f40f8b178c14155ddb73ff4583a9b57d1f1f1b9de345329d9d902e6b35768b51

Analysis

max time kernel
178s
max time network
131s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
15-06-2024 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0427b2ba17f72797853cc02fc1f8c66_JaffaCakes118.apk
Size

637KB
MD5

b0427b2ba17f72797853cc02fc1f8c66
SHA1

1a7ebcea3386d71c24ebfc425b10ebbca541fffe
SHA256

f40f8b178c14155ddb73ff4583a9b57d1f1f1b9de345329d9d902e6b35768b51
SHA512

22bdbaa9dfa2a4df125504ba5ae5e6b9035d041e4ac11e96a1f71a2a9e879629c0f2bb6d2ffede633f726af19a0047c3c0f31d0b54fc5a04155096dbb98c43ae
SSDEEP

12288:+4L4oQI8Y0FotaKIUtrbMy1y/gfOdFskKkMeFx3MAt94vvQe6ERylTAf:UoL0otaYtXMU5OgklJM8iydy

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.jppa.fugg.puiw

pid process

5031 com.jppa.fugg.puiw

pid	process
5031	com.jppa.fugg.puiw

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.jppa.fugg.puiwcom.jppa.fugg.puiw:daemon

ioc	pid	process
/data/user/0/com.jppa.fugg.puiw/app_mjf/dz.jar	5031	com.jppa.fugg.puiw
/data/user/0/com.jppa.fugg.puiw/app_mjf/dz.jar	5110	com.jppa.fugg.puiw:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.jppa.fugg.puiw

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.jppa.fugg.puiw
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.jppa.fugg.puiw

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.jppa.fugg.puiw
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

Processes:

flow ioc

7 alog.umeng.com
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.jppa.fugg.puiw

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.jppa.fugg.puiw
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.jppa.fugg.puiw

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.jppa.fugg.puiw
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.jppa.fugg.puiw

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.jppa.fugg.puiw
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.jppa.fugg.puiw

description ioc process

File opened for read /proc/cpuinfo com.jppa.fugg.puiw

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.jppa.fugg.puiw

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.jppa.fugg.puiw

flow	ioc
7	alog.umeng.com

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.jppa.fugg.puiw

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.jppa.fugg.puiw

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.jppa.fugg.puiw

description	ioc	process
File opened for read	/proc/cpuinfo	com.jppa.fugg.puiw

com.jppa.fugg.puiw
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5031

com.jppa.fugg.puiw:daemon
1⤵
- Loads dropped Dex/Jar
PID:5110

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.jppa.fugg.puiw/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.jppa.fugg.puiw/app_mjf/oat/dz.jar.cur.prof
Filesize
586B

MD5
f4d61bfac430e19512ea2ff75b438059

SHA1
a0902993f276693ab4ef628700999d81b6632cf5

SHA256
6c45a89a3460dccfac1ee5d4ec2a0e77efda525cfc71973bdf4de60fb8b70a79

SHA512
00947c607069f25eca4a5499d0436bd29ecbe697d9d66de52d92556fac578c7970dffec11f51a2833f4fa8c75e5ca5057c4063d8777fcb50a3f235aed2ac5074

Download Submit
/data/data/com.jppa.fugg.puiw/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.jppa.fugg.puiw/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.jppa.fugg.puiw/databases/lezzd-journal
Filesize
8KB

MD5
144cf512e29b7f89f4c78031e1b0e6d2

SHA1
0facf4727d4f489bf0e83d5c905ed079aa341b74

SHA256
96706451342363c4980e6aa6f69eec14831bfd16f3f2d0446de48ab2ad14eec5

SHA512
fd1002d196953f2eb4e773730bd325c2a95a64a7948f70ac4f8c7c2d10f3c32b88d85b862deec53f806d999b6b339e5175faf25f6098af163daf402ed8b7f460

Download Submit
/data/data/com.jppa.fugg.puiw/databases/lezzd-journal
Filesize
8KB

MD5
0bfb293faac1482479d5761c8678f717

SHA1
3ccd0f3a9fd27ffec4eb5121b228ff09ab434574

SHA256
af3d341614e7160f4cdaa9490b28cc3cebf22a07ecd8f98b78ddcaf12983d76f

SHA512
44e366690a65c42e108edf3f714037bdcb21e929f81acaa93d0e6f8ac1b474eee7db59fbcefd6836db2fc8f08e1ddcc4eb03a462483bdbc062f74086edd3ee59

Download Submit
/data/data/com.jppa.fugg.puiw/databases/lezzd-journal
Filesize
8KB

MD5
6508d49ae08644f0f59b829593f5127c

SHA1
b61b18b66607ace2726ae8195defaf3170d54f0c

SHA256
61aeed00fa6434afbec9e3b0b4f8dd3dc0dd0a50160ef7fe0f3ca2161b82ea00

SHA512
2e65807715adc79e67b53474d7031806cf073344e1ec5b1c4aca908e2f22ad65b800c6949963fb802ee40e913a3a9e0551ebd22f5be76e3a5a811a9f0babb889

Download Submit
/data/data/com.jppa.fugg.puiw/databases/lezzd-journal
Filesize
512B

MD5
007810e930b12c325f3e37d1b266f5de

SHA1
29f6c05de739f89a9d196242e37cd9362b6d6fc6

SHA256
681eed40394cf43e44ac0cccf3055478fd5c39f61afce7e4bd82129ac3e76caf

SHA512
ade3591713a438372bb2bd518cd05026622d17225676f1c7640856340b5deb6d8098be5758ac7b39171e6e3fc417bc230cd4dd8c27ad7906d8250fd71e32a783

Download Submit
/data/data/com.jppa.fugg.puiw/databases/lezzd-journal
Filesize
8KB

MD5
2ebcc4967b30cfc06d8d1808e2f2cfe7

SHA1
b25a38a0c3f02cd673695b5d902eb4a98ac8480e

SHA256
e8e724e764804ba2f0a9cb3720b552685afbcbda00fffd7d3a1555eacb0d979b

SHA512
846a0a5e7a2edfeda7f9be11d2e7b7a6afce7c797a673426f9f6ea22380a3875212249637f050e2bbb1631718b47a85f48c7c6beddfe2d29c9c479178e09239c

Download Submit
/data/data/com.jppa.fugg.puiw/databases/lezzd-journal
Filesize
4KB

MD5
f173cc416521dc5ee6dbfa236c98c51f

SHA1
278a58c416c107246be47cabde0be8208be7eddf

SHA256
dade41ed7f32c4ecd7fc958ec5735aef40138b522b4a32bc2bf543259887d83d

SHA512
584f3be399d2979a9210befbf0a4281f767aa8ed2ca441ba96ca25327056b5de3bde6da4c291ea63c84ce6681b56d89426591499b40b3e00b02098eeb2d5cb58

Download Submit
/data/data/com.jppa.fugg.puiw/files/.imprint
Filesize
950B

MD5
f2ff9e3fd071f4dca2c6bd23b32256fe

SHA1
63dfdc16479ddf9ba62ba5e5353f1fb1cc5e5ed2

SHA256
405b9f79952a018acd366e8e5507c1d25648ef396b18feaabb2b97e74215ab50

SHA512
ffa0ad78a5654b5383af862beafca3c21942380402a4b80f4cb27484f9f61159b46522139bbaf96234da9728603b3b6e38f35eee7bb73abdd1af390a240728c5

Download Submit
/data/data/com.jppa.fugg.puiw/files/.imprint
Filesize
950B

MD5
29c3fc546010c7ecd8a20c979ed222cd

SHA1
9c587e87560405038ce404fb7ab0b84355a01244

SHA256
a62cd5a7ef862107730b778ebc6edd5a8128b839b7d3e2cf3863029d272336e9

SHA512
c916d9f6613c6cb1d45c518a2690bacb316fa9df1de625c9f8b33cfa2d235c97a215756b7fb8e186589bf2905d85578ba2b7b3c4e47fb07aa05179b05bc33d28

Download Submit
/data/data/com.jppa.fugg.puiw/files/.imprint
Filesize
950B

MD5
0e25eb9fb895cb72d88af2e8232f2650

SHA1
00d78911f11a5c1d902b7075415ab6391c4185d3

SHA256
4ed47811f4bddc902f65cfd69f3414f67dfd582d29ce1767a219fb4ea4d37e34

SHA512
15c53453607f38471d1688b20058206e68dd569b7a6b223bc19790cb48b89d9d368518753e2f754e950da976815727bf290a2521e28e36f1a7f50fc2e53e286b

Download Submit
/data/data/com.jppa.fugg.puiw/files/.umeng/exchangeIdentity.json
Filesize
204B

MD5
5ec52d9e7a7e100d2dbf73530919c180

SHA1
942651d1a42d358b250f13df3dc67cfe7af4e0c4

SHA256
b0b30b80f342b0c5ef23c68668a188da9c53f5ff1c4fbe1b4f3926c196c4cca5

SHA512
f7b151b440a4d047ed7e8f52e8f9a225ef23899bccd0d354e0ab2812953ea8845c34dde4aa62a00b71683985023e73b75e6f21514087d963c4e6b18b4a7feb07

Download Submit
/data/data/com.jppa.fugg.puiw/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
e500bb8fb535bed33dc0d3fbd90c327f

SHA1
a08245613b78377656c97a30a520fc26e70cbf8c

SHA256
68704aa1bf03509f631ad0dbc5f95df05e90e25c2955aae0e97ffa635cfc0d42

SHA512
9a3592caec9808e7dfd99fa8d00fe49c7126177b103b2f8ab4f9accc8796cb8296d00bdbfb5a28a4dddd90867ec513fc916b193d2268612a0ba0b35fc7d2da43

Download Submit
/data/data/com.jppa.fugg.puiw/files/umeng_it.cache
Filesize
179B

MD5
b39056eb31062d54a11ebf3f8357909d

SHA1
d3515618e11d94d227e45f485d8b86061597b791

SHA256
ee483acc6cb9e2c45a7581129eceba6d6efea87e453baa21f5385e262b6c11b8

SHA512
d7fca1fb72e9ea7b5c2d4e3d0c0c79a2c711baabbd822ea3df6f5e39f74afa97e92e82ae8ef7f518a46adce24477a5fe6ecc93e2a97959409fdb70736ce662e0

Download Submit
/data/data/com.jppa.fugg.puiw/files/umeng_it.cache
Filesize
352B

MD5
0cddde21d721948b982d01e291e19070

SHA1
7e9e434ba2d22911f8bd79507ff01984de0da5e6

SHA256
6780d8e214106e967c9ee60c282aaf58d98e05ad3775e479545f7e2205243d90

SHA512
2c29e86986bdbf178433bf50a922abde371a6d16ff6198f9b174b06d4308d3fdcf34cd9f927dbb57b08ab665e0d3d43c07e325bedec0d6c7cc8105e428469f95

Download Submit
/data/user/0/com.jppa.fugg.puiw/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit