2b937dfac9d5c974a0678540e663d2289e0ad37b3af1bb2e235dcf8d7d1c1f03

Analysis

max time kernel
179s
max time network
186s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
15-06-2024 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad69d0a4f4da493a5da6445d9a0fe4f4_JaffaCakes118.apk
Size

637KB
MD5

ad69d0a4f4da493a5da6445d9a0fe4f4
SHA1

a89e5c759ceae141cacd443b65c99cd58af8d37e
SHA256

2b937dfac9d5c974a0678540e663d2289e0ad37b3af1bb2e235dcf8d7d1c1f03
SHA512

ceddffc3a8b59df4dd96613e17e487e69def6353793ecfa9044d7b329404f6774707f02ddeee3044fb5e330d07b220a0319405cb305c6d38af6bd914809b3eb4
SSDEEP

12288:064L4oQI8Y0FotaKIUtrbM5D954vqaHoCoxKI2AKYnIRIB0gXa46iSeFxqMHS946:LoL0otaYtXMPWHHMkI2on/B0gXa46izs

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.qhot.gbca.ojry

pid process

5119 com.qhot.gbca.ojry

pid	process
5119	com.qhot.gbca.ojry

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.qhot.gbca.ojrycom.qhot.gbca.ojry:daemon

ioc	pid	process
/data/user/0/com.qhot.gbca.ojry/app_mjf/dz.jar	5119	com.qhot.gbca.ojry
/data/user/0/com.qhot.gbca.ojry/app_mjf/dz.jar	5250	com.qhot.gbca.ojry:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.qhot.gbca.ojry

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.qhot.gbca.ojry
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.qhot.gbca.ojry

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.qhot.gbca.ojry
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

Processes:

flow ioc

6 alog.umeng.com
58 alog.umeng.com
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.qhot.gbca.ojry

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.qhot.gbca.ojry
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.qhot.gbca.ojry

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.qhot.gbca.ojry
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.qhot.gbca.ojry

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.qhot.gbca.ojry
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.qhot.gbca.ojry

description ioc process

File opened for read /proc/cpuinfo com.qhot.gbca.ojry

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.qhot.gbca.ojry

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qhot.gbca.ojry

flow	ioc
6	alog.umeng.com
58	alog.umeng.com

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qhot.gbca.ojry

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qhot.gbca.ojry

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.qhot.gbca.ojry

description	ioc	process
File opened for read	/proc/cpuinfo	com.qhot.gbca.ojry

com.qhot.gbca.ojry
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5119

com.qhot.gbca.ojry:daemon
1⤵
- Loads dropped Dex/Jar
PID:5250

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.qhot.gbca.ojry/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.qhot.gbca.ojry/app_mjf/oat/dz.jar.cur.prof
Filesize
736B

MD5
6811f510b9625709ba3979e4c62b34a2

SHA1
f2a6abe7338c21691d20164471e83e86c29b43e4

SHA256
64a85ab4ed877635edfccd1eb5eb3167c70f0dfd38679b708b1ecb65cb7ad0e3

SHA512
61b23105087d01aa4473d8212df39ff5ca8dbc7ac04026222f1777f013f5b65bd892ee1d61551abe2d2834566e7fb69266ef592d7d9dec44ec8b3dafa8588c33

Download Submit
/data/data/com.qhot.gbca.ojry/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.qhot.gbca.ojry/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.qhot.gbca.ojry/databases/lezzd-journal
Filesize
8KB

MD5
e99f33aa793836691f6902197fb432e1

SHA1
6fc41576db499335fda956cda6ba8812231c9f00

SHA256
55c96aed51907708278be87953fc012e27cf307cb95983dbdc5dbbbfd131e4e4

SHA512
e0575eb40701ff4b7cc186e089ece1430bfe596ed2e7150a92e07e792ddedfcf818d2f5abc84d3e7b71c1a6ed3c13e07e5ac4130a3334303cfb0340ea0e004fe

Download Submit
/data/data/com.qhot.gbca.ojry/databases/lezzd-journal
Filesize
8KB

MD5
09e6e164666358f73767466440e0defe

SHA1
c800dc6756ae3f4e054eba07d953d723d08d843f

SHA256
95bc41f54e8dac4bb2a853e1c8a942020cc15a45fdd0d1a800f5dd5d42358671

SHA512
f1a6f436692da1430c5692808be4b568d8ba05cba36b52d940e90e21e08ae4d9c097fcc1ac209136e781fe435ea2b85d92842d370dee93cf5c7bdd5b4a9ed9fa

Download Submit
/data/data/com.qhot.gbca.ojry/databases/lezzd-journal
Filesize
8KB

MD5
da8a4356d5435ef463dbbea50ca1b4f9

SHA1
392699e4b28e96f2ccba39f6570119e05454a3c3

SHA256
c6dd2e68f032fc0e9180b4ac578ee852fc331c85018a2689bcd8c8e61a410c25

SHA512
018602201c879cdb5242779e2606abc455441060bc93ac029d9f16242329133e8ca60027c1a5fe5cc2a65a5a33761cc31541e4efe02b46be5e9a3b7a714586fc

Download Submit
/data/data/com.qhot.gbca.ojry/databases/lezzd-journal
Filesize
512B

MD5
2b0ba371e7987d8d91c0a4723f4eb32c

SHA1
27f4be5414b40016ea1c76083f2caa44be5d54c3

SHA256
bc01a2a0a6065098242c842ad0b39128cc78b34443bc33581594b72814fd6133

SHA512
1ab73a0b431d7d4c228575f5c2ebdc82e3d1b466ab865d6aa896f97697aeb47eb1d10402f0bccd2c3a4b5813585033b0e7d76146dceae45fe7660dc8fbfc420d

Download Submit
/data/data/com.qhot.gbca.ojry/databases/lezzd-journal
Filesize
8KB

MD5
00c0ed6750353830929647cd60bd06ec

SHA1
4be0aa1dc65bda28c8d451a39bfae75f8f3965b0

SHA256
a9042d24c745c9e5cb2ab5dda75caf60c8f1bbd805c3ec56f65ec3ea23abadff

SHA512
99e815c16a7b8d95065279820735231f78c9a9882e6d35f6e2332398df5bc09921c0dfea1e7d7fcbcc296aceada3761ec6ecb3baecc34cde6d71aedbaf5196d2

Download Submit
/data/data/com.qhot.gbca.ojry/databases/lezzd-journal
Filesize
4KB

MD5
ae38c344fc0bb44a414dd3f1e68f8fe0

SHA1
fc933790722a7e498eb63d8ad23e84e5d0251bf5

SHA256
d1f6c9555bd115c926a23c40727ddfc15db0b554e24d7bb553a1d9c762617813

SHA512
ec8dd5e4b3ffe6bd3e5a6c68da11972241217ea57b957507cdbe3e0dc4fa131e3cd7512fa38f96f6b3e975e168c2ad48f19433ea8de7b0f31efa89b3d7afce69

Download Submit
/data/data/com.qhot.gbca.ojry/files/.um/um_cache_1718438178042.env
Filesize
657B

MD5
b87f581b69a18031605e13e6c1c9ff43

SHA1
e90f64d56c031015ed91c5df0f10ae0fa06778a4

SHA256
f6a7d1e0c1385ac4eee3316a6301582224b56841ee34f83f26f285b98da1cfa6

SHA512
d40b2b2d85bef30ac40803d9d29984d04a663421c5ffadf5299d38a3af311dbb92102ac8e2edc77c063a080747b6ad85b82824be09ca4001e423f6cc9fc0c7e4

Download Submit
/data/data/com.qhot.gbca.ojry/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
dcfb2ac7ffcc42aa5077d55c34120d51

SHA1
ed42224b15b8857714c70661a745a5cbe2c19058

SHA256
8f7e705d4d9f3ba6103e7fef6e8b851200ba61de1cf799c604c505d8c3661391

SHA512
9d14a4f0dc811081ae1693449494f2c324768e9926a03040761ebe6fef45aab7c5ad4e11c216c9064f795abd4208124bdd029c11d036b13f562638500d2e0a6b

Download Submit
/data/data/com.qhot.gbca.ojry/files/mobclick_agent_cached_com.qhot.gbca.ojry1
Filesize
806B

MD5
766fd4fa45b34074b23179515c82d469

SHA1
cc00f9993957bee8e5561ce3972a428ffbc83390

SHA256
0dc6e59cc06d20bf51fdddeb7784b916d4539a4556a497d4f1a3202aa3d9b8a9

SHA512
4d271a1a712dc35960a5e453f7ba8f0d2f0d720016438466d78e2d71b204355f5d79dc531b61080c04d4a13491f655e88e0abccb11e2817814d89473e7e8ded1

Download Submit
/data/data/com.qhot.gbca.ojry/files/umeng_it.cache
Filesize
352B

MD5
39f087be8b91e6127469d9b7412c65d4

SHA1
43fdd0c78cda9290664d7557489ec84c4def848a

SHA256
46f6faf2d564e2d80648ed0bbc0533cec47a4950d8d8836ab01c0337144eaf45

SHA512
db30566d432f1cf624e148db4b0e35d4b0ead8f1d7304d168c0ceb55b59208771a978dce5c9911b6dc31e82204143428b0d76cd32edce006abdeb786b0c67778

Download Submit
/data/user/0/com.qhot.gbca.ojry/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit