822ac55a505bd34b021246da52e5009faa43a4925fe127a5f5fe35ced9d23562

Analysis

max time kernel
178s
max time network
182s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
28-05-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dd5181629ee77cf45b6af55bd2ebb1f_JaffaCakes118.apk
Size

1.3MB
MD5

7dd5181629ee77cf45b6af55bd2ebb1f
SHA1

ae9752ab25d7da22df0668650749d0ca167cd9cd
SHA256

822ac55a505bd34b021246da52e5009faa43a4925fe127a5f5fe35ced9d23562
SHA512

680eb3dda3b67d9f13a2c333b237be0026f967d9ec034a812e063b0877c899a163ee37236383858c4dcc15790a9a442740295d9197190476dea9782af4c90182
SSDEEP

24576:poL0otaYtXMhes8X3lUKfcfIkuovSp0Cjjo+9UjtUDq/13tdHbZKm51Ob83C:iQ7YtRX1wvTvSp1jvSjtUDq/1XHNKmje

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.xdzp.dpbp.batd

pid process

5154 com.xdzp.dpbp.batd
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.xdzp.dpbp.batd

description ioc process

File opened for read /proc/cpuinfo com.xdzp.dpbp.batd

pid	process
5154	com.xdzp.dpbp.batd

description	ioc	process
File opened for read	/proc/cpuinfo	com.xdzp.dpbp.batd

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.xdzp.dpbp.batdcom.xdzp.dpbp.batd:daemon

ioc	pid	process
/data/user/0/com.xdzp.dpbp.batd/app_mjf/dz.jar	5154	com.xdzp.dpbp.batd
/data/user/0/com.xdzp.dpbp.batd/app_mjf/dz.jar	5227	com.xdzp.dpbp.batd:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.xdzp.dpbp.batd

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.xdzp.dpbp.batd
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.xdzp.dpbp.batd

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.xdzp.dpbp.batd
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.xdzp.dpbp.batd

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.xdzp.dpbp.batd
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.xdzp.dpbp.batd

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.xdzp.dpbp.batd
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.xdzp.dpbp.batd

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.xdzp.dpbp.batd
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

Processes:

flow ioc

36 alog.umeng.com
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.xdzp.dpbp.batd

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xdzp.dpbp.batd

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xdzp.dpbp.batd

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.xdzp.dpbp.batd

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xdzp.dpbp.batd

flow	ioc
36	alog.umeng.com

com.xdzp.dpbp.batd
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5154

com.xdzp.dpbp.batd:daemon
1⤵
- Loads dropped Dex/Jar
PID:5227

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xdzp.dpbp.batd/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.xdzp.dpbp.batd/app_mjf/oat/dz.jar.cur.prof
Filesize
723B

MD5
27e823f3f6838c3e257440da107fff42

SHA1
f56a2741b7ff9a027f064f82695ff8c160d2f6c6

SHA256
25791cd0817129d64ccebccaefa3832c478c1aced8107de6d0642f655229851b

SHA512
9bfb77030f5b7508c81550675793b4a77f4d3c15731d31a0ecf0adef4f9df1b5bc490a553639ab81a9ca2397706c064ff72be9593c8af8d7dc1aa8986cc81e1a

Download Submit
/data/data/com.xdzp.dpbp.batd/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.xdzp.dpbp.batd/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
8KB

MD5
c3a60d1cc19f059c5814d5b6381f3696

SHA1
9781dde6a50c9a37f6133711a95fbb8684771fb1

SHA256
6a8bdbc12cd1304fcbc5e5ec2c7f087918d5a6cfdcc573e2b0a3e21104f985d4

SHA512
edcf1a6812bbc0d47279fe4c42b4d28581635855dc22b3db0abd0927a997c4779d30eea43369c35daf868a74e7e413a37220a0ee5ee146b3bc7eaea1150625f1

Download Submit
/data/data/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
512B

MD5
30a4017ab9dbf38c5973cdca11214407

SHA1
f9fb3cdacaea0bdaccf5ece62ea58694dde51c5f

SHA256
eb00404d8bff10f56f381499e0a3f9adb7cc79883235acc09b3240ec4fc2fc24

SHA512
d7de71c86924e9491183c09ebbd5e0dccc0ae913d2aef378ac6fd94dddb35ce4204a2df7313f38d99a97f525a0693ae43834a4859f38648ddf61ebb833a6e167

Download Submit
/data/data/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
8KB

MD5
7c584dce6a8b68f02abcf4c3f806ebe8

SHA1
b593ee79027a7b0cc3e10b9274c81558690ea53a

SHA256
c653167b4e74495850fb60d5bdc3ef1be3237fec58c8113d52ca57fe4ae27d69

SHA512
1809c1a76d7573831b0a0ad952113858e271b16916d87a51919f3b1b6852d9fe99b1d3c23a49e621043c493eddb7bbe01896653af6e3b095ff1a2f97c776edaf

Download Submit
/data/data/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
4KB

MD5
b89e73731e598c79179558fd50bbc694

SHA1
1b09e0d556886eb76a757291cf021ad615a26b18

SHA256
67be071701c80d26b2f09bcda52adc7793363abf2cea7dc525b378d6f8e3231a

SHA512
f5d5c4f76c0fafc443a62a6cfd91eb0b9d53327beed8f7bc446bcb2e583b5568401dbe231889dabb78c1f2a37cd10513bf36e764e4184b7e114cab9fe13d1ebb

Download Submit
/data/data/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
8KB

MD5
30130a578e9cb468e0a4faaa9906d176

SHA1
32528e150fba33ca7affc3d06756077d0911108f

SHA256
e1b2b9ecb05f47829db8966d6749b5acd1d1f6f7f0a8affb70735b289772faa8

SHA512
14256113e66a9830a908eb1d975d6a6e6cf0cb6ab951c144449a3e8608bab76fe5497e37a6ff1e17d0c505cad5afd87947a6bd5f1f229fa7219ca043b270d621

Download Submit
/data/data/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
8KB

MD5
9626af7a14ba4532af198bc0e9245df1

SHA1
d170807dd1d8feb2f6c143c65d0457b11252bca9

SHA256
8f277237616eaaaca36c742e179439ab06dc7071f9df07b8bf45abd04b4eafef

SHA512
2b2aa046a4e48e5fdd6715d4e963354d499c6da0de89aea98117ad5a56b8d6e7033bba5adee58867358330bea286b05943fcbc25ba9369c31c73bd302e5eca0a

Download Submit
/data/data/com.xdzp.dpbp.batd/files/.imprint
Filesize
943B

MD5
ac5f0beb04a3330e6f1afcc940c7a149

SHA1
82602922a0ac95a61236dce0944328f87ab6ff88

SHA256
86d86ac5e38736fdaae44f101bafc42a867d69065b5b1f502d3b373e83afa983

SHA512
4b25b9c4441d887dd572a02adb93cdb0a08f65503deb559945707a467c56df282bc652239469ecf022f0547c969a08b1acebfcf44dbb187b02efc3cc83e1dc91

Download Submit
/data/data/com.xdzp.dpbp.batd/files/.um/um_cache_1716918673735.env
Filesize
1KB

MD5
acd976164a3e142407752a566d8c06de

SHA1
5cd27c4af352b4816b79e579a46e2915a81568b3

SHA256
836ddf1046dcf1395e513eb9646d4db9bc2256886b4fd7930b0fa7788eafdb37

SHA512
b71758e9da0d468eafae0891e401f3347e0bcf81bcd71589d6436c2d097a3c97196d0b5e165f8849f64a77e1b0aa29ac46b75a514ece9879dba3b29cb4bb17b5

Download Submit
/data/data/com.xdzp.dpbp.batd/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
04fd1caca5ec29a577ccbfcd519ea154

SHA1
85eb836262ff289fe5ede574c36456e50d56bf66

SHA256
97c7394d0380f0209a212279bf7f940a0bdb7a2c2bd8ebf34df5ed49e587829b

SHA512
1fbfdd45ffc623537152ef5cd41dfad623402f70a9700a99640c89178379e96ae4734d7dfa9b208a49a2982eb8d1d3778c2cafd833f0f5da2b60eca82d0169b1

Download Submit
/data/data/com.xdzp.dpbp.batd/files/.umeng/exchangeIdentity.json
Filesize
202B

MD5
7547ae022c774e9b6be68c9b2251d076

SHA1
74a5550b3265b20793c2083c36f2c366fc9754b1

SHA256
221574193e93aec452717549da1943f1b68fdd900b09b3c9c53a7d9013eaae90

SHA512
3be86e7bc9d08b115f6f0ef7cc68dbfbcefbe2c8cd395c344867eaeb28961f417bdf09c8920a06c19baef6f789128cd0d5b30a533642ef3a5cf467e0695bb320

Download Submit
/data/data/com.xdzp.dpbp.batd/files/umeng_it.cache
Filesize
348B

MD5
28b0c12f202827ec05aae1eaa523ae5e

SHA1
9a735b289740ed6a1f86e6980e736884eea14416

SHA256
9991e1993b5d738681768bb8968064f9590691a7545f4f107de60a187fc152ac

SHA512
1bdf22cb7317af379943d64f58eb166e0914342f84957c90c6cc46e7ed14fc9d1cb714a982659ec0ec3f930e9909eebbf42802925b07ca5530eb2b892c18c415

Download Submit
/data/data/com.xdzp.dpbp.batd/files/umeng_it.cache
Filesize
177B

MD5
7148fd6c04db9fdee0b3facd0ce04d35

SHA1
34976fa2d9d0fc3989d8fca059494e1089c1ec55

SHA256
83b4ecc10771157a65970b1cf157c676edc7224b957d2c8503e7552a67c2a696

SHA512
03ea2402304e7dfdf4f1d8aed82552e8cc89e3b50844997d53b9e265e3621139590e21127069196ac0147bdce1b8d59b106e43efaa854ed5f196da4b439d7c58

Download Submit
/data/user/0/com.xdzp.dpbp.batd/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit