23017cf18a4b707769ced016570ab097c5561f742ad9511a3d2f4871ebced3d6

Analysis

max time kernel
178s
max time network
184s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
21-05-2024 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64d9597adb9df9f9639d679625ce44f0_JaffaCakes118.apk
Size

1.3MB
MD5

64d9597adb9df9f9639d679625ce44f0
SHA1

0995b131d1caa8c08ed543dba50248cffa019ff2
SHA256

23017cf18a4b707769ced016570ab097c5561f742ad9511a3d2f4871ebced3d6
SHA512

0c42c5a2fd4ed2dd1522a116ac71f227c72df0fadfbad65e46078e996908fa9dfc909eefa7ab4e29adff430c10d94c23e14fe2907d7b934e612c083682e8d7d0
SSDEEP

24576:OoL0otaYtXMheC8X3lUKfcfIkuovSp0ojro+H8j/qZq/13tdHbZKm51Ob83L:dQ7YtbX1wvTvSpLjncj/qZq/1XHNKmjH

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.vpkv.iupn.kond

pid process

4490 com.vpkv.iupn.kond
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.vpkv.iupn.kond

description ioc process

File opened for read /proc/cpuinfo com.vpkv.iupn.kond

pid	process
4490	com.vpkv.iupn.kond

description	ioc	process
File opened for read	/proc/cpuinfo	com.vpkv.iupn.kond

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.vpkv.iupn.kondcom.vpkv.iupn.kond:daemon

ioc	pid	process
/data/user/0/com.vpkv.iupn.kond/app_mjf/dz.jar	4490	com.vpkv.iupn.kond
/data/user/0/com.vpkv.iupn.kond/app_mjf/dz.jar	4682	com.vpkv.iupn.kond:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.vpkv.iupn.kond

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.vpkv.iupn.kond
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.vpkv.iupn.kond

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.vpkv.iupn.kond
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.vpkv.iupn.kond

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.vpkv.iupn.kond
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.vpkv.iupn.kond

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.vpkv.iupn.kond
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.vpkv.iupn.kond

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.vpkv.iupn.kond

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.vpkv.iupn.kond

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.vpkv.iupn.kond

com.vpkv.iupn.kond
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4490

com.vpkv.iupn.kond:daemon
1⤵
- Loads dropped Dex/Jar
PID:4682

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.vpkv.iupn.kond/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/user/0/com.vpkv.iupn.kond/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit
/data/user/0/com.vpkv.iupn.kond/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/user/0/com.vpkv.iupn.kond/databases/lezzd
Filesize
28KB

MD5
fdb8a92e5060ce104e8f0faca55a47ce

SHA1
270d7ca30673e18cec1d2b9add71cba96dc426fe

SHA256
194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a

SHA512
ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

Download Submit
/data/user/0/com.vpkv.iupn.kond/databases/lezzd-journal
Filesize
8KB

MD5
e91757982ebd95d690a978654e91be32

SHA1
23ec2d0790c65b2178fed2da288667fe68eaa446

SHA256
52edbac3530caffc76c726f4abeeb742eddbd11bddd52289add989a1c426a9ea

SHA512
fa9f42039b4ffcf4b21387c5bb14e7664a9c9287622b7a548c61d029980280af1656a8f57f16bffc9234ef8bbb16c79861ebd160fff511e1fd60bb46ce481f02

Download Submit
/data/user/0/com.vpkv.iupn.kond/databases/lezzd-journal
Filesize
512B

MD5
4dd86803111083543c71573dbcfe776c

SHA1
db5e6b32f967815eb2e6f97be5772d34f6a79afb

SHA256
8278e7a463c521a6f28b113c7b9f60a0128d4dc87a9de3cbd318596b3e852ea9

SHA512
9f784c4035a45afb1185e70638a2ac836fe7403613834dc1d236d8644b0dde16321d8427e3dd9fe38d363fc4df15707a92fc9bb7148df8e5513ef86090ef628d

Download Submit
/data/user/0/com.vpkv.iupn.kond/databases/lezzd-journal
Filesize
8KB

MD5
087ccf0b03c350e7f53d4f41be5d45bf

SHA1
4989159e975413d3c26059d70fbbedcecec717ed

SHA256
5cf632793a48aa89edc263d586609c1613af14eaac100fe0aed28b1c8b320267

SHA512
2f14d8de88f9c03dc14839ebaace6fab671933bccf854453756160b9e8c725f3847fb0d7091b2fc714da0e0b5637abf97f49fb0e275f3ff687079645311a2cd5

Download Submit
/data/user/0/com.vpkv.iupn.kond/databases/lezzd-journal
Filesize
4KB

MD5
8ebbe686d37d51b1f98c1084020666a4

SHA1
5a83cb120fd96bc2629e51fc4e65101d840a0b5d

SHA256
48fcd0b0c19a0a79667539430b1e82ec2696b90dbf67a0683cb1ea0d5d8edc57

SHA512
ca5b5ee41161b63ee99a34631849e5b32b7276967d988df874ddb7836ba2c199b069ee414f6619b3f7edd78d8f340bd5799e5c71ab358ef790bcb270f5411f39

Download Submit
/data/user/0/com.vpkv.iupn.kond/databases/lezzd-journal
Filesize
8KB

MD5
970674b7e685a55204b9f86755b52d8e

SHA1
b0fe00feec63e17bcee58bb3dd30e4bcd227290c

SHA256
675fa0d8ddb97081477ff9d3aafb5448f8dabde4473eaceaf6f828d2d504ab2c

SHA512
c45978ce3084b8e8e984c821ee6418dcfe4547e5961fbcb1498227478045de54b1ef9b93cb8da71a7f14f065bab06216197fae14b4fe039e8beaffb108699647

Download Submit
/data/user/0/com.vpkv.iupn.kond/databases/lezzd-journal
Filesize
8KB

MD5
35cd8115952fc29df66baa66f4c745f1

SHA1
c41d3e21ba33716141f9bbcdd3002f7ada98e041

SHA256
6a5e1d30b3cb0f6e96b94d76e6c9fcdde51c46c1cd0e03ee1537cc5dc76ad21b

SHA512
8779c2b78736f26c4ea25863a99a229a94ddf4ed4eb12e979fb4e855c063f0f414a3fc39ce302804319ab0190626b3e7f44e7b8570f6c1ce30ac5c29b7b90a1e

Download Submit
/data/user/0/com.vpkv.iupn.kond/files/.um/um_cache_1716327575140.env
Filesize
656B

MD5
82b31918dd3c8e254d0178688511097d

SHA1
ae7e043c14196931fcd5553ff4d2354b7c81a1b2

SHA256
ccd3aa7ca1d6016ea949d78ea6bea699faf8fcc7eeecbaec3df20db1141540b4

SHA512
fbdf3faf02d5a196d90c642cf680ac83979597d8114c39775642b6dc25d62a90de7ec32f51c12074c4c5e0551680251a0d1b6963b9c79da1e8ed5b36208a7134

Download Submit
/data/user/0/com.vpkv.iupn.kond/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
a03e082fe00942976470d9ea80287aba

SHA1
c4d9995dc86198f4d66518bf54141ae7850bef17

SHA256
1d6e32785d9592d4f63901b172b74af5f22d03566cb70e6c8a2be11b87279d82

SHA512
dfbc3bfe839bbc2ceee7c001ba36de39105f9aa7361018cb9d2335c87761f820c0026c9c2d92f02a655caf731810e539041822a54da31d18824515c7430858bd

Download Submit
/data/user/0/com.vpkv.iupn.kond/files/umeng_it.cache
Filesize
352B

MD5
f2febbac739562603c23303681f0f495

SHA1
61358df43063c2db50563111b2e234baf54ce946

SHA256
5cf232e8927a3e7c59a45ca30bce02db6ef252cca86bd6846c772ba604660a12

SHA512
fd011113d703e89fab6aa3694ec76153e3ba34175bdab332b180a308f86f4d3df855a0f47a884aedea7d431b11eb4a47fc2f132554d5bf31d034feff920df9d0

Download Submit