3ec5aea05c57cad11be0fc90683cc56a491a9dcb1b380c853465ed9899af2b38

Analysis

max time kernel
179s
max time network
188s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
13/06/2024, 08:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a497f3ef165ae8a2057f56a9ee20b577_JaffaCakes118.apk
Size 637KB
Sample240613-j7p7fa1arc
SHA256 3ec5aea05c57cad11be0fc90683cc56a491a9dcb1b380c853465ed9899af2b38
MD5 a497f3ef165ae8a2057f56a9ee20b577
SHA1 ac09a5a47c25beb32a2c5eb2e0479f0b2b09da0b
SHA512 7e7f9e255a72d952486bcec10900b7c43f402aee651ce533357ceca8ef742857827a3a1938d61a64100be2ab167af155bf2e0229d67e5ad29ef8c19c61c81393
SSDEEP 12288:l4L4oQI8Y0FotaKIUtrbMB1y/gfOdFskKk6eFx6MXi94vvQe6ERylT8gar:hoL0otaYtXMf5OgkbAMyiydU
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4686	com.sspi.twlj.dwav

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sspi.twlj.dwav/app_mjf/dz.jar	4686	com.sspi.twlj.dwav
/data/user/0/com.sspi.twlj.dwav/app_mjf/dz.jar	4760	com.sspi.twlj.dwav:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.sspi.twlj.dwav

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sspi.twlj.dwav

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs

flow	ioc
53	alog.umeng.com
63	alog.umeng.com
18	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sspi.twlj.dwav

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.sspi.twlj.dwav

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sspi.twlj.dwav

com.sspi.twlj.dwav
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4686

com.sspi.twlj.dwav:daemon
1⤵
- Loads dropped Dex/Jar
PID:4760

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/user/0/com.sspi.twlj.dwav/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar

Path /data/user/0/com.sspi.twlj.dwav/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

tdz.jar

Path /data/user/0/com.sspi.twlj.dwav/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/user/0/com.sspi.twlj.dwav/databases/lezzd
Size 28KB
SHA256 194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
MD5 fdb8a92e5060ce104e8f0faca55a47ce
SHA1 270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA512 ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122
SSDEEP 24:TLj0kSBieszXtUku+haaL6nwyLGSiGQQ:TskS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.sspi.twlj.dwav/databases/lezzd-journal
Size 8KB
SHA256 a17fd442ad7ebfbb212514f89eb64819ae9582f99635491ef4f8ac17be45c244
MD5 cabf0c8d3ade5ebc68d40032aacc30a4
SHA1 f5e8d10e0165460667cd321dd034080ea30d0624
SHA512 29b4e27fab33818d30d07856c182705fc27b734e2ca2d102d28d1f4ab509329789b0cb182f8c99a46f52357c81bb5aace72ed82263f601eb8c7be7a65b226265
SSDEEP 6:7+/l9R04Pg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKU//i:7+tjqLmqKRmBEyPbdi
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.sspi.twlj.dwav/databases/lezzd-journal
Size 8KB
SHA256 9ecab4a987192db14e56dd18d35e1b4ba240c536bdeeb2c8e092a225804a19f6
MD5 7e65eb86541716f8ef9a936743dee7ca
SHA1 9e330b32c1212c2aa7751accd6b38470a7375212
SHA512 443d5cfb06846faff83ce3adde3fdf3b370c5de17bffcb04fd7647a11f2be7ff9c79cba0c58ed0beb3cdf781696ae6012493446c706f750007f7a5832ef0afbc
SSDEEP 12:7+tJnqLyKPjSyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbNe:7+t9qLy2TUku+haaL6nwyLGS0
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.sspi.twlj.dwav/databases/lezzd-journal
Size 8KB
SHA256 448f13fdcd25880a823c394e1c6291b2144d1942509aa08379b6263880d877f5
MD5 b473fb48325508081d555970ed80f5a7
SHA1 45ea8d3a321b7cb32bf4e7de74e441f7f4b1f7e8
SHA512 f6a8ec11ac05c7b2de02dc2644d62d24fd6d38040d7f6039851ddcfee7bf9884f7714fb74761bf290c2de83e89fef5531a27ebd95a20affabe4f69b6d4bea919
SSDEEP 12:7+tHgqLWem6QADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbVo:7+tAqLu6teszXtUku+haaL6nwyLGSm
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.sspi.twlj.dwav/databases/lezzd-journal
Size 512B
SHA256 98b7b37a25b6afd9aed05affbdaf45c5d85f3818be84219ec83d84afafde4b07
MD5 99a7c12ec37244a4cc6f5518f68d3aab
SHA1 bb707f1980b9985351f7938249327348e27dbf66
SHA512 e31ebc5cbf560b00bb521e302479398b77fed3f118cdd5ef4fa466ed663dcf5ea6b0fed14e1b37e12f77514f3d9782959728deb244607fc4a88f2315fbcb85e0
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/user/0/com.sspi.twlj.dwav/databases/lezzd-journal
Size 8KB
SHA256 ceecb034c605742d73537616465fc7f567ec48b65396629159678e7f4d22fef4
MD5 13cdba657228dc96ad9c95fb1aefb83f
SHA1 2f596fd67d39405eeb1edbd8aa85a45bfb8add69
SHA512 c475acaa7c13dca2b024be1fcf7825f01c85d61c6b0088c1e9bb4ed75da444aea95587ddfb148f1d94aec94228eb18b317073afb243ea3c750223d4de72c24e4
SSDEEP 6:7+/l9i4n1ug9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKEU:7+tEqLiuWdYRmBEyPb0
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.sspi.twlj.dwav/databases/lezzd-journal
Size 4KB
SHA256 8e7cedcd230672afaa63db029f81e8f491638e1852f4aad8a80cface0d6347b9
MD5 f29a45ff04ab6ccec84da148a2f70812
SHA1 90a6ffe6d263ef9f7fad660e52428886b966ad94
SHA512 a2ca2774dfd10729c5be2980eb81ff4088fb113a9de856d8d1642b0c9fa0dab72d9b85ec874864c5ebc1e0eb3aeb1baa5cb2300703d5ae2b456b31995587b54d
SSDEEP 6:7+/lVajtgPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK2R:7+tV44qLJdeWRmBEyPbHR
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1718266803414.env

Path /data/user/0/com.sspi.twlj.dwav/files/.um/um_cache_1718266803414.env
Size 654B
SHA256 37eeef60a9699daefb9fab720d53d59ffb7376b5a9f3686b1988615337265530
MD5 9844639e36f53279936bbb626dc5a327
SHA1 02398f24464ba525c7fbca85b7313eed638958b5
SHA512 d66612bb23d527cbdb3b74b867fb15ac86abb516a62045bc37908501448eedc3186a7a0ec47f10f7668134890b445ddca4e7c9614975da20e8dddb66ee9ef5fb
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.sspi.twlj.dwav/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 9dd9547dfba62020e04136ce8f2db58955aaf2290206e65a6f81c6c0c417fd2f
MD5 f30e6e244efa61ed2ba2daad81b50072
SHA1 22283658ebd697a0e5d006492fad1fb05b233707
SHA512 6a7618bc5edf1ad3dc319bd3eab8a1edac88046b67e0a55d34fc438c3f1e0acc1bf739da7fc43fc347b0f976bfb63cf10754529531bce1cf720413f7b1ea956a
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.sspi.twlj.dwav1

Path /data/user/0/com.sspi.twlj.dwav/files/mobclick_agent_cached_com.sspi.twlj.dwav1
Size 806B
SHA256 34c6bb3133e8a03dd32a852f9aeda851207b6afa60b580232585e59f746698c7
MD5 2271901f7a22db4ba09241cff888dcc3
SHA1 376e7398f6a0a793f9c5d9e1afd93ff14577ec0f
SHA512 0d9dff1af34edee9c10b41ab9a0fd3ae04e6a6519af03a3b6c6bf41cc52f41ea99f0ac80b19f9960c9cc92b5a8254887a00463e8686d09e55560b1335c2d90fb
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.sspi.twlj.dwav/files/umeng_it.cache
Size 352B
SHA256 b9bf34e6fb055398315e2e0f7a6340de2ca3f304933c2acbd6f01e8506e445ac
MD5 973e232be838c51acf231e4aba3623ed
SHA1 d8dd5e6209f92a5a4b3acdf5513441b28debfda1
SHA512 a4d516a9f35b63096ad83f0d912ea9a6322e1bcd805f31c7586065f90290e6fc8b479ae7bb390cf56ad95b907bb7427b9dfbc86e46e876250bfbda6abada1154
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads