99fd4397853f9858fa1cac86414ff2d671cbc4ca75bb95b2633db5bbb5f9abee

Analysis

max time kernel
179s
max time network
158s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
25-05-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72c97d9a34bb1088759ed49067ec62bf_JaffaCakes118.apk
Size

1.3MB
MD5

72c97d9a34bb1088759ed49067ec62bf
SHA1

55acc083624c90f25c90e875b89a04e134b80fe9
SHA256

99fd4397853f9858fa1cac86414ff2d671cbc4ca75bb95b2633db5bbb5f9abee
SHA512

0bfab357bda569fb730c4161a3e15efd4e1a064a8cec57571e26e5eddc7eba2d07441c444310c32395d8bbf0581ca36cda2a9c8146766809758cc8d1129e470a
SSDEEP

24576:JoL0otaYtXMjG6dJZXs+bS8oaPnDAUCxFMMjfo+B4jVAnq/13tdHbZKm51Ob83J1:CQ7YtSdJZJboaPDAUcFzjjyjVAnq/1Xj

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.nmhs.tpjr.yopk

pid process

5177 com.nmhs.tpjr.yopk
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.nmhs.tpjr.yopk

description ioc process

File opened for read /proc/cpuinfo com.nmhs.tpjr.yopk

pid	process
5177	com.nmhs.tpjr.yopk

description	ioc	process
File opened for read	/proc/cpuinfo	com.nmhs.tpjr.yopk

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.nmhs.tpjr.yopkcom.nmhs.tpjr.yopk:daemon

ioc	pid	process
/data/user/0/com.nmhs.tpjr.yopk/app_mjf/dz.jar	5177	com.nmhs.tpjr.yopk
/data/user/0/com.nmhs.tpjr.yopk/app_mjf/dz.jar	5237	com.nmhs.tpjr.yopk:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.nmhs.tpjr.yopk

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.nmhs.tpjr.yopk
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.nmhs.tpjr.yopk

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.nmhs.tpjr.yopk
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.nmhs.tpjr.yopk

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.nmhs.tpjr.yopk
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.nmhs.tpjr.yopk

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.nmhs.tpjr.yopk
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.nmhs.tpjr.yopk

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.nmhs.tpjr.yopk
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

Processes:

flow ioc

39 alog.umeng.com
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.nmhs.tpjr.yopk

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nmhs.tpjr.yopk

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.nmhs.tpjr.yopk

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.nmhs.tpjr.yopk

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nmhs.tpjr.yopk

flow	ioc
39	alog.umeng.com

com.nmhs.tpjr.yopk
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5177

com.nmhs.tpjr.yopk:daemon
1⤵
- Loads dropped Dex/Jar
PID:5237

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nmhs.tpjr.yopk/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.nmhs.tpjr.yopk/app_mjf/oat/dz.jar.cur.prof
Filesize
724B

MD5
df1ff980a354417d0c471130c49de84a

SHA1
ec6f5a0c8501b74abb9b35ee5e72cc245be59a6f

SHA256
8628b7439382f5cf1d2ffc743a19cfb34ab6444186c21755c919b23586967cad

SHA512
4b1761a91eb352dcafad7e33405e9416028ad859e975a16d8a72cda68e9f6a10ba09de0e77e9a6d7518dc747d33546d31f9aa63803b319676bf0fa092e19e889

Download Submit
/data/data/com.nmhs.tpjr.yopk/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.nmhs.tpjr.yopk/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.nmhs.tpjr.yopk/databases/lezzd-journal
Filesize
8KB

MD5
96609b568db0fc4f0e7406ce8f13a09c

SHA1
a6bff22b934d363ca522336505cc0418f71ccd2c

SHA256
0bc22e92c57552011c5813287872a1ce6c2fa6c473a69211dfded47672e56752

SHA512
73ce8fae5d51697f8eaa9e36b2b069594a39557e75bcd4f8de72c1adf756e05fd278381084a27d01318681a4e11c6386ed7bf8637bdf079867dd98503fdd1740

Download Submit
/data/data/com.nmhs.tpjr.yopk/databases/lezzd-journal
Filesize
512B

MD5
15fd08e9882671c0466ed31b0a9409c4

SHA1
1fc3e4125702bb0693d27ea06b65ac0345259305

SHA256
ef3260ad1e52f4c10b5c2d4d7b22420974afc0321c9c261785c143139f4ece64

SHA512
69ec882425288d5d72e4aebeb9f07292693b140de771ca5b1fd80faa8e72368114682f0f6e31a0429a970af5cb60ae7d70239fca5c9f9c274b9c7033c958c8bf

Download Submit
/data/data/com.nmhs.tpjr.yopk/databases/lezzd-journal
Filesize
8KB

MD5
e47c4a93c07b2d7b855f0f58700f8331

SHA1
64e96b16fe3b83f6e0270c0916c12cffa535d6a9

SHA256
ea52e51074a2f92d7a87b8b42af2e6de4a04082e60469ebb8869bbe0d88c1b82

SHA512
72bb9cffda57cd2c1f60d6cfcda32a32d71ebd1875eca7b24852f06f62ac89fa06060db6adaf60d5a5505ddefa024307cf5212d597338e54cf00e02bca8860c7

Download Submit
/data/data/com.nmhs.tpjr.yopk/databases/lezzd-journal
Filesize
4KB

MD5
d6a34d12b522ac6024293192ee1432a2

SHA1
d99a73d13b42f01373c95352254202a82bcf3d8b

SHA256
23a894f45f4ab0c5bd5b98472b6549220e8be47fe8c159c475a634a904951056

SHA512
d41d264c595d19140f91b2780b3115baf053e300dd011e895526a991fde0cb2218327f05b07b212b20436099d2b3e029ae34dcbae8f772ed7c1fdcb6bdb087c8

Download Submit
/data/data/com.nmhs.tpjr.yopk/databases/lezzd-journal
Filesize
8KB

MD5
28c70e947f24abac071b2697a31ccfcd

SHA1
f0accbc2554183147d7f1907f0ac4fb907692cb6

SHA256
05a270d2e4d96362e9ba80bb365dd8372b8fd7f5dce396999c0c222adf00c743

SHA512
b7969a225fc11f6963002d45455dc6d45d7edce0a8b48847ccd85bcc89449b6ead81a51ce9fe64b98653a8bb68612e65ebc1b54e2cd09695f56a51dcebbc9cd5

Download Submit
/data/data/com.nmhs.tpjr.yopk/databases/lezzd-journal
Filesize
8KB

MD5
3c3cc7b3cace0b2cc068d5749c7cf021

SHA1
a93f69afb793bd691201ab8bef1b04fd138e1910

SHA256
56c5bfc11688401f37d65f75a9e7dde2be1e0940a4209b6871758198fe2d480e

SHA512
cc9b40a0d10c830c3293a509f7df13cf1350b6ac2507a2b80279f614ff916142f8876632d8905bda4df7217dd6041d91837b16617931639dac3dfc48a24291e6

Download Submit
/data/data/com.nmhs.tpjr.yopk/files/.imprint
Filesize
945B

MD5
e5f609ff3cf9b7591ce8c4112c7664c8

SHA1
20543960b5ab07345726358afef7391cdf3b9c97

SHA256
e939616ce3bcb5582d72d3b63b46fa83820a67ccd665409178af40f1e217bd56

SHA512
20cc4f98f5a41c218adc7be69ab832e641a952e3d0dfe5aa7fe6eddb877f7dac38282b27c6265e61b73f1220057072113f523d9a431e4f03c12bf274d5aa3849

Download Submit
/data/data/com.nmhs.tpjr.yopk/files/.um/um_cache_1716659939696.env
Filesize
658B

MD5
491932623a02f84d3109fcbd30e6e811

SHA1
a5d91e904ec252697c5e4db10f88c091d25d3cf8

SHA256
0be3c4f5435f8c4b1840da769333b99212d18c3e127d706d748f207a0cee6e6a

SHA512
6f5c8f9900e82125e79194b9bf94c36c33bc8bb7c34d2445a434407866a3e935d1c407b0a4604c8efa8e721bdd93486a4f5a0791ae24f542ea5a368e1156c60a

Download Submit
/data/data/com.nmhs.tpjr.yopk/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
97848a267c57d46b7172be296532b410

SHA1
0c7560b2499bcf8edc60ac59f75a1cccc44539a6

SHA256
56cf2504889493acadc99c8c3a19e5be58eabbab3a1538e23f4fadde07297c81

SHA512
806e9030f5c5345c4408da28894745fe7a81ecbf4fe37b3397a07076bd5f0b87696e474d7e8af930190b096ed4d64aac852cd6cd631799163326dbd45fdd911b

Download Submit
/data/data/com.nmhs.tpjr.yopk/files/mobclick_agent_cached_com.nmhs.tpjr.yopk1
Filesize
1KB

MD5
c65001e9af614a1b5d4406f91f456b99

SHA1
e206639bb42ea728cc1454bb7fdb6272669d8d22

SHA256
cb6a6c0a67c457cdb78966e04ce52102d3ac9e90a8d6bdfb59b6c37e7faa7757

SHA512
b0927bdabdf338338dc33ddcc6a9481427e9130beb21444d7de153ea8b2b978aeff803e31e027246bb4a339c63d74284c0d116b050e6b990808de62b1e674c5c

Download Submit
/data/data/com.nmhs.tpjr.yopk/files/umeng_it.cache
Filesize
352B

MD5
0496cce1c375724c47fc918168eee131

SHA1
12f3e6c267df87cab33e3b68490453f92d382fd9

SHA256
ff39baab55de5ab0fe9bb2b34531c192d02f66e05536b3cd2c76a4217c9d4fba

SHA512
de5717024cfbe320569633e75c5d4f36556c9e37e6c34286d02b08f311249d75bfc6aa011c93ac8e84faaf4072eb3c1b924aa61f0cb7715d171b5de8218ca0b6

Download Submit
/data/user/0/com.nmhs.tpjr.yopk/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit