256
ff2cf3e1ed360ec4d754d6a73dcf1310e71d70e14f66551fc2d61c37dfb3e186

SHA512
9423229cba0c952023782f52864693fb6bc881b071002803a181e80d41fa2a4d2391b0496bce9eb3c5a4dd6f03bda53068554987645a7c8c34155e51e7cc370e

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal

Filesize
8KB

MD5
e12dec0cf46d158fb29602691afae239

SHA1
51b87ff83bd3db4d40e58b9d84a524bde2d8c5b3

SHA256
2df7b41091dd0abe9929b2228a1f3501ba25579e108c061a267ad66361985870

SHA512
8fb2a86f424ca03c758bf6ded08e049775b7265d51408c9f4f00983644ec56da8871d8070b1ac18669778edb6d5f8a48b6b3d709cc892b569b26d4f62f76f29d

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal

Filesize
8KB

MD5
a93842d1b54995dec96856f5de446ffc

SHA1
71053c0055edfb30a0fb134f6c79f3e0b7a143ac

SHA256
0d5dd06b54ac6d94f81c27ccf840b0f0cfb81b12c66a3c097ade349325fd0f64

SHA512
c21e47095b30aba3918000b5a513109d7882e5833a4c3d159b128b5bb98556e5369737a61c5c30f1a7ac471b3645911bdd1a41aeb18cefa4091125eb855d8b2a

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal

Filesize
512B

MD5
f2d5dd016eee8d14374532e48c6a490d

SHA1
4487527b2fafce0dc266d2205cb7d57883f8946d

SHA256
a0ef78fa9ac78727f20057cca9af1ed2a06585190243ef2aa0bdf84497d35932

SHA512
c3ec2cc447f9407342f284bc2ddefb7590d742f8477a395fe4bc4ccddef816988a71927d97a084978f702204179b5d599057afbaec6216be07407512bec40863

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal

Filesize
8KB

MD5
df63fcba546e3d70f5be4b89f7644ce2

SHA1
ba28d1abddee981e935904e4439359f343e92034

SHA256
bc9cfe852621515f34493b535f1b3a948ce37f7a83adafea5e801afa450187d1

SHA512
3363b0729e0f51527ef845f3984b581afcea2d9dcbedf4a263a88fd7fe4decff3e2ec6e4fd79d58644a3e8b9d4dbfb1e2eabd69335c6703e17a0d24276d43bc9

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal

Filesize
4KB

MD5
ac6a8e96444f823153a76cbd4c574aa6

SHA1
0ee5cad98458e41e3437150cde824ee23be473d6

SHA256
0225778fe927d1eb25a4bb705fa645a7042984ee2f6990406b55e86bf4cd3149

SHA512
9342bb0806be0ba5ea0a6e2f2464a123b5b7aedba788e5754327ef8d521583a7c33e081e16db1f84e66e2df4b0aa40f0528782585c84bda98d035adc69e1d6fb

Download Submit
/data/data/com.zpba.malp.slga/files/.um/um_cache_1716226651351.env

Filesize
656B

MD5
ba02cb8b1dff18b594fd0cee6d208649

SHA1
ab766674179e4443bee805757a9a69eaa7da67f8

SHA256
e7a6c87141aaa0d5d32af259d2e78e6103466709d77959c82b53f345ba850869

SHA512
4844adee79fa32040308c6b2d386a07e95f96c26612c5ced9db6150f3688ac6d82545f3b25e41fb3f47b7fd6dbf57d295dabe8fd9b865ee2b7db22fb8164075d

Download Submit
/data/data/com.zpba.malp.slga/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
6c2de2f386d5409986f774abca33d46f

SHA1
3febb7aa788de27cc7a1427eef1b6bd3d7c07088

SHA256
4f866b14ac7192fd9daf185deeb09de753ae4dc56bbc34d9e3308a06a7dbcc06

SHA512
7af6525400df2baf09f2ab8e37ef5ae23e8bfce3a9d3139b958bf92e1c5b1d98c7209f1dd2a93a27766cfd7af674fd0e83367567c8ca22af347882a677debbcc

Download Submit
/data/data/com.zpba.malp.slga/files/mobclick_agent_cached_com.zpba.malp.slga1

Filesize
800B

MD5
a3593c2328a8ebc62438d4de47f5771f

SHA1
983af94afd6a140344ac224a4bfdb927f047913c

SHA256
e180d08bcaf537189c4b0206f7707ca0c8e3a0398554b2e154bee79e61ef3653

SHA512
bab1c501423730f5e0a9b8c836237db5fc53eacffb44386b7152e08478b856879fdc36eaa47ec2c8aeca8fc1abb95013368649f65173b74a511126eb59e36acd

Download Submit
/data/data/com.zpba.malp.slga/files/umeng_it.cache

Filesize
348B

MD5
1f58193a1da3197d4d465c7362ca3210

SHA1
87d97f21ad5015ff09fd389258bd6aed9b93b29c

SHA256
5ce86a30aec7fa377970943fbc71fd1800fb5528d24fd66ee131030d5d082f07

SHA512
2d211654c52b4b9dd7ef2b40e60333e7a00c0733291b48266e38a625b1b629f242e2a0974cb0e3ebd108e14cd8e3567f0a1b57d095ed1cab923a00d7fc130105

Download Submit
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar

Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit