705bce296406b2b3eac808f1bba499f13fb096a3ddda64ebee6754f09d7c28fd

Analysis

max time kernel
179s
max time network
180s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
21-05-2024 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61734b9c1ade7c87613bc4ab3f6a37f7_JaffaCakes118.apk
Size

1.3MB
MD5

61734b9c1ade7c87613bc4ab3f6a37f7
SHA1

83f91a1ab96f4d2dea38b1c0e4272d56e24f8f57
SHA256

705bce296406b2b3eac808f1bba499f13fb096a3ddda64ebee6754f09d7c28fd
SHA512

0ccd702d47dcccce9fdeb5152bcf7a039a68c560ba0fc15f725fa2473197c59551a20dd79a76ec45a23505d539ab122e08b2a08b8572b3106555ea6538baf50d
SSDEEP

24576:/oL0otaYtXMhe+8X3lUKfcfIkuovSp0ljbo+0wjEXoq/13tdHbZKm51Ob830:AQ7Yt3X1wvTvSpuj3ZjEXoq/1XHNKmjg

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.cepv.eiri.ouzu

pid process

5106 com.cepv.eiri.ouzu
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.cepv.eiri.ouzu

description ioc process

File opened for read /proc/cpuinfo com.cepv.eiri.ouzu

pid	process
5106	com.cepv.eiri.ouzu

description	ioc	process
File opened for read	/proc/cpuinfo	com.cepv.eiri.ouzu

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.cepv.eiri.ouzucom.cepv.eiri.ouzu:daemon

ioc	pid	process
/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar	5106	com.cepv.eiri.ouzu
/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar	5192	com.cepv.eiri.ouzu:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.cepv.eiri.ouzu
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.cepv.eiri.ouzu
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.cepv.eiri.ouzu
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.cepv.eiri.ouzu
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.cepv.eiri.ouzu

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cepv.eiri.ouzu
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.cepv.eiri.ouzu

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cepv.eiri.ouzu

com.cepv.eiri.ouzu
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5106

com.cepv.eiri.ouzu:daemon
1⤵
- Loads dropped Dex/Jar
PID:5192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cepv.eiri.ouzu/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.cepv.eiri.ouzu/app_mjf/oat/dz.jar.cur.prof
Filesize
724B

MD5
df1ff980a354417d0c471130c49de84a

SHA1
ec6f5a0c8501b74abb9b35ee5e72cc245be59a6f

SHA256
8628b7439382f5cf1d2ffc743a19cfb34ab6444186c21755c919b23586967cad

SHA512
4b1761a91eb352dcafad7e33405e9416028ad859e975a16d8a72cda68e9f6a10ba09de0e77e9a6d7518dc747d33546d31f9aa63803b319676bf0fa092e19e889

Download Submit
/data/data/com.cepv.eiri.ouzu/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal
Filesize
8KB

MD5
9694902cc45333e2edbe4386fad53934

SHA1
2bc98a97b3e99cdcc79d7b84df58d7d8c700a981

SHA256
5773af14615cdb787848f9857277e0ff16dd3e4b7b09873571fa85ecb4f7122f

SHA512
1428477d22df86bd38e7eccddbb2cc39553aa472a2ba4f7472a8160b50ab0aaed83e549d14133b104542f410deef96c88f4533d42f88e8730f696b51c1d03db9

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal
Filesize
512B

MD5
f11b1439a2300dc9acbdf4e606016aa5

SHA1
13552ff9d32dcde4a7f9220fc86e9c8d42d8c56f

SHA256
a7c8ac48f67958a835b8ee87af77234dcb60888ecb1993ade36871bc48a396ba

SHA512
db9a4192d210b3bbcddad54801ec4d509b833d7c2f6c993be38b8b882f2122712344dbfb2afd01d4a6a4f874be24965f2fdb4329b13a23fd11abe17d13f1bbd2

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal
Filesize
8KB

MD5
2c6a1197d81a9c2400768ed9208db5f2

SHA1
5c11c13a13c4f4f2c620cd5ee15c3e07102af3db

SHA256
d7f92e1619b2ccb31411ec1d45a2cbd3f89571cead229bca8077e9fdedad50ed

SHA512
aa441a43d6f993a0a4096ed094849af222b832ed2ee2f5d32c31cea8b36ad6b639b08b63caf9031f1d242f199b40cce1d0735c231045698516feb7d19a21e22f

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal
Filesize
4KB

MD5
d56c37662919684305e9034450745b7e

SHA1
f2c0491af1949080c315343b08d732b68bf42273

SHA256
55bf91ab9ad1b9a45da76fa334faa1738cdda92acb8798d4136cd7ba805a16ab

SHA512
b9aad5e77d36d2b99fa84360291b11f838d5e95f07abdbf1361c50ad3052221c7e5bfcd83b59b537073bc3a2ab7888135cc596a139def07b520043c57beb4115

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal
Filesize
8KB

MD5
568c7700023fe3b8a5a0762ad854aef5

SHA1
6e58deb577b4ef3c9540e305b78ea97abb95a139

SHA256
20cd07a7ed7e439d14a09db198c87d616106ae2a68eb42983214e2cf32b870ba

SHA512
6e614033cda6e461359d7f0ea8b7ab7b3befc3a6591308f518e8d3c524092606a6d59934b71233fae650f82637f5b341ba872cc022f652cc9ad08d38eea5e9fc

Download Submit
/data/data/com.cepv.eiri.ouzu/databases/lezzd-journal
Filesize
8KB

MD5
2f34313cd753e89685087f7981a8b1ea

SHA1
12c35f021b4bebfd0265904a868f60c6e8d98082

SHA256
49298be9a9e3189bd6dbfe1b0da16eb3b15e2aa7f6a65927b03f0485f72f6ada

SHA512
f2a442b6bd505ca6ad9aa484c962e9f746bb99c0ced92bd5cb8c98710d933de5f6534e8f57c24a0ad044e4b5bc2552bf472324b5600ba235e3682b85479eae84

Download Submit
/data/data/com.cepv.eiri.ouzu/files/.um/um_cache_1716251328683.env
Filesize
656B

MD5
9d57e30f89917168cd37ff14d1189c67

SHA1
773e98400fd2be09829a4ef820d402f8c5be4db8

SHA256
2855f618f80de5c3ab3cd9bdb7fe9c84764b2b9879a15ac26b805921eceea1af

SHA512
9c72ea29523aac8aa1e3295416b42e195becb3b85f4292e2ae43332ff6c6f689424df69d7bcf6d0f50701d7411e8f70c028ba4461b49b29b19c81ebc691b7142

Download Submit
/data/data/com.cepv.eiri.ouzu/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
9cc60f6560c2dcc5700f4b949f2ee264

SHA1
0a94495d7f8e934baa292f83fa5c1d87445be4f7

SHA256
d77db94b1bfb069a96fc68f3d9f27cef6c20eefb7b3493ef9512f50d7cf146c2

SHA512
e8a7495ef5d4399f002675f2f3fba86a3544d573a649b9aff934a411a5ea5db7490b77d4d7bad9aaaac535dd94b69139f1902859ea0ab85b3631cf0680a6b61f

Download Submit
/data/data/com.cepv.eiri.ouzu/files/mobclick_agent_cached_com.cepv.eiri.ouzu1
Filesize
798B

MD5
cbf70d70634bf49516d54ff0dc81c4cd

SHA1
b2ba95e11b026d6bd01c2193171683d59e4491dc

SHA256
2e7e542b0871117c91e54694566438837ca81f1ff660a623fb372d37d8327736

SHA512
4cb8b3c16ccc9a41c05b7613894921af0f1749677ec7113f56050a4cabb216e388b473369b0d62842be211e1af9a17d04c69d130c3bab0fe797b97fd51644024

Download Submit
/data/data/com.cepv.eiri.ouzu/files/umeng_it.cache
Filesize
352B

MD5
c3eb2369620376ee6d7feb84f741a8ef

SHA1
06232379523a76a288c6b2f5c84a72759d395dbc

SHA256
205a067604c98402ce3c988cdba4db5ba00d4fd8120adced3fa59a5cd6e3401a

SHA512
e82cb3603524967e828cd163fcae98b2645fc8a50a121e23536039933758ba614809c25b19a06da6c3d0288a736b54574758e15ae8852a4fc801b049e75a716f

Download Submit
/data/user/0/com.cepv.eiri.ouzu/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit