705bce296406b2b3eac808f1bba499f13fb096a3ddda64ebee6754f09d7c28fd

Analysis

max time kernel
179s
max time network
180s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
21-05-2024 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61734b9c1ade7c87613bc4ab3f6a37f7_JaffaCakes118.apk
Size

1.3MB
MD5

61734b9c1ade7c87613bc4ab3f6a37f7
SHA1

83f91a1ab96f4d2dea38b1c0e4272d56e24f8f57
SHA256

705bce296406b2b3eac808f1bba499f13fb096a3ddda64ebee6754f09d7c28fd
SHA512

0ccd702d47dcccce9fdeb5152bcf7a039a68c560ba0fc15f725fa2473197c59551a20dd79a76ec45a23505d539ab122e08b2a08b8572b3106555ea6538baf50d
SSDEEP

24576:/oL0otaYtXMhe+8X3lUKfcfIkuovSp0ljbo+0wjEXoq/13tdHbZKm51Ob830:AQ7Yt3X1wvTvSpuj3ZjEXoq/1XHNKmjg

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.cepv.eiri.ouzu

pid process

5106 com.cepv.eiri.ouzu
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.cepv.eiri.ouzu

description ioc process

File opened for read /proc/cpuinfo com.cepv.eiri.ouzu

pid	process
5106	com.cepv.eiri.ouzu

description	ioc	process
File opened for read	/proc/cpuinfo	com.cepv.eiri.ouzu

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.cepv.eiri.ouzucom.cepv.eiri.ouzu:daemon

ioc	pid	process
/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar	5106	com.cepv.eiri.ouzu
/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar	5192	com.cepv.eiri.ouzu:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.cepv.eiri.ouzu
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.cepv.eiri.ouzu
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.cepv.eiri.ouzu
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.cepv.eiri.ouzu
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cepv.eiri.ouzu
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cepv.eiri.ouzu

com.cepv.eiri.ouzu
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5106

com.cepv.eiri.ouzu:daemon
1⤵
- Loads dropped Dex/Jar
PID:5192

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cepv.eiri.ouzu/app_mjf/ddz.jar

Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.cepv.eiri.ouzu/app_mjf/oat/dz.jar.cur.prof

Filesize
724B

MD5
df1ff980a354417d0c471130c49de84a

SHA1
ec6f5a0c8501b74abb9b35ee5e72cc245be59a6f

SHA256
8628b7439382f5cf1d2ffc743a19cfb34ab6444186c21755c919b23586967cad

SHA512
4b1761a91eb352dcafad7e33405e9416028ad859e975a16d8a72cda68e9f6a10ba09de0e77e9a6d7518dc747d33546d31f9aa63803b319676bf0fa092e19e889

Download Submit
/data/data/com.cepv.eiri.ouzu/app_mjf/tdz.jar

Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd

Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal

Filesize
8KB

MD5
9694902cc45333e2edbe4386fad53934

SHA1
2bc98a97b3e99cdcc79d7b84df58d7d8c700a981

SHA256
5773af14615cdb787848f9857277e0ff16dd3e4b7b09873571fa85ecb4f7122f

SHA512
1428477d22df86bd38e7eccddbb2cc39553aa472a2ba4f7472a8160b50ab0aaed83e549d14133b104542f410deef96c88f4533d42f88e8730f696b51c1d03db9

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal

Filesize
512B

MD5
f11b1439a2300dc9acbdf4e606016aa5

SHA1
13552ff9d32dcde4a7f9220fc86e9c8d42d8c56f

SHA256
a7c8ac48f67958a835b8ee87af77234dcb60888ecb1993ade36871bc48a396ba

SHA512
db9a4192d210b3bbcddad54801ec4d509b833d7c2f6c993be38b8b882f2122712344dbfb2afd01d4a6a4f874be24965f2fdb4329b13a23fd11abe17d13f1bbd2

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal

Filesize
8KB

MD5
2c6a1197d81a9c2400768ed9208db5f2

SHA1
5c11c13a13c4f4f2c620cd5ee15c3e07102af3db

SHA256
d7f92e1619b2ccb31411ec1d45a2cbd3f89571cead229bca8077e9fdedad50ed

SHA512
aa441a43d6f993a0a4096ed094849af222b832ed2ee2f5d32c31cea8b36ad6b639b08b63caf9031f1d242f199b40cce1d0735c231045698516feb7d19a21e22f

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal

Filesize
4KB

MD5
d56c37662919684305e9034450745b7e

SHA1
f2c0491af1949080c315343b08d732b68bf42273

SHA256
55bf91ab9ad1b9a45da76fa334faa1738cdda92acb8798d4136cd7ba805a16ab

SHA512
b9aad5e77d36d2b99fa84360291b11f838d5e95f07abdbf1361c50ad3052221c7e5bfcd83b59b537073bc3a2ab7888135cc596a139def07b520043c57beb4115

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal

Filesize
8KB

MD5
568c7700023fe3b8a5a0762ad854aef5

SHA1
6e58deb577b4ef3c9540e305b78ea97abb95a139

SHA256
20cd07a7ed7e439d14a09db198c87d616106ae2a68eb42983214e2cf32b870ba

SHA512
6e614033cda6e461359d7f0ea8b7ab7b3befc3a6591308f518e8d3c524092606a6d59934b71233fae650f82637f5b341ba872cc022f652cc9ad08d38eea5e9fc

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal

Filesize
8KB

MD5
2f34313cd753e89685087f7981a8b1ea

SHA1
12c35f021b4bebfd0265904a868f60c6e8d98082

SHA256
49298be9a9e3189bd6dbfe1b0da16eb3b15e2aa7f6a65927b03f0485f72f6ada

SHA512
f2a442b6bd505ca6ad9aa484c962e9f746bb99c0ced92bd5cb8c98710d933de5f6534e8f57c24a0ad044e4b5bc2552bf472324b5600ba235e3682b85479eae84

Download Submit
/data/data/com.cepv.eiri.ouzu/files/.um/um_cache_1716251328683.env

Filesize
656B

MD5
9d57e30f89917168cd37ff14d1189c67

SHA1
773e98400fd2be09829a4ef820d402f8c5be4db8

SHA256
2855f618f80de5c3ab3cd9bdb7fe9c84764b2b9879a15ac26b805921eceea1af

SHA512
9c72ea29523aac8aa1e3295416b42e195becb3b85f4292e2ae43332ff6c6f689424df69d7bcf6d0f50701d7411e8f70c028ba4461b49b29b19c81ebc691b7142

Download Submit
/data/data/com.cepv.eiri.ouzu/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
9cc60f6560c2dcc5700f4b949f2ee264

SHA1
0a94495d7f8e934baa292f83fa5c1d87445be4f7

SHA256
d77db94b1bfb069a96fc68f3d9f27cef6c20eefb7b3493ef9512f50d7cf146c2

SHA512
e8a7495ef5d4399f002675f2f3fba86a3544d573a649b9aff934a411a5ea5db7490b77d4d7bad9aaaac535dd94b69139f1902859ea0ab85b3631cf0680a6b61f

Download Submit
/data/data/com.cepv.eiri.ouzu/files/mobclick_agent_cached_com.cepv.eiri.ouzu1

Filesize
798B

MD5
cbf70d70634bf49516d54ff0dc81c4cd

SHA1
b2ba95e11b026d6bd01c2193171683d59e4491dc

SHA256
2e7e542b0871117c91e54694566438837ca81f1ff660a623fb372d37d8327736

SHA512
4cb8b3c16ccc9a41c05b7613894921af0f1749677ec7113f56050a4cabb216e388b473369b0d62842be211e1af9a17d04c69d130c3bab0fe797b97fd51644024

Download Submit
/data/data/com.cepv.eiri.ouzu/files/umeng_it.cache

Filesize
352B

MD5
c3eb2369620376ee6d7feb84f741a8ef

SHA1
06232379523a76a288c6b2f5c84a72759d395dbc

SHA256
205a067604c98402ce3c988cdba4db5ba00d4fd8120adced3fa59a5cd6e3401a

SHA512
e82cb3603524967e828cd163fcae98b2645fc8a50a121e23536039933758ba614809c25b19a06da6c3d0288a736b54574758e15ae8852a4fc801b049e75a716f

Download Submit
/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar

Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit