3ec5aea05c57cad11be0fc90683cc56a491a9dcb1b380c853465ed9899af2b38

Analysis

max time kernel
179s
max time network
180s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
13/06/2024, 08:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a497f3ef165ae8a2057f56a9ee20b577_JaffaCakes118.apk
Size 637KB
Sample240613-j7p7fa1arc
SHA256 3ec5aea05c57cad11be0fc90683cc56a491a9dcb1b380c853465ed9899af2b38
MD5 a497f3ef165ae8a2057f56a9ee20b577
SHA1 ac09a5a47c25beb32a2c5eb2e0479f0b2b09da0b
SHA512 7e7f9e255a72d952486bcec10900b7c43f402aee651ce533357ceca8ef742857827a3a1938d61a64100be2ab167af155bf2e0229d67e5ad29ef8c19c61c81393
SSDEEP 12288:l4L4oQI8Y0FotaKIUtrbMB1y/gfOdFskKk6eFx6MXi94vvQe6ERylT8gar:hoL0otaYtXMf5OgkbAMyiydU
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5081	com.sspi.twlj.dwav

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sspi.twlj.dwav/app_mjf/dz.jar	5081	com.sspi.twlj.dwav
/data/user/0/com.sspi.twlj.dwav/app_mjf/dz.jar	5240	com.sspi.twlj.dwav:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.sspi.twlj.dwav

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sspi.twlj.dwav

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
9	alog.umeng.com
52	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sspi.twlj.dwav

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.sspi.twlj.dwav

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.sspi.twlj.dwav

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sspi.twlj.dwav

com.sspi.twlj.dwav
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5081

com.sspi.twlj.dwav:daemon
1⤵
- Loads dropped Dex/Jar
PID:5240

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.sspi.twlj.dwav/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar.cur.prof

Path /data/data/com.sspi.twlj.dwav/app_mjf/oat/dz.jar.cur.prof
Size 727B
SHA256 562322ecfb89a7d02c0bd6a17a66cd1f96c81ec7bbf0e322bce177358f74307a
MD5 23c181a2d36eccbada96c4a58386ff94
SHA1 4cc44adf7fd391ba6474547827d07722270af8e5
SHA512 59429c8524df4f4d1d1e2ca1c507f41a82364f2c455aed7000dd95191b5d47da4fc8aba9cfa7439bcaf7bffdaf29f5d550efff8bc06d432e179620c95ab90857
MD5 SHA1 SHA512

Submit Download

tdz.jar

Path /data/data/com.sspi.twlj.dwav/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.sspi.twlj.dwav/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.sspi.twlj.dwav/databases/lezzd-journal
Size 8KB
SHA256 f8954c96116c939956261f3cdc84d3da63ceb852d2662a96441bc85cdf37dfda
MD5 c0f62c41fc1a115887b963fb9fa3b171
SHA1 ce3864d2af6cc37c363474636f8b84a27c711ac9
SHA512 08a62c23e246b98fbfaae390a69e4cf845778be1ff3e47e5c0544413d06f925b0b5ee102f8cbec6de45f0ced00ca0ee6a22fd28f074d73a326c5b835fbf1e943
SSDEEP 6:7+/l9n7Pg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuK8voU/4:7+tFzqLmqCRmBEyPbH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.sspi.twlj.dwav/databases/lezzd-journal
Size 8KB
SHA256 8b8e2d702c8a850f2d63e0f4cf41cff52615be917ff6839e98fd4c0f284198f5
MD5 bb94c97004620ebe62983960f5ff8044
SHA1 db38026eb089e07b3c1ec9845186f1d82cc0a1d2
SHA512 c43cf0f54c3e3683434b87abcd6d3baee84bfcf086753baf1db6652687dc42aa919474d1c5df3b513d7c0735afd722226f9b6a0b1f6fb063858ef3ae88f60b87
SSDEEP 12:7+tynqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbT4H:7+tWqLy9yUku+haaL6nwyLGSw
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.sspi.twlj.dwav/databases/lezzd-journal
Size 8KB
SHA256 b9cf798d9e19df2f549d8dc18c22f250c90909074dc518fcde6bd7ad5bea88f9
MD5 0b012ba26eb112d3bab5abf875f8d9ce
SHA1 d0f1ee1008eb9a1d044c1f9253cbfc3becfa6412
SHA512 2fa4ec64f3c08cdc7acd6317ba11d6f1fb9013661255d60a907819d2189748c000e9bfa11f2ba1fef86970d24085b46a9286a9907c9cea835a4122f756913350
SSDEEP 12:7+tdqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbbHn:7+tdqLGqteszXtUku+haaL6nwyLGSL
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.sspi.twlj.dwav/databases/lezzd-journal
Size 512B
SHA256 3a0cd78d870de850738ccfbd50c264ab01c0b07fe51d7a57b1d4686e5cd9b781
MD5 decd0794c1d5d7ba2f5d5199fd6029bf
SHA1 28f5f89cc9b4804d46fa781cc28e6dcd7f0277c0
SHA512 55399e5c2ef17802e77fa864049a30c990e094f7ac8f5608c10d087b08c62ce70ea877994da920d9165c380ddf3e2bdb4dbfdf7b6fe7bb09384d194a9fe20bc6
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.sspi.twlj.dwav/databases/lezzd-journal
Size 8KB
SHA256 448aa508ae89e8d02435f903380e4e776d78140a57a5d546ba88e3c458fcaf41
MD5 212716ed6b0e59a9850dd5eff5bb3100
SHA1 c2e4dc50a44c037931cda1a94ccf65aa6a46aa89
SHA512 7acd65420afe70897cc248ee140b26f9453106a0e1564c803374d99284ed18c4aef5f3e5f224de1a5e1e7803d66bf659a03e9786cc7810dcf7286bcbed419115
SSDEEP 6:7+/l9Zqy/SFn1sGtng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKs:7+tp3GtnqLiuWdwRmBEyPbz
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.sspi.twlj.dwav/databases/lezzd-journal
Size 4KB
SHA256 cb00e81077d849f9ba3248dd40314ac7d011d66964054f135ac8888c41a031a1
MD5 31e6d3b6e271663f6cd832e547f75a69
SHA1 ecb45b83d49a2238d04b0205e7705b830cc07117
SHA512 b1e5d224e571eb52d4ecdc0bc41e7a2edc7ad545d93d027a187a0746748c24b1cc5a6060c85b36b2ddbb51d8794ca4c6c74b76fb3707331c720bf56d07b5c29c
SSDEEP 6:7+/lJgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKH:7+t+qLJdTRmBEyPbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/data/com.sspi.twlj.dwav/files/.imprint
Size 951B
SHA256 3abb1db494d519dec0c4163bf30f4f204f79ee1055a98429b10c0216f10f262f
MD5 a102cccd4a3994c3f03402cf3a5d1d2d
SHA1 140b2fc4d76eb18a4e8d34230163c05dfe7294aa
SHA512 70cd91f543f832f34098f89e8a3398511e61d9af271dae005d2f59b067408de87a4342352c215929a46b863db254fceecad9ede8d6cbea928af4bd8408414ef1
MD5 SHA1 SHA512

Submit Download

um_cache_1718266851951.env

Path /data/data/com.sspi.twlj.dwav/files/.um/um_cache_1718266851951.env
Size 1KB
SHA256 82f12c2825abc3564b46a4b45166245f6c7465734e39c7d775593ef38a47efac
MD5 5119748d28d261a7045b8bc710ee3738
SHA1 b55bcac11b232bceab36068469d1ba6c7dd372c2
SHA512 1f9b92a70ce10e067107f3689c29a44f7f985f63dce9c562151b152e9e4b72641d324407aabd4e9c176901fae5ed2bc0e3d0cfadeaab5c42194253244a7e60a9
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.sspi.twlj.dwav/files/.umeng/exchangeIdentity.json
Size 204B
SHA256 c082acd3b20c982698e4518d013011960be8a01f847f99efcd11ab47d148c031
MD5 aba42b77de2e39adfc92b110a6b8c6cc
SHA1 0ce74f774ff86d35a6c0a5d1d6474bc9bbdb0d38
SHA512 ae8342505eb68054a4584ac7259147e783776ec63ad5a50725c5a686b141d432c0f37526ef2d952b6aff2b5c05112e20ecd409f9ac0a78e31ba3c4cba612f507
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.sspi.twlj.dwav/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 224456172b2fbe09de3806afe72ee234740c45b05e0f2a8c184fbd36ed1095c4
MD5 c860b90aab195c5869b3417d1dce2418
SHA1 be31e34a6842e96951fc53d7e185e25bef475d6d
SHA512 bd53c38648f3e47d6809d927b0067e9801d4693b1b6b4d9a4d48102a01b6ee3b1041ffaf18530bd703a111ec2edb4b69ec6704023056bb0324fed651616d9d83
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.sspi.twlj.dwav1

Path /data/data/com.sspi.twlj.dwav/files/mobclick_agent_cached_com.sspi.twlj.dwav1
Size 1KB
SHA256 7cd7c6891a7793c51d76ff52146c81fc499b4d3d1dda25f9ee4ba17997b165ac
MD5 925467ad1da221314e624010cdfd5502
SHA1 41f53470753b0c67328b74a5322223804c0e1544
SHA512 54f1f8ff2d49dc9c1f496555acd397b388ef7151808cd40c5cbbb247d4564c38bca48c0eec2e20ff66667b2b0e84f5a6d919392b05d6b6d177a8d89d5d601b91
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.sspi.twlj.dwav/files/umeng_it.cache
Size 179B
SHA256 794a8eaf88de915778f11a4a338de9b39b37ad1f175a3d7bf9c91ab8ff276108
MD5 e98c01422ce162244db7d9828ad08434
SHA1 cc1756c014f3463b4e62b59c757badab620a4bb5
SHA512 8e059d29995d8316cb3ec1294d0e4375cd008283ddc0652b2791557d3da7253bd69a710e5e515a7a41aa3f62dbce3c0b9e44a80c6e14061e6ab8606d587af0a9
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.sspi.twlj.dwav/files/umeng_it.cache
Size 352B
SHA256 cbbfc10f3231e055333a481d02c0f6744bfaac7ea34f99fd6f9d9818384ceedf
MD5 8567c006d1d803553e9de909baaf59cd
SHA1 bd63739733b2e1015f6bb1a9471a504c3c708c68
SHA512 15abfaaa2683ac74b7745f75c5835aa3fb0c06c4bbdf7eb1460a33f7f6beb9fa0c3d96d23bbd8b7f530ac50d31055ca2be1b1d49a6e598392347e74348276ddf
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.sspi.twlj.dwav/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads