b2de24b42811ba0a05d5e51cf45bce10ec8aff9a1e0a5834476d6a70ff4cd04d

Analysis

max time kernel
178s
max time network
185s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
29-05-2024 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81028b67bd463375a732a0c77450f965_JaffaCakes118.apk
Size

637KB
MD5

81028b67bd463375a732a0c77450f965
SHA1

0ef62bdf7f8f31af8af6e7d9f69c946b2014ce67
SHA256

b2de24b42811ba0a05d5e51cf45bce10ec8aff9a1e0a5834476d6a70ff4cd04d
SHA512

5ce4f1c394e17735847b193e9034d89707735dd121350a6a36ec69cb0dc18d8322d86b90999678bfe9dd1dc28c5d239cfbc7fd3063102e78b253a642741ed706
SSDEEP

12288:B4L4oQI8Y0FotaKIUtrbMs1y/gfOdFskKkgeFxBMC794vvQe6ERylTgJ:doL0otaYtXM25OgkRfM4iydc

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.pygt.rcsy.qeyt

pid process

5109 com.pygt.rcsy.qeyt
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.pygt.rcsy.qeyt

description ioc process

File opened for read /proc/cpuinfo com.pygt.rcsy.qeyt

pid	process
5109	com.pygt.rcsy.qeyt

description	ioc	process
File opened for read	/proc/cpuinfo	com.pygt.rcsy.qeyt

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.pygt.rcsy.qeytcom.pygt.rcsy.qeyt:daemon

ioc	pid	process
/data/user/0/com.pygt.rcsy.qeyt/app_mjf/dz.jar	5109	com.pygt.rcsy.qeyt
/data/user/0/com.pygt.rcsy.qeyt/app_mjf/dz.jar	5231	com.pygt.rcsy.qeyt:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.pygt.rcsy.qeyt

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.pygt.rcsy.qeyt
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.pygt.rcsy.qeyt

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.pygt.rcsy.qeyt
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.pygt.rcsy.qeyt

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.pygt.rcsy.qeyt
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.pygt.rcsy.qeyt

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.pygt.rcsy.qeyt
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.pygt.rcsy.qeyt

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.pygt.rcsy.qeyt
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

Processes:

flow ioc

57 alog.umeng.com
6 alog.umeng.com
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.pygt.rcsy.qeyt

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.pygt.rcsy.qeyt

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.pygt.rcsy.qeyt

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.pygt.rcsy.qeyt

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pygt.rcsy.qeyt

flow	ioc
57	alog.umeng.com
6	alog.umeng.com

com.pygt.rcsy.qeyt
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5109

com.pygt.rcsy.qeyt:daemon
1⤵
- Loads dropped Dex/Jar
PID:5231

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.pygt.rcsy.qeyt/app_mjf/ddz.jar

Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.pygt.rcsy.qeyt/app_mjf/oat/dz.jar.cur.prof

Filesize
718B

MD5
f005a656e0f14575498548f795b6a9a3

SHA1
6142469f862bf288cf33b4edf6c70c47e182c1c3

SHA256
c81ab1a5c183962dab7fc8211763b03c7e7beafde83a16f2555204ae4c561716

SHA512
16cf71b64ebaaab54c6183e2c0c9a87839381fc16cd4dcab09ea33af8282474467499fd5041456cbb4526199654c6f70e0fe7fc369827bb018102ee5ef5697ef

Download Submit
/data/data/com.pygt.rcsy.qeyt/app_mjf/tdz.jar

Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.pygt.rcsy.qeyt/databases/lezzd

Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.pygt.rcsy.qeyt/databases/lezzd-journal

Filesize
8KB

MD5
2e5927037b5b78b1f5e4ec1d96df7415

SHA1
de933b96f8ba555f5301b12f16e6f2c162a08146

SHA256
c6f7617b3aa43c8eddf6d0bbb908c63d9875616dc7965567a105dec8dedab9e7

SHA512
d7dbf56efad71284cd9b22cf08ccdd40026fbae237dcffb4d6a72b4105e87794d1b47fd0a66636cac3e9e39515a39f61bce8c313647f9ca57554b12491f893d0

Download Submit
/data/data/com.pygt.rcsy.qeyt/databases/lezzd-journal

Filesize
8KB

MD5
2f88b683a7d83c33635b9fdffb236c68

SHA1
e0cf12e3aa7d68cbd4515368a04d594255e7b1aa

SHA256
a5c961739ac4fd472b62a4707b06f81337df794c9ea9627260723e6641850b9c

SHA512
1c32286ba5a280bb61d1fe01051f25b05f7d79b5a0d83990ae1d9b6a76fb6f4e664f7125fb98e5f2d9d0732426a1a2f388bc95e36cebee130fceb4e3f8e6e259

Download Submit
/data/data/com.pygt.rcsy.qeyt/databases/lezzd-journal

Filesize
8KB

MD5
bb414502581571d078a06071eec7fbe9

SHA1
67978930f404e1898868acfbdcfab7935f63589e

SHA256
aac6b2cc64a87edc65ff7303224e3ca92b55b2f1a80e0ad99126c40408973138

SHA512
f447d52e63018e4094cabdcfb83fc15b0d752bf95b9692d55862a909f38a71fb297493987d73310dd2e4356574ea4216c500642eae5a6c60c5860ea9f813bf00

Download Submit
/data/data/com.pygt.rcsy.qeyt/databases/lezzd-journal

Filesize
512B

MD5
bc8b75a6f141ac9fb291bc245449854f

SHA1
9340121cd5a23ac12d721d0557366e5afa885c6d

SHA256
909b1219a503d1a937639219e454e9f3e9e1d6341ec92e6bfd3c0fdc4b7cf101

SHA512
0f507892ff4d494228bb649a878c340756bcb2c5235ddea66ea324a69fe07fe5cdb2cbf8e27505af645587252e6c0375dfc1055d52c8fec361f6e239fb6fcf3b

Download Submit
/data/data/com.pygt.rcsy.qeyt/databases/lezzd-journal

Filesize
8KB

MD5
b1cdc069d9110089fb59a3ace468e85f

SHA1
36f769fd66d012e1edbf93bbe21c86d2374d100f

SHA256
e79d1b6ec772682994047a9e03918fda61c7df27511e171f3c22bd8fde2d8af4

SHA512
f8e04537ef982e4c56b5612fea3673d8516d7505653631fd3eff72be7f4fae90fcbc84b8a24a35e36f588ef65760faad825d99a191b272ddc4bf77d9f2a07b40

Download Submit
/data/data/com.pygt.rcsy.qeyt/databases/lezzd-journal

Filesize
4KB

MD5
13d8a80c093620b6d85bbae20f090c87

SHA1
f90c3fa132a3de89548f2da4e61c2648a20ba4da

SHA256
8550bd10c8dc53de321d23aefc6f73d9f4312cc226169085723c4ed5c0df4b77

SHA512
d6889a00b6b9461e58d5c6e8ad2e8f085f5c280bf77f4d903224c7c327210904ac44753058e6f908b371d9fd07feeabdb8c1d3fd9a1ca69d78b6a582ce767326

Download Submit
/data/data/com.pygt.rcsy.qeyt/files/.imprint

Filesize
951B

MD5
494b2cf336b59ba97893a7b91c420199

SHA1
0de7b205415099707daa6e29fa654523b5451d9c

SHA256
b817fdc4ac5391bf26e76f66f2f24403fb12e0a5e327e1751afe66ce5f71b912

SHA512
fd7cfda7556821ec55582f4d62f0a18a7c8cbcc0dda725c6c5cf362ffe452ce7b2fc129de23cb9c2f82e8af169c8c62821c7192c270b18064dea6be1afa42d86

Download Submit
/data/data/com.pygt.rcsy.qeyt/files/.um/um_cache_1716992020003.env

Filesize
1KB

MD5
c2281bc595b734cb6901e87037dbf195

SHA1
e996286ef1f613d743aabbab8eccbe8a420f21cc

SHA256
fa036d3a2441d61853fb410877c13fb9e2261709b27b32e503a4082c46e10e09

SHA512
48ffd4530df8acaa1dabca5faf1c682deb33c19adb526dff341cfa09249b04e7ca5fad398ddda711b01cdf7aa9ee689649cf0b8bd03ccf2b7db19ade809f9ddd

Download Submit
/data/data/com.pygt.rcsy.qeyt/files/.umeng/exchangeIdentity.json

Filesize
204B

MD5
91d0bb54ab2ad0a53f87bc35a8f77bbb

SHA1
bcc4e9e3537330aab63476c38e7cf98951a63699

SHA256
2cd4a662991f9fcf270859ba94b91317da5a075e4c09321d8c2f0ab536ffa212

SHA512
9e683cc9d2bf31b1141b09e8e82c5c0f66349e2a53643ad5c6418a61cf2ef4a390e3aa5929e4fc9277a419f25aac2b2204ba9dd82f327eaaa5c44653799f5489

Download Submit
/data/data/com.pygt.rcsy.qeyt/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
3ea4652223a4779539974e4969479c71

SHA1
a5495b3c9012161ec01ceb2cdf7da5b662acc3ec

SHA256
d07a030de00d184612584af3a9c7e204e38cf5b29fbb30a6b5bc58e4659a0a34

SHA512
1ecc68143c8ad534d517d4329c396271d2ddaeb545721b29df696a9103083d8e658990728b6e60f90130a0500d89ba58b81dbdab9cab166e03d481a5ce42905c

Download Submit
/data/data/com.pygt.rcsy.qeyt/files/umeng_it.cache

Filesize
179B

MD5
1fd174d2dd7f7d9d27651680f24ca805

SHA1
0ef19c5b29496e4a8342c78b283d94eae30a639d

SHA256
590dd4be63b85c32cb9ddae5e58ef680f66406acbfdeedc59d5e5640573eb843

SHA512
22279a7a60dd3b7082adfe8b3b3ab4795cb2bfcc0bff259bce3515d7ec6939087ec37f0d9db5c4e4c226e0d43920254cfa30fc6af24469d0834a587891c73e7d

Download Submit
/data/data/com.pygt.rcsy.qeyt/files/umeng_it.cache

Filesize
352B

MD5
ff65e5a744e5eb22e0ad3b345cd44f8e

SHA1
1fbe7908a53307be152275bd78b7e2d625dab1c6

SHA256
14eb3d6b501c40f0bf644277ec230b2a451402e51a48bd29af469c0c298aea36

SHA512
ff28b733b756687d24505fd2d23e8fd3e05a25f85fa4c70a2e653bcfa8fe2910b18d5f6aa31ac6af24d40f139e44f7697dd7a81b26295303b1a38e25bf6fff1a

Download Submit
/data/user/0/com.pygt.rcsy.qeyt/app_mjf/dz.jar

Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit