850347bcf79455608014b4dbec62092f0ada6b08da2bfc112bb07254c4e2f2c5

Analysis

max time kernel
179s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
13/06/2024, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a465004fcd91973beda26061f059ff54_JaffaCakes118.apk
Size 6.3MB
Sample240613-h6e5eatajp
SHA256 850347bcf79455608014b4dbec62092f0ada6b08da2bfc112bb07254c4e2f2c5
MD5 a465004fcd91973beda26061f059ff54
SHA1 d9a3fc92953d04fd9015f315310fe83790ac0e5b
SHA512 85a281bf3f8bda348ae8a2a14cd0bbeef6d31211ac9a813a76cfc39f5aacad8a9516fb5c9e3fe8225fbbb69ae039ee1dd1eb00a012184ca015b698242ff8b788
SSDEEP 98304:UEVILPnmmjjpX76LtvLTofjiadu52wi4MZ4iV4jSmBL9mDPiPSaY+YNsj/X9lk1+:UEU+mxreLTmjbu5FimjSOLZYJg/7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.bxd365.helper:pushservice
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.bxd365.helper

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.bxd365.helper
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.bxd365.helper:pushservice

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.bxd365.helper:pushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
16	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.bxd365.helper
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.bxd365.helper:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.bxd365.helper
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.bxd365.helper:pushservice

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.bxd365.helper

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.bxd365.helper

com.bxd365.helper
1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4461

com.bxd365.helper:pushservice
1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
PID:4521

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

crashannals.db

Path /data/user/0/com.bxd365.helper/databases/crashannals.db
Size 44KB
SHA256 2dedadd105b3c36f2f500d24ca28852c5d173593f5947317b15c4d6cd8a23574
MD5 83711c426e74713eef541f8734eef3a0
SHA1 d6781382f3773f14c3bf703edf883b42e9083e7f
SHA512 00ef03c3372f837af52abe811124ac36fd4accd77d3cc865f58ec198be8de5abd5605ee235fd64123780a01ce7a6359639579c391ad64cefcac66c4bf740edb9
SSDEEP 48:TR0xopA/t379y/MSocgrwTLexpaJU9CTZVpKxbW:N0+pYto/tvHCqLpKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

crashannals.db-journal

Path /data/user/0/com.bxd365.helper/databases/crashannals.db-journal
Size 512B
SHA256 eba20e521c839874c1c4b2081b3b2e7e423be90e9a3087c240093ada73d42f1a
MD5 1ec98af2e04392b232e748d5f2b5de32
SHA1 65d8e35305e5e4f56299659c5dbf9b542f1d1d2b
SHA512 b9d5ea58595efdeaff9c6494c32a3456bf5e52af80723c6c8594a65db4b6bb03f56a6a801388caa2ca88ed266a85051cf9b237e333e77fe9d68b271b2c2826fa
MD5 SHA1 SHA512

Submit Download

crashannals.db-journal

Path /data/user/0/com.bxd365.helper/databases/crashannals.db-journal
Size 8KB
SHA256 f6a98970f0fb314219c8e291c3e1230cfa7fe4cdb3ba1393ca3f4572cf3deee8
MD5 67fd7e915a08c7f2fa751117b7cc0206
SHA1 6037e0240a322c0d3aec6438a354c2e0d6f00632
SHA512 3f54764c9db4164fe91d18b9310b5681c9c9cc5f7203d3703483623d25c010d2a1369f74cacc5df633bab527793f8d2707fbff30ec8727c11fcfe5d4006b753d
SSDEEP 6:7+/l91mFn1Vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKux:7+tgqLiuWdYRmBEyPbfx
MD5 SHA1 SHA512 SSDEEP

Submit Download

crashannals.db-journal

Path /data/user/0/com.bxd365.helper/databases/crashannals.db-journal
Size 8KB
SHA256 141578dd9d9c57f4d123a7b75c026a276ceb8a8a3ef73f006263d938c776f09c
MD5 0fc294d41f9212956caa1c61ba3b0a5e
SHA1 cc049e5441866efa58ed15cc61a25c84ea786e48
SHA512 f999f67a9de8a961d89ee727037350c38d02ad7220bee175796b444de7ce6e765c6456a3ef02abf8766e620368240f1ab59591b29006ed6f1be7c804b9d33c6c
SSDEEP 6:7+/l9RgiUHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK0K//h:7+t+qLJdeWRmBEyPbmh
MD5 SHA1 SHA512 SSDEEP

Submit Download

helper.db-journal

Path /data/user/0/com.bxd365.helper/databases/helper.db-journal
Size 8KB
SHA256 b034de8b9fd8cf983dd6a5f6a50f68d98f800fe221a892c6c45156df36d79497
MD5 9b2f78fe88e1b600945ad0e1c92054ff
SHA1 9e0f64567af5dc0f60407747c5a8415055c6d79d
SHA512 a574ced5b87b4f8653f74c56ad10adafdb6fffcfdd4206f4baf5ac9c2612d7e6b70173cc533b33367574157a48b41e4bba4a2a26c67bfa7afa7f5599593d758f
SSDEEP 6:7+/l9PUilgn1Rll/vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKG:7+ttqqLiuWdYRmBEyPbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

helper.db-journal

Path /data/user/0/com.bxd365.helper/databases/helper.db-journal
Size 8KB
SHA256 016355a1c3c14aafe4b613c4fc6779e6dbf40dd3fff10f49a414af9f3cea566f
MD5 1509658c0177add05985efd6155f1a63
SHA1 b5d711b7598defbbe655d67b2b16977c5a980b9c
SHA512 275a84d6275a5e79a955d106a9113a64b4f8e0a968f24dcf05d729494a999377e238a6f360e0f7374fec01a9fe84b54cefd2a1e801c2026d56b5c10984f3dae9
SSDEEP 6:7+/l9I4Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK7M/xG:7+tWwqLJdeWRmBEyPb7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/com.bxd365.helper/databases/pushsdk.db-journal
Size 100KB
SHA256 c96c4644be987ae0cb24ba16f6713f0551a72083cdc0c6ab89d74b784292271b
MD5 3e3aa151c34eebc5a6aade5d94d1b509
SHA1 44ba3232809fd8cfa2231502ddd5cf5207130b5a
SHA512 590e74e5ffdfcef31edb325aaf2b488bd5117675bfebf1b2434d8928919a8b4cdc0921cb955da299443322dde13085005ef60daf5f5c704354b5bbf4bfe7e4b8
SSDEEP 384:egNJou9O2yu6Qz64uNufyn0DKUeorI/16aw78KI:egB9Byun6qftFrIN6a48x
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/com.bxd365.helper/databases/pushsdk.db-journal
Size 12KB
SHA256 e9af4cec2af2d5baf691c95668b2944e4decb14f5523fb1b38bbcf7e52d923b7
MD5 6b55a82436e50f508e2686b68ee76c77
SHA1 1e40f7c0e4d98b352c8c4f79598538fdaedbcefd
SHA512 1a9be12300030e0798313a33875ef84fcfa9ef05c9c8053a4c342d61e2c11421cb7e51ef539b74b849ffa38fcf8ec6117bdf7ec1b9235318941f3ff8cf16f6c8
SSDEEP 48:7M2rw6q3R0xopA/t379y/MSYpqx0xopA/t379y/MSZ:7+6cR0+pYto/tYp80+pYto/tZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1718263313376.env

Path /data/user/0/com.bxd365.helper/files/.um/um_cache_1718263313376.env
Size 540B
SHA256 3697343c0513562d8f1135b6bb353ab91e3bd23202a66316311a946e3c6fb2aa
MD5 60b1703be32af585118c7f80534c14e2
SHA1 a4891aa0461b6cb0de731954784dc2decb76c668
SHA512 ba18d725a83b8d73ae5ade2b48423f518f9514ba19b2687010fe9e5cbd77dfc62a4a78ea129078ed46d0730755eb78916279a8de9b2669b25fe7636ddb2a8f5e
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.bxd365.helper/files/umeng_it.cache
Size 4KB
SHA256 8ad8e36659f2b6409267dac7bbec1524928f6749eeae639926666a7f4429028f
MD5 6c23571c28d83b8ee4bbca90932fb128
SHA1 ee350f1d63a8bea253016014eb014b1b1d1c0fe9
SHA512 3fdade847f5df68c19e11c4953c180d8ff213b1925cab92b360b1619cbbd25c98a2209752e90dac63a8c51972f282792b7cc888815c265c66dbc2944800b8ed6
SSDEEP 24:7+tvqLVvz0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSK:7MvqB0xopA/t379y/MSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads