e714e8adda00db5053bd11f6fc33792137e05fdc851fd3401dc90a957e9a13a9

Analysis

max time kernel
179s
max time network
181s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
15-06-2024 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad6690376c647d1f00778276b8367398_JaffaCakes118.apk
Size

1.3MB
MD5

ad6690376c647d1f00778276b8367398
SHA1

0f9dfcb20180dcc3e49abdcec180538a3a4e6b53
SHA256

e714e8adda00db5053bd11f6fc33792137e05fdc851fd3401dc90a957e9a13a9
SHA512

441723eeda8b1ece903c40f73c201d92d7f56a1dcbc04d3b3026405a9b1063995f86ec28623c469cd0f977308e3f8a78de5be90f1c4161a00dd060b1685c0fc7
SSDEEP

24576:NchoL0otaYtXMheU8X3lUKfcfIkuovSp0cjTo+rEjDe9q/13tdHbZKm51Ob83r:NcaQ7YttX1wvTvSpfj/gjDe9q/1XHNKU

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.rffa.ymba.clil

pid process

4514 com.rffa.ymba.clil

pid	process
4514	com.rffa.ymba.clil

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.rffa.ymba.clilcom.rffa.ymba.clil:daemon

ioc	pid	process
/data/user/0/com.rffa.ymba.clil/app_mjf/dz.jar	4514	com.rffa.ymba.clil
/data/user/0/com.rffa.ymba.clil/app_mjf/dz.jar	4576	com.rffa.ymba.clil:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.rffa.ymba.clil

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.rffa.ymba.clil
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.rffa.ymba.clil

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.rffa.ymba.clil
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

Processes:

flow ioc

40 alog.umeng.com
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.rffa.ymba.clil

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.rffa.ymba.clil
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.rffa.ymba.clil

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.rffa.ymba.clil
Reads information about phone network operator. 1 TTPs
discovery

T1422
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.rffa.ymba.clil

description ioc process

File opened for read /proc/cpuinfo com.rffa.ymba.clil

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.rffa.ymba.clil

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.rffa.ymba.clil

flow	ioc
40	alog.umeng.com

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rffa.ymba.clil

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.rffa.ymba.clil

description	ioc	process
File opened for read	/proc/cpuinfo	com.rffa.ymba.clil

com.rffa.ymba.clil
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4514

com.rffa.ymba.clil:daemon
1⤵
- Loads dropped Dex/Jar
PID:4576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.rffa.ymba.clil/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/user/0/com.rffa.ymba.clil/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit
/data/user/0/com.rffa.ymba.clil/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/user/0/com.rffa.ymba.clil/databases/lezzd
Filesize
28KB

MD5
fdb8a92e5060ce104e8f0faca55a47ce

SHA1
270d7ca30673e18cec1d2b9add71cba96dc426fe

SHA256
194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a

SHA512
ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

Download Submit
/data/user/0/com.rffa.ymba.clil/databases/lezzd-journal
Filesize
8KB

MD5
f024c607d7dd20cdf0b996e3a94171a7

SHA1
f15395e06c812564e77aa93934631c91124b5109

SHA256
afa13fba22210d5812c304f6830a0d79483a6d5da5937752be6a4d97192f20f8

SHA512
96c15c07003935a8046dd854e465351c734735a4fec54759bd9c7590a0ce3d2f67534dc18c29d97d92a26833bb6ce046b2365e65cf2d47df3c2ed2113f6e3716

Download Submit
/data/user/0/com.rffa.ymba.clil/databases/lezzd-journal
Filesize
512B

MD5
d33c35e888b984ac6f66a883fb740bc8

SHA1
ce8ad0ba0a2c5a7b20fa952ad4f4d807c697f009

SHA256
b0d2400cbd8d48170e5f0e317d65e0db598252db9cc665050d3179e5f8c45dbb

SHA512
5579e03a93fa9cc78524869fe9841fc8cf6a28af3af2a8007fb6c98be5cb398c7aa6a607dd5d3a0ced3017d147544e6284377976251a997043bc782346c09bac

Download Submit
/data/user/0/com.rffa.ymba.clil/databases/lezzd-journal
Filesize
8KB

MD5
d4e85655f9754a12b23637e859fb4eb8

SHA1
6b4528be2f80597d8213fc1ebc057f46fa04d9d7

SHA256
615839a800186c71d4e9859f3b7c79d73530c96e2f3b603f303cd7737e2d837c

SHA512
d7f8f037f592abfa43363810f08d128abf4002a694804731bbf0665d606fd22088767540d3f594f8c1624c042716682601132e3b08f7e8468e47ed8bbacf14b3

Download Submit
/data/user/0/com.rffa.ymba.clil/databases/lezzd-journal
Filesize
4KB

MD5
129bf6b9944763209abb274b4be590d6

SHA1
7d97b50d50c2dac6c079e703f7f2750da9b03a32

SHA256
5755b24e7dc605a4a2360dc0261ade31a8b2e33f4f7cfe33812437c2e606123f

SHA512
17fe93c3ea23f5fc5d6fad5807616da07f3481583183e3d381a267da2af800d7986eb93e56f1493c66a48b01b81f9068d59eca470204c7f17fa2811da5f6622b

Download Submit
/data/user/0/com.rffa.ymba.clil/databases/lezzd-journal
Filesize
8KB

MD5
df4dd7e66c74bc8c40f1fea6d44765de

SHA1
93bf27c783aaf3021a80450b2569899c75479491

SHA256
f056765f2843d39a32688d18211e155e610c54b410fb44953402d656d44a6f1d

SHA512
1c3a4424c149a5d2dac2a21a02c37f31901d4113334911ee25fa112b46c9e6903a07426dfb9a5985c4bfb43ff2ba3d76b5f9cc45084a0b7101a1d743e4799a89

Download Submit
/data/user/0/com.rffa.ymba.clil/databases/lezzd-journal
Filesize
8KB

MD5
acd221b5f7b7c128d1b86fe50f09dda7

SHA1
308aa17a3f75a5bda1b71f90326e4c6d3f2db662

SHA256
025ef62a47816420e725ca51934a5b70a0a1d736cfd1c7f56c31dfaf0839b56a

SHA512
e2a609e2a6c094c5f8368bacf31f3b0b9913b3cf855528977a2e1762ec9d7188cbc254743d21f5c4ad6477d4283b6d1cabf20ff2c4499d756ed0319a96e2e7fa

Download Submit
/data/user/0/com.rffa.ymba.clil/files/.um/um_cache_1718437870750.env
Filesize
646B

MD5
155c9b2db5177e1b4411c84ed74e8833

SHA1
f0f5156a6b77518349ccde8b2d911ee139f8df09

SHA256
d2c0c94093ff112021b74658e63dd5228b3c5a354bde0d892cf48d0e23bb173d

SHA512
63c3606a5a0b605dad5b1cb1dce1f1aa86cafa5f7f29b5f778ad6560090fa5ddd726aac6c64ca5ae1774cface8a7695c2a76673e10a0d355aa9d9a989f422a56

Download Submit
/data/user/0/com.rffa.ymba.clil/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
aecb6e6da79fd9f8af272146582ff630

SHA1
f409aab7ee5dfa563ab68368f8baa10a8cf63aa7

SHA256
843ba5d2973ed65d0c5048f06bd36dce147d1e806788e1728636463c276cb61d

SHA512
e637c00eed7c9e195333131f7feb82ffd1a10be6c18fb8d59c91ad11b75a055f770939dccad3e5b152d04c852c55a383cb7af185a931a1a053a42ecc695dc07d

Download Submit
/data/user/0/com.rffa.ymba.clil/files/mobclick_agent_cached_com.rffa.ymba.clil1
Filesize
791B

MD5
0c93e11c2c95c90f3991ea0f19e10ffb

SHA1
89c5aec3e7c65f9a534af377f003426ae98892d0

SHA256
5146a6e36ab7136e40708b794c7174193ed7190921c66d4407bc8d81f2d5f67f

SHA512
8eb774c19c0f83ffa0b372b9c39681e781e86cb2fd696fe8c2044d8a291d8ac68af284d02c3b797072862a55647f64516c97409f2e2016f68a87c1830b0ad45f

Download Submit
/data/user/0/com.rffa.ymba.clil/files/umeng_it.cache
Filesize
348B

MD5
b27e58b46c607b731b7b5481d6aae23e

SHA1
ffc5f69b7447465adfe90f4e987c331e72e82e42

SHA256
031d0e884dceca265b550484b807d8ac2f2d658cad08744acb9db46688ac062b

SHA512
f05e0870aac37fa18223c46fcd248066c80ae79a66b99927e07f8fa1ba507c1c00b79ac208d24472b14b87aa8c325761d8fd4238d27347277d9718ef0ee13855

Download Submit