14e4e6112ade7224ac5fcf612a536601db5b24ea87c97a753175c44e9b8e9560

Analysis

max time kernel
178s
max time network
186s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
20-05-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6057c23c1a28a8e0111bc472b542b042_JaffaCakes118.apk
Size

637KB
MD5

6057c23c1a28a8e0111bc472b542b042
SHA1

a79b3d0ad77085cb45dd7684e820daa614acf9c0
SHA256

14e4e6112ade7224ac5fcf612a536601db5b24ea87c97a753175c44e9b8e9560
SHA512

158f4e6b93487ee1fc6612f97d77758974d3f7bd73746c9728af6c25a40220677dbcfeef8413c5dcdb168ee69d2afd5aba7a65f87be621855d675c399c598940
SSDEEP

12288:TI4L4oQI8Y0FotaKIUtrbMDp3zE1aaTJE5+/u9cejETeFxNM2f94vvQe6ERylT4O:+oL0otaYtXMDp3o1aKJY+/ufEWrMwiyh

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.zpba.malp.slga

pid process

5113 com.zpba.malp.slga
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.zpba.malp.slga

description ioc process

File opened for read /proc/cpuinfo com.zpba.malp.slga

pid	process
5113	com.zpba.malp.slga

description	ioc	process
File opened for read	/proc/cpuinfo	com.zpba.malp.slga

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.zpba.malp.slgacom.zpba.malp.slga:daemon

ioc	pid	process
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar	5113	com.zpba.malp.slga
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar	5214	com.zpba.malp.slga:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.zpba.malp.slga
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.zpba.malp.slga
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.zpba.malp.slga
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.zpba.malp.slga
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.zpba.malp.slga

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.zpba.malp.slga
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.zpba.malp.slga

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.zpba.malp.slga

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.zpba.malp.slga

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.zpba.malp.slga

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.zpba.malp.slga

com.zpba.malp.slga
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5113

com.zpba.malp.slga:daemon
1⤵
- Loads dropped Dex/Jar
PID:5214

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.zpba.malp.slga/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.zpba.malp.slga/app_mjf/oat/dz.jar.cur.prof
Filesize
734B

MD5
ad70d5493c5d67325ade40bfa925e7ca

SHA1
0b82a38ca1b2da0c4df4935d75ad36e3481aa616

SHA256
3053a0ea90d74afa8ad601c8b8b4d183a8a8b22e46efaa2ddcd4b7db54f7d9bc

SHA512
0b3af28049c57740b0186b8c53d8ad8c76d182245c98a19ebced66cd151194ed59cdd4217313be181ec2dbc65eadd0bad1efcff5a8f4b48c729349649274672d

Download Submit
/data/data/com.zpba.malp.slga/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal
Filesize
8KB

MD5
c7751a9f733c6c101016f1be4c6c3cd4

SHA1
b8ff34b4a888b14592fce7ccc74b9b6bc8434607

SHA256
ff2cf3e1ed360ec4d754d6a73dcf1310e71d70e14f66551fc2d61c37dfb3e186

SHA512
9423229cba0c952023782f52864693fb6bc881b071002803a181e80d41fa2a4d2391b0496bce9eb3c5a4dd6f03bda53068554987645a7c8c34155e51e7cc370e

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal
Filesize
8KB

MD5
e12dec0cf46d158fb29602691afae239

SHA1
51b87ff83bd3db4d40e58b9d84a524bde2d8c5b3

SHA256
2df7b41091dd0abe9929b2228a1f3501ba25579e108c061a267ad66361985870

SHA512
8fb2a86f424ca03c758bf6ded08e049775b7265d51408c9f4f00983644ec56da8871d8070b1ac18669778edb6d5f8a48b6b3d709cc892b569b26d4f62f76f29d

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal
Filesize
8KB

MD5
a93842d1b54995dec96856f5de446ffc

SHA1
71053c0055edfb30a0fb134f6c79f3e0b7a143ac

SHA256
0d5dd06b54ac6d94f81c27ccf840b0f0cfb81b12c66a3c097ade349325fd0f64

SHA512
c21e47095b30aba3918000b5a513109d7882e5833a4c3d159b128b5bb98556e5369737a61c5c30f1a7ac471b3645911bdd1a41aeb18cefa4091125eb855d8b2a

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal
Filesize
512B

MD5
f2d5dd016eee8d14374532e48c6a490d

SHA1
4487527b2fafce0dc266d2205cb7d57883f8946d

SHA256
a0ef78fa9ac78727f20057cca9af1ed2a06585190243ef2aa0bdf84497d35932

SHA512
c3ec2cc447f9407342f284bc2ddefb7590d742f8477a395fe4bc4ccddef816988a71927d97a084978f702204179b5d599057afbaec6216be07407512bec40863

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal
Filesize
8KB

MD5
df63fcba546e3d70f5be4b89f7644ce2

SHA1
ba28d1abddee981e935904e4439359f343e92034

SHA256
bc9cfe852621515f34493b535f1b3a948ce37f7a83adafea5e801afa450187d1

SHA512
3363b0729e0f51527ef845f3984b581afcea2d9dcbedf4a263a88fd7fe4decff3e2ec6e4fd79d58644a3e8b9d4dbfb1e2eabd69335c6703e17a0d24276d43bc9

Download Submit
/data/data/com.zpba.malp.slga/databases/lezzd-journal
Filesize
4KB

MD5
ac6a8e96444f823153a76cbd4c574aa6

SHA1
0ee5cad98458e41e3437150cde824ee23be473d6

SHA256
0225778fe927d1eb25a4bb705fa645a7042984ee2f6990406b55e86bf4cd3149

SHA512
9342bb0806be0ba5ea0a6e2f2464a123b5b7aedba788e5754327ef8d521583a7c33e081e16db1f84e66e2df4b0aa40f0528782585c84bda98d035adc69e1d6fb

Download Submit
/data/data/com.zpba.malp.slga/files/.um/um_cache_1716226651351.env
Filesize
656B

MD5
ba02cb8b1dff18b594fd0cee6d208649

SHA1
ab766674179e4443bee805757a9a69eaa7da67f8

SHA256
e7a6c87141aaa0d5d32af259d2e78e6103466709d77959c82b53f345ba850869

SHA512
4844adee79fa32040308c6b2d386a07e95f96c26612c5ced9db6150f3688ac6d82545f3b25e41fb3f47b7fd6dbf57d295dabe8fd9b865ee2b7db22fb8164075d

Download Submit
/data/data/com.zpba.malp.slga/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
6c2de2f386d5409986f774abca33d46f

SHA1
3febb7aa788de27cc7a1427eef1b6bd3d7c07088

SHA256
4f866b14ac7192fd9daf185deeb09de753ae4dc56bbc34d9e3308a06a7dbcc06

SHA512
7af6525400df2baf09f2ab8e37ef5ae23e8bfce3a9d3139b958bf92e1c5b1d98c7209f1dd2a93a27766cfd7af674fd0e83367567c8ca22af347882a677debbcc

Download Submit
/data/data/com.zpba.malp.slga/files/mobclick_agent_cached_com.zpba.malp.slga1
Filesize
800B

MD5
a3593c2328a8ebc62438d4de47f5771f

SHA1
983af94afd6a140344ac224a4bfdb927f047913c

SHA256
e180d08bcaf537189c4b0206f7707ca0c8e3a0398554b2e154bee79e61ef3653

SHA512
bab1c501423730f5e0a9b8c836237db5fc53eacffb44386b7152e08478b856879fdc36eaa47ec2c8aeca8fc1abb95013368649f65173b74a511126eb59e36acd

Download Submit
/data/data/com.zpba.malp.slga/files/umeng_it.cache
Filesize
348B

MD5
1f58193a1da3197d4d465c7362ca3210

SHA1
87d97f21ad5015ff09fd389258bd6aed9b93b29c

SHA256
5ce86a30aec7fa377970943fbc71fd1800fb5528d24fd66ee131030d5d082f07

SHA512
2d211654c52b4b9dd7ef2b40e60333e7a00c0733291b48266e38a625b1b629f242e2a0974cb0e3ebd108e14cd8e3567f0a1b57d095ed1cab923a00d7fc130105

Download Submit
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit