705bce296406b2b3eac808f1bba499f13fb096a3ddda64ebee6754f09d7c28fd

Analysis

max time kernel
177s
max time network
178s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
21-05-2024 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61734b9c1ade7c87613bc4ab3f6a37f7_JaffaCakes118.apk
Size

1.3MB
MD5

61734b9c1ade7c87613bc4ab3f6a37f7
SHA1

83f91a1ab96f4d2dea38b1c0e4272d56e24f8f57
SHA256

705bce296406b2b3eac808f1bba499f13fb096a3ddda64ebee6754f09d7c28fd
SHA512

0ccd702d47dcccce9fdeb5152bcf7a039a68c560ba0fc15f725fa2473197c59551a20dd79a76ec45a23505d539ab122e08b2a08b8572b3106555ea6538baf50d
SSDEEP

24576:/oL0otaYtXMhe+8X3lUKfcfIkuovSp0ljbo+0wjEXoq/13tdHbZKm51Ob830:AQ7Yt3X1wvTvSpuj3ZjEXoq/1XHNKmjg

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.cepv.eiri.ouzu

pid process

4277 com.cepv.eiri.ouzu
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.cepv.eiri.ouzu

description ioc process

File opened for read /proc/cpuinfo com.cepv.eiri.ouzu

pid	process
4277	com.cepv.eiri.ouzu

description	ioc	process
File opened for read	/proc/cpuinfo	com.cepv.eiri.ouzu

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.cepv.eiri.ouzu/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&com.cepv.eiri.ouzucom.cepv.eiri.ouzu:daemon

ioc	pid	process
/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar	4315	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.cepv.eiri.ouzu/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar	4277	com.cepv.eiri.ouzu
/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar	4386	com.cepv.eiri.ouzu:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.cepv.eiri.ouzu
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.cepv.eiri.ouzu
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.cepv.eiri.ouzu
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.cepv.eiri.ouzu
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cepv.eiri.ouzu
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cepv.eiri.ouzu

com.cepv.eiri.ouzu
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4277

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.cepv.eiri.ouzu/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4315

com.cepv.eiri.ouzu:daemon
1⤵
- Loads dropped Dex/Jar
PID:4386

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cepv.eiri.ouzu/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.cepv.eiri.ouzu/app_mjf/oat/dz.jar.cur.prof
Filesize
550B

MD5
598289cdc29932b0bd870140f859c73a

SHA1
182f3e8eb28238ecd8b40b456efb5e01f15a8f59

SHA256
96ae0a25bd82c0f9057e747ebd38539eb66a9760ad6190dbbb832cfb4c1130ac

SHA512
7fd271fbfda7c471ae76d67842ced503048ba2ca307fc2713bf5c9c6e1c5895ddbddb7a7e3b63c3d1c3139d6bdd6acfcb2d691078e6a2807fd0b50d6ad03cfec

Download Submit
/data/data/com.cepv.eiri.ouzu/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal
Filesize
512B

MD5
27660441e044c2a6dfa1a40917beba48

SHA1
8a0bdcf92f1ac8e2b9862b011bcfec1cb2114713

SHA256
e0b5376870536cd473eff47bfd34f6d65158b47a74ce3c4a2a4f68af8ed8edfb

SHA512
f6d12ab11a487e15b9bbc04a95ad54580274dc175da905cf77beabb48cb29c321c8698d7c00c34ba3115581cff6aa97ecabfed5bc380d6123f0daf4d28913065

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-wal
Filesize
60KB

MD5
474dfcb05e46663928432a5e6b0dae6a

SHA1
193af185b76673194227059510cae2ceaceeb85b

SHA256
73a35d3649119250333575dd2c7676eb063f6e5e27b83feefe7cfe3381afdbb6

SHA512
d926ff1c487b083e6bf0e8d7e52438e6db9d6afaf41172f4574004ac20ef32cb9758aff54a21888cadc8961debfd035ba3c98af5520a9437404bf111b3053e0d

Download Submit
/data/data/com.cepv.eiri.ouzu/files/.um/um_cache_1716251329023.env
Filesize
681B

MD5
f8b46f4c5d26507f20eb467f54329a6b

SHA1
3fdb4ff68dce94b95d25f7b7e1d3ec3a25b0d6eb

SHA256
655d2064f80e2a34e0f7abd8982ac529a8b31d719900280ec96169dc31e5b436

SHA512
150ff29b9e477e8188902adcaffe163828d7980de300720bdf086b2a72ca146f9c1f7cf30c210ad0df771aa0a426d28eb3b0594ac3e375fc38287f6aeb2cf79f

Download Submit
/data/data/com.cepv.eiri.ouzu/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
4e300cb05697fbccb4249922075abe70

SHA1
9956e6c6edbfe6da2397d5cd94830a67b3a3368f

SHA256
19f6f444773b0f75392cb44bdbaf7b206409694eacb026c12e35d5f3ff17a313

SHA512
a3964dc16a64392d5787eac278d3439aeb58432ca93d000a8f1fcaa211967297ea5ff282552ebfa0fd383413a3f44fd5ecbe10307c066fe99dd91abb0853d56e

Download Submit
/data/data/com.cepv.eiri.ouzu/files/mobclick_agent_cached_com.cepv.eiri.ouzu1
Filesize
858B

MD5
a716353a600d2c6bc41afe1138806cb3

SHA1
4e244ea953e35cdc3c259e60f7371ed412e028e5

SHA256
8a3721aa22c24dd0317d6266d01b0f6169fe597d3fbda38c33995c1c80f4995f

SHA512
87d9e8ba68d4312720e75e2e2f81287a91551f8c19831d626d8c816fa2aab4b43ad733ff598dff7780d27871e83bc479085ecc2be24dca039e6f8d47fe40ca95

Download Submit
/data/data/com.cepv.eiri.ouzu/files/umeng_it.cache
Filesize
415B

MD5
5002bf3557953ffbc8158c2ba7664f67

SHA1
b54cb4e80c5be913c11d3aa599ede61bed4db171

SHA256
a26bbca3fa8603d1a8c277584950042f44b64bc25157306f0d414f720c9bebdf

SHA512
8431097482aa0486675b04390a3230b1f8e5e256b3631274e17fd6b6b139ba377dcdaa82db5e89c36daae9215517c41dde4f0aec492db274a86e4a031e63de85

Download Submit
/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar
Filesize
248KB

MD5
9b47e78a6ff90cce5755ce4742047627

SHA1
831b24aa9e116eb8d7065efd430088d419dfd6c7

SHA256
30d7699b73fd7f276945415c405c12bff69c5958d12f56265a768443f6fd8cae

SHA512
4587a5b26f13cbd0524eade71ed29203fc55029fe150fce850016aa7d9c578623cdc4b6a551bed3dec9e31a39563f8927cfcc9d21e2d83c2c781808b958446fc

Download Submit
/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit