e56ad696b97bb7eba970912af136ceff025041aff733020f27396f084220ab76

Analysis

max time kernel
179s
max time network
179s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
27-05-2024 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7798f554fe00ae8424fc15cbfbb43fb1_JaffaCakes118.apk
Size

1.3MB
MD5

7798f554fe00ae8424fc15cbfbb43fb1
SHA1

3e846d50ca4b7ff11de48523fb31034afad9d52b
SHA256

e56ad696b97bb7eba970912af136ceff025041aff733020f27396f084220ab76
SHA512

7316f348bf4a02a9c8194f7f298207d23e36263983f6e3d494a8d36149006846381213b5bb964504a7d3a26d51cf2267a5df454b8ca4da22e6393f31b97728e4
SSDEEP

24576:htoL0otaYtXMjGwdJZXs+bS8oaPnDAUCxFM9jPo+G0j69Gq/13tdHbZKm51Ob83s:YQ7Yt4dJZJboaPDAUcFKjz3j69Gq/1XQ

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.rizw.umjb.eosy

pid process

5091 com.rizw.umjb.eosy
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.rizw.umjb.eosy

description ioc process

File opened for read /proc/cpuinfo com.rizw.umjb.eosy

pid	process
5091	com.rizw.umjb.eosy

description	ioc	process
File opened for read	/proc/cpuinfo	com.rizw.umjb.eosy

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.rizw.umjb.eosycom.rizw.umjb.eosy:daemon

ioc	pid	process
/data/user/0/com.rizw.umjb.eosy/app_mjf/dz.jar	5091	com.rizw.umjb.eosy
/data/user/0/com.rizw.umjb.eosy/app_mjf/dz.jar	5212	com.rizw.umjb.eosy:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.rizw.umjb.eosy

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.rizw.umjb.eosy
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.rizw.umjb.eosy

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.rizw.umjb.eosy
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.rizw.umjb.eosy

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.rizw.umjb.eosy
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.rizw.umjb.eosy

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.rizw.umjb.eosy
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.rizw.umjb.eosy

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.rizw.umjb.eosy
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

Processes:

flow ioc

36 alog.umeng.com
49 alog.umeng.com
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.rizw.umjb.eosy

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.rizw.umjb.eosy

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.rizw.umjb.eosy

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.rizw.umjb.eosy

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rizw.umjb.eosy

flow	ioc
36	alog.umeng.com
49	alog.umeng.com

com.rizw.umjb.eosy
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5091

com.rizw.umjb.eosy:daemon
1⤵
- Loads dropped Dex/Jar
PID:5212

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.rizw.umjb.eosy/app_mjf/ddz.jar

Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.rizw.umjb.eosy/app_mjf/tdz.jar

Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.rizw.umjb.eosy/databases/lezzd

Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.rizw.umjb.eosy/databases/lezzd-journal

Filesize
8KB

MD5
4e71b21c6d7b5b6d992953a19242fb6c

SHA1
5beee431b5c402a14e4c8d1b9e96e33498573221

SHA256
e7b3dc987abf501fcaf5d3a18f7e895adb250476ee7cf8b611c7f7f3c6f41b22

SHA512
ce7f6c986bf6f7b46510e689f704d738e6f87e08edb58d2ec20663a2a88f9084758f3dcac96b775edaafc24a60257c5db1f0f8caf02a28a82e5d8cdc87813ea9

Download Submit
/data/data/com.rizw.umjb.eosy/databases/lezzd-journal

Filesize
512B

MD5
cd87f26326f87ea5c8770678ca06cb16

SHA1
6626587bc9d54939a0806c1bdb0e79fee5f545f2

SHA256
1f7e077451d4faab960bcea2942756fccd7466e7aa46623562d3c0ca8615f840

SHA512
1bf1725e3816bdfec084ed464e71dca22a2d591c526439f574ac3fb8f484ee7a0eae4cb4c778138a51eacf2319d8eb1656c996d55eb8416988f7f156e3889e3e

Download Submit
/data/data/com.rizw.umjb.eosy/databases/lezzd-journal

Filesize
8KB

MD5
0ee8f6e6ddef21189641229528aec02a

SHA1
6f69de4d4891129e4db3537fbbf1804c672a03be

SHA256
e2f324f5f173b92227bbc1d3d0368673ee3fa88f0489c8438d325fd225b15e72

SHA512
5703b24fd9dcc44c5edf78e501caccbb85a91a85360ce63a00a73b4b22caf0b5a744440fff6c0eb9be09db0da814e2f9ad6a7867a0f75e329b8c21773ac62c64

Download Submit
/data/data/com.rizw.umjb.eosy/databases/lezzd-journal

Filesize
4KB

MD5
38217c8bc3cd30951fc2a12a8cd699bd

SHA1
1cea6fde551db48f891723118420e60a3baf47dd

SHA256
d9b5c99da55c20fa957364e443cfc99678676376ae72b1bcc2ed93c929c8c0f7

SHA512
3617267b2cbcbccaec4285e99dcf8762868b55b279e7e74d88f6cfbea527b036ad051b236aaa0b3717c5c08b226dbea8a8f7da3a008266b0cadb4d238e072aee

Download Submit
/data/data/com.rizw.umjb.eosy/databases/lezzd-journal

Filesize
8KB

MD5
350300b00f8ae691c6899bde9e8afdfc

SHA1
590ef883f7283ebc285beece7d194d42c976b108

SHA256
246fcf17539ddda58561842dd7e743cd3f916ba7d89ff32678f963e4650f9ad9

SHA512
689cb3c132b4e7696f61f7dded42bae63414e61dc4e3194c044cfdbc53212d50ff2df928e28f8f4f576a9441d8de631f127b464226fc89e954332e3ee2e6cd6a

Download Submit
/data/data/com.rizw.umjb.eosy/databases/lezzd-journal

Filesize
8KB

MD5
cc2237a9177f7bd4072b535c4a157a2b

SHA1
c2945436ee7e5db17a5de0bab71f2e492751386a

SHA256
75ec3ee540c332d3107e5fe116e865ed06f28a0c0f7e5fc214eb63b79880fe86

SHA512
0b7997a9c8d7c0c5e5cd507b2ce4eb94464848d64199b16207ea472c02f43cc57be9ef701e26c46b7275767aefb9b957429fb0a56b7490fdc45067c12fb86d6c

Download Submit
/data/data/com.rizw.umjb.eosy/files/.um/um_cache_1716776745877.env

Filesize
655B

MD5
3f55e5b0d43b4fc48c0a5900f0e559ea

SHA1
857037f11771f3d9198191867ef74c93002d7520

SHA256
e721457f87607abddc7ad985d64268854c1943a54cc6fac7242a397add81688e

SHA512
1adeea51912ef36a56948f8817ded9b11f27ee506c31b2f4d429f7054a4454084300cb06b0408404639bc82f20589e48d97f747a2565258e0bf46f3ea7960302

Download Submit
/data/data/com.rizw.umjb.eosy/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
cf923bc5a2524a9d367e3e604226b6c2

SHA1
013a0be16f768a52a6e3d81e2c504075ec0e88a2

SHA256
1033677b168f18f2a0bacd9afdbf8d7fb573ab0abe63671df08c0785fb75426f

SHA512
b6c68e5db72731063d906da82d55e67a8aa5f411319c6556a9dfc0ccb23c24665a50e5f260e863582c9bf6de7c4f7467711bc0565fbce35659caf0cddea42b88

Download Submit
/data/data/com.rizw.umjb.eosy/files/mobclick_agent_cached_com.rizw.umjb.eosy1

Filesize
794B

MD5
af9fa8f76b14eb4192260733d9fdef05

SHA1
1d80fb0a1ea6677a465ab7d52bf8b7ccbbe57bc9

SHA256
a42c67c4fb2109bb53fd6f454ff7ca415888b23ae69bd9ada5057ed15938f84c

SHA512
030b53a51d25975306fe39295880a74dc36ca9dd497f2551959156beccc684eda2a65cc2f781ed757a72020225be5cf890fdb50a1fa9aa64049611f7d0f944db

Download Submit
/data/data/com.rizw.umjb.eosy/files/umeng_it.cache

Filesize
350B

MD5
e890c02c91ecdb268972ef256e6fe6d0

SHA1
bcab84607f1814b72824ea78e263a856220f25a2

SHA256
bf7a82b354511a1ee1678837de2deff3aab71358358a864fceb4124a42728596

SHA512
888c6f6edfbaad9547d8c888dcb6301e4b9855ca58e1857bafaf75106e0a8912fcada78331f7f9c51fb34c71aee6a684cbc51b4ca5b47039e35db977befc773d

Download Submit
/data/user/0/com.rizw.umjb.eosy/app_mjf/dz.jar

Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit