Overview

overview

8

Static

static

6

abbfc842d4...18.apk

android-9-x86

8

abbfc842d4...18.apk

android-10-x64

8

abbfc842d4...18.apk

android-11-x64

8

Analysis

  • max time kernel
    178s
  • max time network
    177s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    14-06-2024 22:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    abbfc842d462adb69849061e91d5a790_JaffaCakes118.apk

  • Size

    1.3MB

  • MD5

    abbfc842d462adb69849061e91d5a790

  • SHA1

    a025d0b7ce728d74ce26546c5a1962c5d81cbfef

  • SHA256

    68203feb3411dccd4b1bb6afd3ec1f72589737b6324d82fbd9df0d14df66cc28

  • SHA512

    099c4d2588a25ee0cdf65f7226c8205b6188a544c90d11dc8962184a079de8033d2d6ba696c468e68d7e06913aedf0c2574d99e05f9a3fa8919e85ec74a8a5dc

  • SSDEEP

    24576:CgcEoL0otaYtXM1SprkM4FqD5Bl0ZHqU+XjTo+EYjM/Aq/13tdHbZKm51Ob83O:C7Q7YtbrkruBl0ZHKj/BjM/Aq/1XHNKH

Score
8/10
bankercollectiondiscoveryevasionpersistencestealthtrojan

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.xhkk.lssp.foyj
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    PID:4260
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xhkk.lssp.foyj/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.xhkk.lssp.foyj/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4331
  • com.xhkk.lssp.foyj:daemon
    1⤵
    • Loads dropped Dex/Jar
    PID:4367

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.xhkk.lssp.foyj/app_mjf/ddz.jar
    Filesize

    105KB

    MD5

    23ba0b249042b7ba33e92c0199b0ea4a

    SHA1

    99b13ee9f7307316c2337953fceed87e9942b794

    SHA256

    1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

    SHA512

    0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

    Download Submit
  • /data/data/com.xhkk.lssp.foyj/app_mjf/oat/dz.jar.cur.prof
    Filesize

    550B

    MD5

    a883806bdc631a026eaa6a5b0d82ba90

    SHA1

    a571d34bbb8b217829978229c8054ab88622e763

    SHA256

    5414c0547ed0c79c2639b23d26775fbf5751b645f7cfb649c90c66a36d9e94d9

    SHA512

    91b5b2f6f4cdcd4307b5a36f192f1c398de10b8ee6c0e1596de73778c61f06ea7c6015e2ffc8c67a187db7065e138e6728cca00414c93f0120da2531a2fe98a4

    Download Submit
  • /data/data/com.xhkk.lssp.foyj/app_mjf/tdz.jar
    Filesize

    105KB

    MD5

    293ea5f01e27975bed5179ba79d80eac

    SHA1

    c5b0806a537fd1cb753e11f1a9684933317716b8

    SHA256

    8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

    SHA512

    c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

    Download Submit
  • /data/data/com.xhkk.lssp.foyj/databases/lezzd
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit
  • /data/data/com.xhkk.lssp.foyj/databases/lezzd-journal
    Filesize

    512B

    MD5

    ac0bde97e1404a034e3e4aa5f78b50fc

    SHA1

    459b563495dc72014f7378ca8ffa6b0152ec6abf

    SHA256

    80538c4879303241894d8795d94fc12c7322decdb9a0c0f6904bdf2fd567684d

    SHA512

    97ece969742df371a3e086b89974bccb693481d9ccffd97ad33245b4314ef4b39628fdb9d392205951bb9fdb43ec44ccd2278ccdc45ed6f450e39112e3644ab9

    Download Submit
  • /data/data/com.xhkk.lssp.foyj/databases/lezzd-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit
  • /data/data/com.xhkk.lssp.foyj/databases/lezzd-wal
    Filesize

    60KB

    MD5

    a75309b6976f60d80a4f87bcf5914d37

    SHA1

    dba9ae0f8bfb2d25cc7c26274cadd2d848719a03

    SHA256

    f452091c737fbbfdda0bd841ff8a9d7ed0cb04a821c0e21eb23e52bf83fabcc4

    SHA512

    29a18b13df3750aa8fc3caa35e929c779af26b7ffbda94d903156ab38e7b94ef28988452eca45cba3428235cb469b9090337fb70302a0c4aec5761ab19c9001d

    Download Submit
  • /data/data/com.xhkk.lssp.foyj/files/.um/um_cache_1718404021602.env
    Filesize

    682B

    MD5

    9f0739d022c893a2d35854653e770c4b

    SHA1

    f47078647957277d8a9a69d3fa0d8f45a5b1b281

    SHA256

    21714e6874d09b2a08ce9f5cce40914613f500eaafbeb9c6349b75fc180221d8

    SHA512

    91b1ec7bf74979fb424e5017059acb3a27586019539874b9955fc90d6a9b86f09967dac6dad5d4d11a787065826a29b748994ef598803af409503581fecf31bb

    Download Submit
  • /data/data/com.xhkk.lssp.foyj/files/.umeng/exchangeIdentity.json
    Filesize

    162B

    MD5

    bfb22647e0b4ee0012845cfe9afa66a1

    SHA1

    6bac49d90ccc63a9a7af140b35a5ec80ab9393ec

    SHA256

    e803d50254df34d7aa1b17961d755a94c6eb749caee044ac23346891355ae80a

    SHA512

    d283439db7b43f7277819395c2daf39fb2e9bb1fd945bf730bfe53e09e99d27827ff6bd30ff886c83458ddaf4f23cd6c749de81efa54ac8f41fccf7f75753ebe

    Download Submit
  • /data/data/com.xhkk.lssp.foyj/files/mobclick_agent_cached_com.xhkk.lssp.foyj1
    Filesize

    858B

    MD5

    20703e4e301425212053c49af9da4b00

    SHA1

    11186fbdc9ff2c33c60c55768657dedd836a804e

    SHA256

    a88903f32351f833ee37c04c218ae2a220f613e715307a906f607d5fc5946752

    SHA512

    1448137c232ef42d25cddf81c4968c0445b81083e86291d497d530d3d49cf1b8f02b1eec1c6f2d0f9e5e8e07fa9fe7b80557549254be1eafb8c9114b1c566fcf

    Download Submit
  • /data/data/com.xhkk.lssp.foyj/files/umeng_it.cache
    Filesize

    415B

    MD5

    1c59b25e1247ebf5ead6f3145f13fcad

    SHA1

    aa084bbf125afcd8a6db5396324f9cb6260e4e90

    SHA256

    69ab6e7790c8c41797a1e740f597f33dc0bead69a1f4ac3871bfc69e66a62ca1

    SHA512

    0e16a62c1c161e7270e9716d3b948d73eec28a55e0056e647a455d8d7d168dcf44ae09c13e424ffb84545d51b20e36a7e05479be410d4f3ecf9f9dc585bd6a24

    Download Submit
  • /data/user/0/com.xhkk.lssp.foyj/app_mjf/dz.jar
    Filesize

    248KB

    MD5

    9b47e78a6ff90cce5755ce4742047627

    SHA1

    831b24aa9e116eb8d7065efd430088d419dfd6c7

    SHA256

    30d7699b73fd7f276945415c405c12bff69c5958d12f56265a768443f6fd8cae

    SHA512

    4587a5b26f13cbd0524eade71ed29203fc55029fe150fce850016aa7d9c578623cdc4b6a551bed3dec9e31a39563f8927cfcc9d21e2d83c2c781808b958446fc

    Download Submit
  • /data/user/0/com.xhkk.lssp.foyj/app_mjf/dz.jar
    Filesize

    248KB

    MD5

    a54a18b58c6720991c021f433dfb2a46

    SHA1

    d2ffa07919f92b6e04914e39843f08fdb2a75b68

    SHA256

    3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

    SHA512

    e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

    Download Submit