822ac55a505bd34b021246da52e5009faa43a4925fe127a5f5fe35ced9d23562

Analysis

max time kernel
179s
max time network
137s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
28-05-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dd5181629ee77cf45b6af55bd2ebb1f_JaffaCakes118.apk
Size

1.3MB
MD5

7dd5181629ee77cf45b6af55bd2ebb1f
SHA1

ae9752ab25d7da22df0668650749d0ca167cd9cd
SHA256

822ac55a505bd34b021246da52e5009faa43a4925fe127a5f5fe35ced9d23562
SHA512

680eb3dda3b67d9f13a2c333b237be0026f967d9ec034a812e063b0877c899a163ee37236383858c4dcc15790a9a442740295d9197190476dea9782af4c90182
SSDEEP

24576:poL0otaYtXMhes8X3lUKfcfIkuovSp0Cjjo+9UjtUDq/13tdHbZKm51Ob83C:iQ7YtRX1wvTvSp1jvSjtUDq/1XHNKmje

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.xdzp.dpbp.batd

pid process

4627 com.xdzp.dpbp.batd
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.xdzp.dpbp.batd

description ioc process

File opened for read /proc/cpuinfo com.xdzp.dpbp.batd

pid	process
4627	com.xdzp.dpbp.batd

description	ioc	process
File opened for read	/proc/cpuinfo	com.xdzp.dpbp.batd

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.xdzp.dpbp.batdcom.xdzp.dpbp.batd:daemon

ioc	pid	process
/data/user/0/com.xdzp.dpbp.batd/app_mjf/dz.jar	4627	com.xdzp.dpbp.batd
/data/user/0/com.xdzp.dpbp.batd/app_mjf/dz.jar	4687	com.xdzp.dpbp.batd:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.xdzp.dpbp.batd

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.xdzp.dpbp.batd
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.xdzp.dpbp.batd

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.xdzp.dpbp.batd
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.xdzp.dpbp.batd

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.xdzp.dpbp.batd
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.xdzp.dpbp.batd

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.xdzp.dpbp.batd
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

Processes:

flow ioc

47 alog.umeng.com
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.xdzp.dpbp.batd

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xdzp.dpbp.batd

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xdzp.dpbp.batd

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xdzp.dpbp.batd

flow	ioc
47	alog.umeng.com

com.xdzp.dpbp.batd
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4627

com.xdzp.dpbp.batd:daemon
1⤵
- Loads dropped Dex/Jar
PID:4687

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.xdzp.dpbp.batd/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/user/0/com.xdzp.dpbp.batd/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit
/data/user/0/com.xdzp.dpbp.batd/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/user/0/com.xdzp.dpbp.batd/databases/lezzd
Filesize
28KB

MD5
fdb8a92e5060ce104e8f0faca55a47ce

SHA1
270d7ca30673e18cec1d2b9add71cba96dc426fe

SHA256
194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a

SHA512
ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

Download Submit
/data/user/0/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
8KB

MD5
e8345969bf558027e0a3025bcbe8995f

SHA1
0ec8cdc376d1653ca8ba0cc7052fc5d2ae3b260a

SHA256
82ab9e54902f34da858b1728474223888e020e87fdf0ed6e98bb988a7160a71b

SHA512
bf62f278e91594d8dae612aaa5c42e3313ea045f61989a87f590d3f9e8a9691107f86042e63d3da07d015edc037db3495fe340aad13eb674b68b4d9b440fafa9

Download Submit
/data/user/0/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
512B

MD5
7b918312693b58b6fa974a318470e2c9

SHA1
b98aa78e50141a8814b5f2fa7f26b099ca321cb9

SHA256
4ded18090dee0ca00e90dc347e849d96dae69b2d05c00cc78843a73819ad4607

SHA512
ada1d4638e43c181364b491cfff4a5793530f3d08e6f6551eb3564f766ad239988672eba7a50fe70665ceb027bca27b69c7a59d6e02f1b48e069c390f3aa4aea

Download Submit
/data/user/0/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
8KB

MD5
0821faf2247b806307ab5ac4c855df6e

SHA1
f2feb6fad2875da889539803039d5dddd7fcea69

SHA256
b29088edbf0841658d7036104baa4b4f9439673874ea00a15b4ea44b323b7cb0

SHA512
760b3b02813bb124a85acb376ce5b5a38253e80e7b9197856e3fc2e43899e19f18f5b184834f253cb71cd618051799e6795d0028345a2d682e9fddae8ad9ec5d

Download Submit
/data/user/0/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
4KB

MD5
a6f82971fe0d989052a06cdbfc76617c

SHA1
5273e9f3a9942adb14ff3058a7c9f770fac72de9

SHA256
5614183c1d9d58bf1faf8f3b034942cc10fa74505393d4205f5b9fb7cda5b26d

SHA512
8ba07abfdcc0e70617ae99d27d766f0d79c99871e0c3eb134d855ef3118f2527e29fe9f977291c0b12c1815ce3376124685d2bce2a7c3fc691ad7f14f25714f5

Download Submit
/data/user/0/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
8KB

MD5
763b6a988fbfd1998a16d9e668c258fa

SHA1
9732c59e70523dd1e2b434406fd2ae9086d396bc

SHA256
21f78f43bf04d8387e8c7ffeb2299d442a57d5a821d39108901803fcecff7192

SHA512
a68f42b9352e9252e8fb5fd6005382f73c069e332d4df5a89db845e08aa1e9251d8eb5b724664490b61e84bbbd34f0d32ceca8e923ce633e86a372c2329b9041

Download Submit
/data/user/0/com.xdzp.dpbp.batd/databases/lezzd-journal
Filesize
8KB

MD5
a6aa8cf1580513ea3107df05e2372b8a

SHA1
e4ac14071d6675a28bc8a2295aaf68dd045584c4

SHA256
da8faa7a269fe8d20f005a66a5507fcc57d5b26e1ee19f484379e66890a92175

SHA512
5df24dd265dd43621c27a8cb2fb0a15a856ce0112231ca00cdb84dc092ff9250fc1f667ee84daeef8bc891822a8f329f13935effa77210f3233e695163e2f528

Download Submit
/data/user/0/com.xdzp.dpbp.batd/files/.imprint
Filesize
944B

MD5
88400a0ab3d573ba7c7f4e9444376130

SHA1
6bb3d62dc6035fcd1fd157729167f74da2519c38

SHA256
99cf2a49954569fb7d59030e40a0bd20a8bbfb83a63688fb981b920ba9567a4d

SHA512
2a72b2228aefa2060223cf7ffcef5ab0162814a3c192190fe6fe89d3798f28170292f1e7a0107fab219772093962bfb364eef6767b62dd2dfff885abd05192d7

Download Submit
/data/user/0/com.xdzp.dpbp.batd/files/.um/um_cache_1716918617834.env
Filesize
652B

MD5
87023acdb063273b3688b72b960b091d

SHA1
2d6567b1478768d6d16c3f6630305cc88e773e45

SHA256
d46ad96cdab9549d11427e83adac4d151ad2e4076fe32690c648d363cbd3a1ba

SHA512
a722584fe419af28139da5301375fb69b12943eb95548ce916e50de5a99ba2a1526499f73a6e81885c973ed85c0689831a3e84e41e9cce4adf56c17fb270ce75

Download Submit
/data/user/0/com.xdzp.dpbp.batd/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
9c6f45557373be588da08053fa62baa1

SHA1
3c35e4ab987289e06c6e99ee9140dddd9a033c92

SHA256
90bc483b7f8540b38ad1007c4ff09a41e80b3ec37bca1495cf565dd2816b9227

SHA512
8e378b8fe44e3ed99bdd3e218aeb1c0d62fe30a2ad06a27fb9ca1347d7dbd9d74ac57f9f6e577ebe848fb17750e6b8bc0a044f4248e76454fead523cc5a416ba

Download Submit
/data/user/0/com.xdzp.dpbp.batd/files/mobclick_agent_cached_com.xdzp.dpbp.batd1
Filesize
1KB

MD5
67ed2f3323d2004f170a64c5e3115495

SHA1
d64879f3465bde5acd17b10e319d81cf4dfbad66

SHA256
4f8f4566b5902b5d87923861d8ca05b5672b40dcc40e4f9d6893b85f2cccc59b

SHA512
26ba8301fff252ae06b881f2f0f5c6819f504ff830544243c091448495f11088f3d0f6e09d9b96d37c80cbbb0fa170e9185da4878ca21f6865d8062b03cc7e13

Download Submit
/data/user/0/com.xdzp.dpbp.batd/files/umeng_it.cache
Filesize
350B

MD5
c0efc1de8d9649efbe24061bd988c560

SHA1
6da15de924067722f96e7ed999fe940235c3b189

SHA256
bbe3a40698ecb82c47a32b50fc1373777096d6d755c91c07621ac2895d15c067

SHA512
e42777d17ac58b909f43ea130d587ae2c56eebb28813c1d04d2d74791a41d5ca29b48457f22342677c9c3dfa98e6b4b4d39ff82753e76140e82e79276e3ea14c

Download Submit