3e2dbc15adfb5f8af2c294a75336670164b3a3fed1bb2b46f82fc418e0f7d2ac

Analysis

max time kernel
179s
max time network
188s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
03/06/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91c6032ef6b84a2e5fcc437d67a7a85b_JaffaCakes118.apk
Size 1.3MB
Sample240603-plfzjaec7s
SHA256 3e2dbc15adfb5f8af2c294a75336670164b3a3fed1bb2b46f82fc418e0f7d2ac
MD5 91c6032ef6b84a2e5fcc437d67a7a85b
SHA1 1579e048d6b63bb0e7646ce885b10a76926f689a
SHA512 37bb0834ff8418600894f6343a117703f96b8817aec4b60c5473c0e33370779a3a05d84647cd2d4d5fc7e681115f0e5034106e5b531f8039ee6c40e6df4181f6
SSDEEP 24576:ecEoL0otaYtXMMSprkM4FqD5Bl0ZHqU+3jzo+UojMvwq/13tdHbZKm51Ob838:9Q7YtArkruBl0ZH6jfxjMvwq/1XHNKm0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5182	com.zone.piag.doon

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.zone.piag.doon

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.zone.piag.doon/app_mjf/dz.jar	5182	com.zone.piag.doon
/data/user/0/com.zone.piag.doon/app_mjf/dz.jar	5330	com.zone.piag.doon:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.zone.piag.doon

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.zone.piag.doon

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.zone.piag.doon

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.zone.piag.doon

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.zone.piag.doon

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
37	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.zone.piag.doon
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5182

com.zone.piag.doon:daemon
1⤵
- Loads dropped Dex/Jar
PID:5330

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.zone.piag.doon/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar.cur.prof

Path /data/data/com.zone.piag.doon/app_mjf/oat/dz.jar.cur.prof
Size 724B
SHA256 8628b7439382f5cf1d2ffc743a19cfb34ab6444186c21755c919b23586967cad
MD5 df1ff980a354417d0c471130c49de84a
SHA1 ec6f5a0c8501b74abb9b35ee5e72cc245be59a6f
SHA512 4b1761a91eb352dcafad7e33405e9416028ad859e975a16d8a72cda68e9f6a10ba09de0e77e9a6d7518dc747d33546d31f9aa63803b319676bf0fa092e19e889
MD5 SHA1 SHA512

Submit Download

tdz.jar

Path /data/data/com.zone.piag.doon/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.zone.piag.doon/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.zone.piag.doon/databases/lezzd-journal
Size 8KB
SHA256 0d42e90974f8cf0d1868dc94b1cb2b6f6dc6e42a2040f2bb1afba4e196f9b8a7
MD5 42be78cd0e724e732785cad6690beb62
SHA1 2c38aa0c5bf47cee01ec29747bb9d3b5058b3a24
SHA512 8c2dce320f0edb0792e0f7ee26139ddf2330d7cf66b922603dba3522645271074b08d1e481d78c6fdccb097b36aeef44ebae3b5ef459af3d9d173e13a412971a
SSDEEP 12:7+tOqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbARu:7+tOqLGqteszXtUku+haaL6nwyLGSAI
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.zone.piag.doon/databases/lezzd-journal
Size 512B
SHA256 33ea5840692d0c10c0a5941f8ed3af66d9cd3a1c140e19ff847b43667cc660d3
MD5 7376f682511993233290feeb40ed0b95
SHA1 6ab7b53ff0567e69a0b39ca8f2de1f7d5935c30a
SHA512 afb41a22f009e76fdcb0eb96b25ef2701c06bff7839867e3d784f36bc200b060c83a1047cbf0d45af6be6bd1e10af23b019c13a932d5c36f4060ebd6a7e732d2
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.zone.piag.doon/databases/lezzd-journal
Size 8KB
SHA256 a4d5b5c04a382202edf910a5f32b4040e3874ab5cdfdb03ee2a4dbb03acbd53a
MD5 6420ef936300ff4f7b9749564b8ec40a
SHA1 c66765eed003a60d494db3f90abeb3b08b178f16
SHA512 71f44e6e85737a62019e5d0bc1260c1ebd56e79f121022242af88c19297d9c32f01a1b84c02621ddad52469ed16f3896e268c9d0453568908e115fe88bb6a050
SSDEEP 6:7+/l9AFn148Jg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK0:7+tt8JqLiuWdwRmBEyPbT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.zone.piag.doon/databases/lezzd-journal
Size 4KB
SHA256 120a9fecd6d02ae8a8c07cd0e14a23fdf247adccec3299927c519fa208ffd214
MD5 4f340fd6ae6978db8c8eca97dc517602
SHA1 d79bb254ba5869f68bc979b6258dcec924e5b145
SHA512 2301b41c7a7b3d175ad402e3e31a77e6d8a07ed19926c912a469b5afe0e861bbfb9339fa4510e3b53994f16181b172f57bc9099be590ae46fe97e7dbe14d6ccb
SSDEEP 6:7+/lS/GPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKAr:7+tS/6qLJdTRmBEyPbZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.zone.piag.doon/databases/lezzd-journal
Size 8KB
SHA256 dab38b047463d65e75318c81d8282a412a6e009d6bed3132f5f1405d0106c31b
MD5 70eadf626989085bfd1b833b0d35ac06
SHA1 7709fc3cdc3a9c4cf1c5116f3d3d5a60af9b8ba8
SHA512 17bbcf0a9ad7bb72b7e297e16be2c75818b3ecdd020cacad73fb96251151a979b8cff0734a50f99408a3c659ca89bf299fcbc494c489230f93d209b8ccf08dd0
SSDEEP 6:7+/l9uOPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuK/C/2n:7+tIiqLmqCRmBEyPbQS2n
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.zone.piag.doon/databases/lezzd-journal
Size 8KB
SHA256 d74982ba6dc2313c527135201bb5f26f91e8523b29b9f3b543e777f6d7245026
MD5 5575299ea382d713acc7d645395a1fa8
SHA1 55abc1445b990b8861be68e3832acd2998397160
SHA512 d229fc57ee9e505157d17a47bd4842bf76a46fa5b026e6943839467fe1bb5549acd8aaa0b00e754b93904efb2f6a734d9f060a55cca81903e9d312706d7420ec
SSDEEP 12:7+tGnqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbfuz:7+tqqLy9yUku+haaL6nwyLGSfC
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/data/com.zone.piag.doon/files/.imprint
Size 937B
SHA256 cb925c0207a133b068b4e7fae33491b5fbb86643385f32a342c9d08cce8bc4d7
MD5 79a184203169267e408f46709e31449d
SHA1 e7e493bed58232d1b1dbc54b7ccfa72c67d6ee67
SHA512 5a4419a48494eceac4b637b3caa3e283ab10a337894c4650df8121b39fe40ece8b03f695d2ad3f86add3fad68b532021647088483a81ce4689957adf9d3c71c6
MD5 SHA1 SHA512

Submit Download

um_cache_1717417677492.env

Path /data/data/com.zone.piag.doon/files/.um/um_cache_1717417677492.env
Size 1KB
SHA256 7be934c175530c80b5e0b1f2c8f1c46e0cd960c49724b1ed42db317cc8ff77b6
MD5 c3dca20ff8b28ef004f870eaf3e484fb
SHA1 88e531d762c96da863b0218e567ef2755deeafa6
SHA512 32c7c0050e7cfab1c17e54b9fe594bb1e2dff5ce378e533ec53845ddf55a4151e91b9f52b5964ce1d7f019dd5e3a60db30af84753f8673a0b83d5f6fcd8c5521
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.zone.piag.doon/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 02b9dd3ae8b6166390851b9c773ae904df1d77bc225bf49305897d54e7b25fb2
MD5 794b67e33c127b5d7e7493fa17ccd4ae
SHA1 628e5434f24bb901a3120a4947cd7a39b83018d5
SHA512 bd80f7861f14b75718fe07be1a5a32ccda5e9270def9ad45cb2bff2a46582d248a7e4c4802ffdd0b024c89bbd9c21e2d4392974ae789abf27f0729b92aebe0ab
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.zone.piag.doon/files/.umeng/exchangeIdentity.json
Size 204B
SHA256 aef4515dc4307b342894d6308b778fee3ee50ab27ee9a1bc3cd79c0230000d8f
MD5 b14f6bd92d98250ca4d24976d610cab8
SHA1 08b32245930017c52dba54a8914dbd8d7d47f23a
SHA512 d3dd083f30930e7b231c558d9eb3080b109cbfa7f0cb66af30b0cacb33d438d4cbd9240ebf16ad90b8fb13b3035f8f0a1b48b39726718fcfb2cb53d97edea522
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.zone.piag.doon/files/umeng_it.cache
Size 352B
SHA256 da0bf8bdffb928d30759792b3a7c326c95c4fa711cf575d1766ee68c0946e42b
MD5 f761b2d8a5862e59acbe952cd2941b56
SHA1 9e3a58a5be114015eb2b454a4adc164fd43305e2
SHA512 a83a240dc9e0085924a8b34eddac0ce178ea9e8ac6b3455279e43858d7809cf3f187d2acd8aa0184b56f950fe6fc38c9a5d0dfa31b836bc6a8a27cc4c461e9b8
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.zone.piag.doon/files/umeng_it.cache
Size 179B
SHA256 857fe87dee6cf5e0667d16220a19ed10f7a9fa6b35abbad98e361a7bd909895a
MD5 7f9d575c2c222a2599d419a510ed3114
SHA1 2f48470aca6ad49941323c990d3215396ef5736d
SHA512 284a76e1a2242af8378be2b69074771084a782cc7ce7d9c74d97e3b1e3e93c282dea865192aa3ed2969462a2b7da7a8ec842cc3afcd58779f5b1b71c7aa069a5
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.zone.piag.doon/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads