485959428ca353d404fdf264486ae95d0b48f92ff2a5870ec004103d332fbcc5

Analysis

max time kernel
178s
max time network
180s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
04/06/2024, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
937d686eca77928a3b8ea974e2b3dd76_JaffaCakes118.apk
Size 1.3MB
Sample240604-dxm2fabe4z
SHA256 485959428ca353d404fdf264486ae95d0b48f92ff2a5870ec004103d332fbcc5
MD5 937d686eca77928a3b8ea974e2b3dd76
SHA1 91464678205a52f02050106bcee52079a78dfc1f
SHA512 e4204366748898067d2f80d5d0310a78d7686e7704733de44e9c3ae0a09f0b222352580e4658b3362094dea564aa1dcacf617253fcb590f969d0783b18f234e1
SSDEEP 24576:PucEoL0otaYtXM3SprkM4FqD5Bl0ZHqU+1j/o+m0jKt2q/13tdHbZKm51Ob83W:PNQ7YtprkruBl0ZHojDnjKt2q/1XHNK7
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5218	com.rojg.hanu.gsnx

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.rojg.hanu.gsnx

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.rojg.hanu.gsnx/app_mjf/dz.jar	5218	com.rojg.hanu.gsnx
/data/user/0/com.rojg.hanu.gsnx/app_mjf/dz.jar	5289	com.rojg.hanu.gsnx:daemon

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.rojg.hanu.gsnx

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.rojg.hanu.gsnx

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.rojg.hanu.gsnx

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.rojg.hanu.gsnx

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rojg.hanu.gsnx

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
32	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.rojg.hanu.gsnx
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5218

com.rojg.hanu.gsnx:daemon
1⤵
- Loads dropped Dex/Jar
PID:5289

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.rojg.hanu.gsnx/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdz.jar

Path /data/data/com.rojg.hanu.gsnx/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.rojg.hanu.gsnx/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.rojg.hanu.gsnx/databases/lezzd-journal
Size 8KB
SHA256 749c9e350a05289f6f4a7c3234f086763b6310e7694dfdb33ab563c64a3925ac
MD5 65494dc16b834f7d200d97c75a7d004e
SHA1 50ccb0e1d4773802e1b2a7d868a7bfcda9dfa866
SHA512 e56889d2639cdc199dd8dd937dacdd581038021f3970fb3e17addcb02e34d040dd4644b9cebc7d49bba456891fe6795da478b22c9de2f8512b78c0c89f178348
SSDEEP 12:7+tiqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbbOi:7+tiqLGqteszXtUku+haaL6nwyLGSbd
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.rojg.hanu.gsnx/databases/lezzd-journal
Size 512B
SHA256 386db8895b1ca02c84524ed5c5ffb03df4b971443ffca7a554d1fcb3ec7f2779
MD5 7837e0f9bd9cb8369b35cff95f8a234d
SHA1 a968e57b6af46d4bf79672d33b5d95d1e6b368ca
SHA512 356cde0349be13f4cb9b55c51f4ff037b7720f3ba9ba4f7e6168bea3f4787f671ceddedfff566620e8f7b8b6312084913a049baa22e5eb21c161de62eebfbec5
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.rojg.hanu.gsnx/databases/lezzd-journal
Size 8KB
SHA256 7991d6a22f03a0df05e2fe9aa6e7a7a4b3aab9fb7d63423f8d23531dde7935e1
MD5 e047f9e254b61b24c38e7e26b6300b80
SHA1 993a48a417dead729ed2692bc81cb974b02d44dc
SHA512 d29348fdd24e5f3d891a744f71ef1ada980de0afbb8e3f9379a6c750c22246e647f2d2bc81ddd4b2a7bad516388e85befef71a350668f025385b4882619907fc
SSDEEP 6:7+/l9lFn1kfg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKx:7+tvoqLiuWdwRmBEyPbe
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.rojg.hanu.gsnx/databases/lezzd-journal
Size 4KB
SHA256 e5b1ab47f831a58f83335c8d6ebb6c2568c4255bf80542707fcaacb649592d76
MD5 48264c281b91387e499372e624a23e91
SHA1 166b72a6cf05c82bba3311811cd0bab83fd57e33
SHA512 35363b36709073eb8902b08843250a67728c498441fc7828491b11dae1119c1a461ed462dd39ba2aa13e50493fa9e707423aaab846923df319c75590de5c3213
SSDEEP 6:7+/ljPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK0Xp:7+tbqLJdTRmBEyPblp
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.rojg.hanu.gsnx/databases/lezzd-journal
Size 8KB
SHA256 c6350ca65636870fdde4f1b41f77eeccf60da1d525c39e0ad76785f23f87a011
MD5 7a6f8535ba39dce5c1e54250963a7a17
SHA1 fb9a440a7c5eb74a042fedabe89987b15cc72384
SHA512 ee3d6e1cfb36feaa4676c1c3f728b77753adfbebad7261b78b7339383304e18837a78d5d4d252de5f9abec80ef0c0af805dc1a56413b6d1c299743f4e83ab9e7
SSDEEP 6:7+/l9QPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKENM/9:7+tCqLmqCRmBEyPbts9
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.rojg.hanu.gsnx/databases/lezzd-journal
Size 8KB
SHA256 05f834870c41fa310c7b86f5143466378f619a12caf6c508837ed561793213c8
MD5 0c6e6ed68c5129435cf01d48851bfe06
SHA1 81a37d580636a94dea6fdc8436e0a658f22e6016
SHA512 7756221624532cf929b8db11133fcc3fbc9325362bc03c30b7846d6319ff8e34d3cad360475862ec3e8e878316d534b9bf6ce85bc7709604343d1d9ec13abebd
SSDEEP 12:7+thlnqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbZ0:7+thJqLy9yUku+haaL6nwyLGSO
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1717471524190.env

Path /data/data/com.rojg.hanu.gsnx/files/.um/um_cache_1717471524190.env
Size 657B
SHA256 533c8c77197e5c6935e8bf32153bfdfa958b57aa4338b7f71be3be9f73364131
MD5 771b77aae6c57fd8a079696ce4396f29
SHA1 4223836d0c18a06163751a6541ba7f7a2068ffad
SHA512 f9b5a3f401d949e90b986b5cf293605cf5e9fbb16e39974dbd89d05a2ded323ac6fd96df125bfbdd5c6101e3d3c2ed079e602acbbb46f9cb83d8b291093623a3
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.rojg.hanu.gsnx/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 5e33e31fe2fb75f5fe81a7a78020bc3a39f599e716f2f61684448d53c0a2a1e6
MD5 4aa6389e733e2f9d7fc16142e36e3979
SHA1 9e44a00a2f4b5f07fd3c19d987d7b4e24b8e2d9f
SHA512 1b9603731257f01ea858f0db39093e633ced8bd4215d9875f4e4b279f8198eeb8bf29ad4517ab84514ffb4bf8a26118afe3d862a65c92ebe1a9d87de47271aa8
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.rojg.hanu.gsnx1

Path /data/data/com.rojg.hanu.gsnx/files/mobclick_agent_cached_com.rojg.hanu.gsnx1
Size 794B
SHA256 9f1af1b019c1bae89474b23ab20e19686c56b500ccb952d32e7e05ac70d1dbfd
MD5 942f87521b8c12eb0d7a92eab4e8df77
SHA1 9fbe2758effa432d95194f9c191c1cb4d3527a37
SHA512 fa979f2ed4e1963a34f620d933136681595da880622ef6c6cc491b709b212889730f5f7786828fb6b9a4b6183858fb0b743f132c4d25917344cb067bb962d883
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.rojg.hanu.gsnx/files/umeng_it.cache
Size 350B
SHA256 6b8a9751abd8fd8192c818681745b4fbaa38dbfa2e0a75e5739a9d08680255cb
MD5 c68f828f07ad5b49c44dc171331dd3ef
SHA1 5675923b61993d636680fde5d503cdfc901ee6e2
SHA512 6c1f05f3562c4c041091f8735778aeeb155bb7813372ed62b04ac367450515a433284fcbbfea0474432431d8336d0382483ceb66aaec6dc1e3ed02eabb8cb6ef
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.rojg.hanu.gsnx/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads