e56ad696b97bb7eba970912af136ceff025041aff733020f27396f084220ab76

Analysis

max time kernel
178s
max time network
179s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
27-05-2024 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7798f554fe00ae8424fc15cbfbb43fb1_JaffaCakes118.apk
Size

1.3MB
MD5

7798f554fe00ae8424fc15cbfbb43fb1
SHA1

3e846d50ca4b7ff11de48523fb31034afad9d52b
SHA256

e56ad696b97bb7eba970912af136ceff025041aff733020f27396f084220ab76
SHA512

7316f348bf4a02a9c8194f7f298207d23e36263983f6e3d494a8d36149006846381213b5bb964504a7d3a26d51cf2267a5df454b8ca4da22e6393f31b97728e4
SSDEEP

24576:htoL0otaYtXMjGwdJZXs+bS8oaPnDAUCxFM9jPo+G0j69Gq/13tdHbZKm51Ob83s:YQ7Yt4dJZJboaPDAUcFKjz3j69Gq/1XQ

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.rizw.umjb.eosy

pid process

4548 com.rizw.umjb.eosy
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.rizw.umjb.eosy

description ioc process

File opened for read /proc/cpuinfo com.rizw.umjb.eosy

pid	process
4548	com.rizw.umjb.eosy

description	ioc	process
File opened for read	/proc/cpuinfo	com.rizw.umjb.eosy

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.rizw.umjb.eosycom.rizw.umjb.eosy:daemon

ioc	pid	process
/data/user/0/com.rizw.umjb.eosy/app_mjf/dz.jar	4548	com.rizw.umjb.eosy
/data/user/0/com.rizw.umjb.eosy/app_mjf/dz.jar	4612	com.rizw.umjb.eosy:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.rizw.umjb.eosy

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.rizw.umjb.eosy
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.rizw.umjb.eosy

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.rizw.umjb.eosy
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.rizw.umjb.eosy

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.rizw.umjb.eosy
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.rizw.umjb.eosy

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.rizw.umjb.eosy
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

Processes:

flow ioc

46 alog.umeng.com
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.rizw.umjb.eosy

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.rizw.umjb.eosy

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.rizw.umjb.eosy

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rizw.umjb.eosy

flow	ioc
46	alog.umeng.com

com.rizw.umjb.eosy
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4548

com.rizw.umjb.eosy:daemon
1⤵
- Loads dropped Dex/Jar
PID:4612

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.rizw.umjb.eosy/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/user/0/com.rizw.umjb.eosy/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit
/data/user/0/com.rizw.umjb.eosy/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/user/0/com.rizw.umjb.eosy/databases/lezzd
Filesize
28KB

MD5
fdb8a92e5060ce104e8f0faca55a47ce

SHA1
270d7ca30673e18cec1d2b9add71cba96dc426fe

SHA256
194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a

SHA512
ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

Download Submit
/data/user/0/com.rizw.umjb.eosy/databases/lezzd-journal
Filesize
8KB

MD5
a7783aba0093717dca4094da720b0456

SHA1
8a2ee95679d87809652e4334abe1ffae247ae32c

SHA256
99cb3d5dd2db1851cd9dcc755278180e9eaa8f38f6331a2ed50e8cc8a527b030

SHA512
10338f492940aa54c8ffe94fa925006ca62d16a753966a90ed2695f08763d4067741d317494c79a1a46bf2c630eb320248bcc2c3bf9437a2fefed8682e4a0514

Download Submit
/data/user/0/com.rizw.umjb.eosy/databases/lezzd-journal
Filesize
512B

MD5
df708a2508491e51b993e677e266cc2b

SHA1
c60f1e100bd2aa1a508a0e1790a295d8dc84f53b

SHA256
1b46acd4e2224de97813069bda06050db94de8b57784e6faace9a1b5b7ac07b7

SHA512
8e99aa33277a7db43b18e205183b85914f99631a093bfcdffad381956f01285374f7c1bb263d473088f457c91b0d27c2010927cbf96057b9e561b69e9840be23

Download Submit
/data/user/0/com.rizw.umjb.eosy/databases/lezzd-journal
Filesize
8KB

MD5
6d03b7bf8f0ecdeb39e77291fb566b40

SHA1
3a74529c1c6806a478b24a6a2f865e124e20c9fb

SHA256
ffed30c3db2c56296b7a287e415c205d94ec08fcbcbf130240fc84c6751c0a9f

SHA512
7e378a056aae62a6dbc52108f6cb4f9b347bc9ef3f9ea66d683d09267b9c34c9cd1f3d01557cdd3baa9216f114c11add40cd2b94a76cf650be7560d105f8b06f

Download Submit
/data/user/0/com.rizw.umjb.eosy/databases/lezzd-journal
Filesize
4KB

MD5
b2ba37819653d4358a8f06906843ff2f

SHA1
2ed5aeed6778127435c7964b20f6a7d135f946a9

SHA256
c1a2d1f44d8b9ab75ed774fd9f0c407cac23fe90cfb2e999c7f94157ebce0afb

SHA512
ea3c8ff32fede2be587c387d5f161b379a9d60de5b8ee59974681d1236443faaa467d8b528799bc474aaec171e666882649773b92893a3167d4e40b729852df9

Download Submit
/data/user/0/com.rizw.umjb.eosy/databases/lezzd-journal
Filesize
8KB

MD5
a5a1e54f4003128ff51f1697a3ba5575

SHA1
890c039356afbd7f13a38edd361225560db17031

SHA256
0b7c863bcd0ef041abcbff5fd82e137fb5f426a056937a3442443089c45fb0a8

SHA512
6c686305474a525d5ee1da953d981dfa7a6c149e3997f352ed031ff7047aaeb0e8b9c0704476fb5f0d62a494fc6eb8325ab3c48f5c3b384eeb07edefb25df26d

Download Submit
/data/user/0/com.rizw.umjb.eosy/databases/lezzd-journal
Filesize
8KB

MD5
10645d1c30428c053798076cf7e825ef

SHA1
0f0a8b9761e585cf302b287a6d2227545e318179

SHA256
ffb4326dce665fc63b05eb48674caa3f78763862100ed8f6511b1e89023bb5f6

SHA512
44f8efc04818b0a7b5ff06b478a4327442166f9a5d9f6c050783a1b5c5558d90175368fc6e5cad9ad37427674ec75840d915610bf67c270f69af615315d916fd

Download Submit
/data/user/0/com.rizw.umjb.eosy/files/.um/um_cache_1716776747459.env
Filesize
651B

MD5
67b789a0405d6916eb2e8f852fa4ac48

SHA1
32cc2b5f8457eac8fb2b1518dd4b19c2eb72362f

SHA256
41a1e0b5cbfcfa22c76e8cac055e9620593e6f6ba00e2aa5c586e586b8c6617f

SHA512
21cd66060be13fffb1e4c55ec63f6930633340852d506ed7e516ba5af614af3d1e56ea1222e4f08fc8ab46b63e04d21c457f1695348a58965cc6f1bee56649cf

Download Submit
/data/user/0/com.rizw.umjb.eosy/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
0d62bdca78bce7dcfb97389bfc08637c

SHA1
47f4342db01455e5eb5f18faf035614ff419df62

SHA256
9b9ab3ba3667f9c7c333b490fc16dd017888c17a9990582550d38b93bc88c2df

SHA512
f8e880faf613161902e3c91fd8c9a8c382cf63bd08b60f39e88e3828bfd2a5c09738d0dd5020a5edfc9cd860acd043558552437c0bd8c80c03b0ff170ebcc438

Download Submit
/data/user/0/com.rizw.umjb.eosy/files/mobclick_agent_cached_com.rizw.umjb.eosy1
Filesize
797B

MD5
c6958432b87aef0f853d9025594a774c

SHA1
ea581ac661a2c5aea0f3ae20f1ed57ec951bacf6

SHA256
06b0228ef0d7ef42bb2cc8dbb0b48d609582ad7dfffefdfa712d445b286e6e4d

SHA512
30ff7a1fb642c6042533954293611fa6a86716953ce15469cd342211fda6d9d278ea1cbb207416ce8eb1ad731858d054c065e7be07b9818986ce4996d958d245

Download Submit
/data/user/0/com.rizw.umjb.eosy/files/umeng_it.cache
Filesize
352B

MD5
898cfe7409ea97b0a7b5c04ad22f9500

SHA1
93754622ae9a81066c24205d1b29eec068f38541

SHA256
6d16da74a49bb329fe303e5b1198f2523cc08ba63e2979fb685701a4d520cdd8

SHA512
8dbcc7507194dea979badf5fb54e84e0d737ff8be5c8d365a1284e2650e3d58abd64b5fb7ccc54fcb57e8d5887a92c21dc59a018d1e9fdcf41b6cbe93d152426

Download Submit