43c9703326164f014bb317e79cd79585245259e18e6d4af32b7735b6da5dd2d6

Analysis

max time kernel
178s
max time network
182s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
21-05-2024 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6478d00b69e5c2561bd38d29f2813fa2_JaffaCakes118.apk
Size

1.3MB
MD5

6478d00b69e5c2561bd38d29f2813fa2
SHA1

c9ae761853f981f359a466217cbee390f23fd97b
SHA256

43c9703326164f014bb317e79cd79585245259e18e6d4af32b7735b6da5dd2d6
SHA512

b0dca0d2c2008b1211197e6debf026c21f296e3834c28b6c1d9e35ab0d774f5b57e5ad54170071a845fd2b02d4abf520cbb90c66753f0fdf192c1353f8f4d105
SSDEEP

24576:loL0otaYtXMLeE2sepAvb6vsm0ZGpUvb+jno+G8jy9Wq/13tdHbZKm51Ob83B:2Q7YtcFeGv0sKUvb+jbPjy9Wq/1XHNKw

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.tbus.dlqa.exsn

pid process

5113 com.tbus.dlqa.exsn
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.tbus.dlqa.exsn

description ioc process

File opened for read /proc/cpuinfo com.tbus.dlqa.exsn

pid	process
5113	com.tbus.dlqa.exsn

description	ioc	process
File opened for read	/proc/cpuinfo	com.tbus.dlqa.exsn

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.tbus.dlqa.exsncom.tbus.dlqa.exsn:daemon

ioc	pid	process
/data/user/0/com.tbus.dlqa.exsn/app_mjf/dz.jar	5113	com.tbus.dlqa.exsn
/data/user/0/com.tbus.dlqa.exsn/app_mjf/dz.jar	5227	com.tbus.dlqa.exsn:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.tbus.dlqa.exsn

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.tbus.dlqa.exsn
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.tbus.dlqa.exsn

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.tbus.dlqa.exsn
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.tbus.dlqa.exsn

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tbus.dlqa.exsn
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.tbus.dlqa.exsn

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.tbus.dlqa.exsn
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.tbus.dlqa.exsn

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.tbus.dlqa.exsn
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.tbus.dlqa.exsn

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tbus.dlqa.exsn

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tbus.dlqa.exsn

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.tbus.dlqa.exsn

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tbus.dlqa.exsn

com.tbus.dlqa.exsn
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5113

com.tbus.dlqa.exsn:daemon
1⤵
- Loads dropped Dex/Jar
PID:5227

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tbus.dlqa.exsn/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.tbus.dlqa.exsn/app_mjf/oat/dz.jar.cur.prof
Filesize
728B

MD5
a87dc1222e6546c25bd22b812f178fe6

SHA1
a7ff038b70956810393286e7548b0520db8b0fec

SHA256
6c57fb585b9619a0b77b41356f48ffe452d24bc8824eb273facb7952e208997f

SHA512
4fd4fc5fb5cad953ac9e1240526c3ad3f864d197b08bf98713b70992ba1d5def64aa3d104786fd16828cb5e064cd931893c11189b4f8d82bc701d01a62bb4d1d

Download Submit
/data/data/com.tbus.dlqa.exsn/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.tbus.dlqa.exsn/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.tbus.dlqa.exsn/databases/lezzd-journal
Filesize
8KB

MD5
ea3899f9b4526cd0c3f1616ff6726ff1

SHA1
3136ce626f1ddea6851aa02840cbae8243367615

SHA256
e358925a30dec6743dbe177e2d02bd76729e2ea6cf61ac01c407614d3d13ea4e

SHA512
cb40df53689f41c599d0c2f4d495ef44b11a498cd7a72895107f10f397c3f8c780971dc2079bdd8933b083d53f995b83935df0c610826c762a23a3984aaa1e35

Download Submit
/data/data/com.tbus.dlqa.exsn/databases/lezzd-journal
Filesize
512B

MD5
b02f5d998229f5b0e76f94f271ee1cdc

SHA1
c988f2f08e950e1e6cd6870584d2d45f5e223916

SHA256
26cf0056ce63553b86daacbc86427b9572687f4bfc012b39f8124938fc6523ad

SHA512
d1dd72b1d30516f649241d4acb31f77d34ac589239457a15eeb2330da687b5bb0c5a30e472ad1a0366b528d541f425554881812a5b82567c0ec68e78215ac0d5

Download Submit
/data/data/com.tbus.dlqa.exsn/databases/lezzd-journal
Filesize
8KB

MD5
75d451bcc1fe33199c20be4d90984d42

SHA1
a0e18d94f9e365ec38e6d54723bd49d2d700fc68

SHA256
a6bae04ff8e70ecb1655558edb4eade22d772429088d25934d6041b9178b233c

SHA512
8ff02fe60153dd3a011ddaf22d58891053c7ead5a3026e0f03c82e343a818c8296bb1eb96f9bdc027f20013f6e77fd44d3f7ad9cd09bed6010af3e16e6634e92

Download Submit
/data/data/com.tbus.dlqa.exsn/databases/lezzd-journal
Filesize
4KB

MD5
e117758b77a69b369096d05d36cc33dd

SHA1
6839f5312e9b143da1f342b6eb5520e02ec0a853

SHA256
a12e9534eebc9cdda3f29032c270497a48de9ab08f13b258eda1d32afe80f237

SHA512
0105cb83a81124cb4afac328a9f3f138680f31c38757b2d5a5d7d4efc64456ec090258ed85b06501f6ecc0b2333c6833e9a3697881ca394b0256e79d9c2b5d87

Download Submit
/data/data/com.tbus.dlqa.exsn/databases/lezzd-journal
Filesize
8KB

MD5
63b706b5f8208919258941f854a355ba

SHA1
ecd722eb17fe5d0c20a08415e02ef62474f6814b

SHA256
770697cf02ca34e914c412162c8e86a74fc236401981622d6e9a47a6edb56a1d

SHA512
586440244e848d9c0e3dff8e61fd5c59afba7d642c2697adae8ca6efdec0bd60ddd9dd54d5969f8f92933ce54a082a99006fb383e1f627b93ed74273e3a6f17a

Download Submit
/data/data/com.tbus.dlqa.exsn/databases/lezzd-journal
Filesize
8KB

MD5
1752279dbf86c144e0bacd0c3f217d0b

SHA1
510b615465308aeb933f09a776f33d7bd6cc21c7

SHA256
589738bd365f4e3f06408f4d5b1d88d8b7355463b96e48fe7300e08ff001b3e1

SHA512
446ce70c51cb6075e6dccfbd0b8c718a26a7b4a8a659a89275afa3638908c791373d65b71e409aa394f5e5bb87d689ad162a54c52e531506d4a295ef6ba49570

Download Submit
/data/data/com.tbus.dlqa.exsn/files/.imprint
Filesize
944B

MD5
3997c523ca234c08afda9d988fa167fd

SHA1
de2d384bbfe5af4ba818e7c0a25a682f1d8dcb25

SHA256
eb550e922b9ba26be125df82286e8735759c088b61ca55179b1fc8b0215c42af

SHA512
01990b1a787d09c3730ed6ecbc50903bb07f3cfbda4bd2e6735200ecf7c780e97c7cb75a66d1a3564ebb19037286481c09f6802fa5c5fb8b195621577b22ef77

Download Submit
/data/data/com.tbus.dlqa.exsn/files/.um/um_cache_1716319573074.env
Filesize
1KB

MD5
396a8d64129ba41f25a60be21faa2367

SHA1
13f7bc4e8996ba765ede26c7e5cea47e1f763c1f

SHA256
a52c53a92c9a7cdfd2e9725378a5be79f459377acdc55ee5f99d90b3487326d8

SHA512
f2cd873d49e3d1ec7182822a01d157e062a01f03b76ec64cd56d928759cecc7dcfe65c4a56b98035a6ac1b632d90621252ed4e2baca273372adcb7d798f324c4

Download Submit
/data/data/com.tbus.dlqa.exsn/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
1cf2bbfe71e5c931b4943a505a9e238d

SHA1
83fa1938dad562dfb4e3d86df26ddc4ba2f58350

SHA256
693095c210b1077becb9c89d5b8ed7c6289864fc60aad90de4951dea4d5fa39b

SHA512
336c34b1d1b3bfe6175999bae3a01bd8bf662ab9215ad051f22e4878f20beff3fb875c117281046679e138c92b0422bf65681928481131396f6689dfddf01215

Download Submit
/data/data/com.tbus.dlqa.exsn/files/.umeng/exchangeIdentity.json
Filesize
203B

MD5
ffd1dbca7e45305fd6c94b80cbde9b95

SHA1
d4a4916d065add034e812b67882b3b012579ebf3

SHA256
74ea0cb6935bf78fa4a82c87e61adf085028d6f2818fe4ddca5c796441696f1b

SHA512
15507ef06e73443119f1b6779da2b6ba42c020770252740e44c8bf22c481cdab28b8f4c57c1daea45fe457c394ba6221db952b4c26c630678482f1144884a4ab

Download Submit
/data/data/com.tbus.dlqa.exsn/files/umeng_it.cache
Filesize
350B

MD5
099dfeb47289057bac679bbed1a0b745

SHA1
4372c7845e7406939f2a6c622230e0670882e150

SHA256
73b5f6274bb3ed4afc0b21370d23cad4e87b789bd50bdcfc6d5d9c16d634915e

SHA512
70e0401f1860d3b5074f380cd165c3dc8809e2979e940fb64675b23bde8d086fa3040ac51446fcd16e45b7d2b340a696b990e22c5eb94291bec43c28e2fe6a12

Download Submit
/data/data/com.tbus.dlqa.exsn/files/umeng_it.cache
Filesize
178B

MD5
87658b08d9c74fc08f52fdff46ae6795

SHA1
ef035bb9cc69ac4c630816c511b09e33199d6999

SHA256
a5b5b5d0702874710172a330fd3b56735da49976e54dbe7bc5faee9cd6e9b67c

SHA512
7075a7e1ca209b5597ea34d61181d0864d92688af1d76a19bdccf91c70e3d37f121a457624315f0d9ed103645a0c7cc1ad8571cf86659d3497959e2c178ffad1

Download Submit
/data/user/0/com.tbus.dlqa.exsn/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit