7f9662785c10c4d97f0c67c8f7361cb0b8d61865c40837b6abe6d447e352d10a

Analysis

max time kernel
178s
max time network
183s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
15/06/2024, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afcaa344d9409237786f2fc800b09733_JaffaCakes118.apk
Size 1.3MB
Sample240615-w63glavapq
SHA256 7f9662785c10c4d97f0c67c8f7361cb0b8d61865c40837b6abe6d447e352d10a
MD5 afcaa344d9409237786f2fc800b09733
SHA1 d9b7dc002e8abf30b014adce00cb95ce20a5595e
SHA512 3c7bae662969c3e1918737cb72bca90eedc445d001ff1d86fe476fb89cd2ea733f97c793b425272222d9722bf7e1e3f4715599033f4f4a2df25e1ef0cbfbe776
SSDEEP 24576:soL0otaYtXMLep2sepAvb6vsm0ZGpUvb2jno+Ocjql+q/13tdHbZKm51Ob83d:TQ7YthFeGv0sKUvb2jbXjql+q/1XHNKs
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5090	com.eexs.tnzw.vjcd

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.eexs.tnzw.vjcd/app_mjf/dz.jar	5090	com.eexs.tnzw.vjcd
/data/user/0/com.eexs.tnzw.vjcd/app_mjf/dz.jar	5271	com.eexs.tnzw.vjcd:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.eexs.tnzw.vjcd

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.eexs.tnzw.vjcd

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
41	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.eexs.tnzw.vjcd

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.eexs.tnzw.vjcd

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.eexs.tnzw.vjcd

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.eexs.tnzw.vjcd

com.eexs.tnzw.vjcd
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5090

com.eexs.tnzw.vjcd:daemon
1⤵
- Loads dropped Dex/Jar
PID:5271

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.eexs.tnzw.vjcd/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar.cur.prof

Path /data/data/com.eexs.tnzw.vjcd/app_mjf/oat/dz.jar.cur.prof
Size 524B
SHA256 60699d90ae79e5e51e080e48d80fe2b659b746d708a1f47d8dbd21ab30bcbca2
MD5 ad834ed210ff5f8191af408a1d5c9650
SHA1 c283217496d5e8f97888c820ceb0eb94c6dd91c1
SHA512 9e73b4ff5b957b839a1519e51341ec2b92009636522b65ecc464120b3abd12663d463a904689716be5792671a1def6a898e89c155166fd2c2fa57275910eeaf7
MD5 SHA1 SHA512

Submit Download

tdz.jar

Path /data/data/com.eexs.tnzw.vjcd/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.eexs.tnzw.vjcd/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.eexs.tnzw.vjcd/databases/lezzd-journal
Size 8KB
SHA256 160e7b6c978c49a202704a2ab43dab7433224e727ce5a6bac623cd6b46837073
MD5 ae6cb8c90f08b150de76398254d26a40
SHA1 16ba9932e7ff3166ae2acdb009687a6be2ce6bec
SHA512 570d75658ffa97e1c37b62a952c1d963fc82dd1d4b7ab548abcbae6a4e69bc17dbc5a4d25c7a6e19139f4bd701a70f45e91a5c02ad6806d756436f49ff7dd9dd
SSDEEP 12:7+twqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbI5Y:7+twqLGqteszXtUku+haaL6nwyLGSI6
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.eexs.tnzw.vjcd/databases/lezzd-journal
Size 512B
SHA256 b453d75b542f50862ca45ce814cd7231182ea18e15c69837b97bf1ba2caff85a
MD5 f3b5e1d840a413fec0f91e9203e52b05
SHA1 888295acb0e447ec9ab1034ef2a1ea8029ce9bc4
SHA512 65eb9ba0b30af43bccd78671ef81912199c2e24927dce2654f8ab867197e82818a61b6a531ee791b4bb36bb80dcd126689eeb5e8adea5d3ac66b0914bdd68239
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.eexs.tnzw.vjcd/databases/lezzd-journal
Size 8KB
SHA256 b53f9023f9835fd1a5cb50c100a12fbf62dfbe9222ff999577cecf3bc87eef37
MD5 e3c58d8c8761bb336d4cb1dc4e08cbc6
SHA1 a9790219c3bdf1cf2742a3b8aa1cedd608731693
SHA512 1b6f2759eba6636c3f5c65b6f55cbc1f9e856d364737c6ae4e723df1268e857d801f211c56f94c6d3e363e9fa08c84e7816e76e9a24ef1dbf46c447b49e82379
SSDEEP 6:7+/l9/n4n1vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKkFn:7+tdeqLiuWdwRmBEyPbjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.eexs.tnzw.vjcd/databases/lezzd-journal
Size 4KB
SHA256 98e6f4f3155aa2297a37f0dd12148e8772d7a8219a554bc0ee4037f634549586
MD5 66556dbd61d404f1da0e74b2bde0e0e9
SHA1 113c9581c0ab7e2fa862b864fa54c27f8d36eca9
SHA512 5d66433b51efb32f3b3ee214dcc21d45049f9ff61c17ad11f2a8ae4b3b9d429e5261d9cfb0d5c437c96da369b943edb77d9da3f0ea6ad29e7f318daf40e51db4
SSDEEP 6:7+/lMHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKr:7+tMvqLJdTRmBEyPbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.eexs.tnzw.vjcd/databases/lezzd-journal
Size 8KB
SHA256 1d600d8b552e0f2b99a8f1385bfa931dca7fd7da1b2114baedbdc625aa53f922
MD5 2e50dd35723de13bdaec75d1da5ce6ef
SHA1 daf9201f951ec2e5361568dec41ebb7cdebbb8b1
SHA512 ee7c1821d1957b0f8d4014fc20d9e18761ae84c1a5c0ff7981a85dd684147a5fa82e24e43fcd7075f0cf12ec2069021c2c8d61b12fcbc6f003b7c8122276c11c
SSDEEP 6:7+/l9lllgPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKOs//v:7+tRl4qLmqCRmBEyPbbsXv
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.eexs.tnzw.vjcd/databases/lezzd-journal
Size 8KB
SHA256 7f154e5c63a82ba018009aefa2df518707268358f7ecc37d5f86ca4b42946cac
MD5 0a2d2531071b707869968ace5222dc41
SHA1 27240fd300651cbe2ad3a7f7221a5547cc1c406b
SHA512 8bb061c3580f686640129b65b070e090c0b213890daf3fbbb9e647a84406229af1b1fdf65e10090b6465e3626dd7af81fce9912f44e93e8b7504b6ecea8bc198
SSDEEP 12:7+t4nqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPb6B:7+twqLy9yUku+haaL6nwyLGSw
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1718476733201.env

Path /data/data/com.eexs.tnzw.vjcd/files/.um/um_cache_1718476733201.env
Size 658B
SHA256 7821697093f545ac3db7f374f9792b616512ed0394bbf74e3c379c68b36bdb50
MD5 e47f731ab7dda1279590bafb2cc32fa8
SHA1 77513b8f897ed99e289dedae36c465c139770396
SHA512 01db51801f58a84f217d5486a88815e0b363325d6a438efb0c7d2c654c060b40ccc2e0af299fdce28b337b08c339e70124bd9dfa8a71d2d3758cf4808ec201d1
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.eexs.tnzw.vjcd/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 96b38d4b19222d9a46e82dab29e4649b7e17ee509a4a5663bdbb4f8d846f1762
MD5 5b5c2fb62955ba66ca20130fdf170167
SHA1 68230145dbce054fde82898b6623045b564c8ea7
SHA512 e11aa61b2d4332cae56f563d64f759a43c07008bdc1def6c176fc883840066eb128dfd7b2dbc0c699b7db70b81fec93debf170367f6c4b6d1ab096a8a0d5c6dd
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.eexs.tnzw.vjcd1

Path /data/data/com.eexs.tnzw.vjcd/files/mobclick_agent_cached_com.eexs.tnzw.vjcd1
Size 797B
SHA256 effc45092540ea66756e0567a6f027bbccaccbf924a74c5fe78a63f087abd1a0
MD5 a1247868fcaed2d7d9456b27bcc4acd9
SHA1 ede6d00a40dfc00e8b3536d7951ce43a8dda0223
SHA512 c59fb86cbe0ab6aaa43778a68b63d0f029be46d36ca1d29150b8f6a451e0926a08fc43b6402f8749aefcd15f1dff8044b5ece59fdb46c2c7cebb92548e393507
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.eexs.tnzw.vjcd/files/umeng_it.cache
Size 352B
SHA256 c986e63c5032a4241667fb2876a43ab80ae3efebaac531faf1a8981c3c8fef9d
MD5 50f474265de70e429bfd08855e072e0a
SHA1 359ddebf6d1a139708fd8af0964cda741a3ff165
SHA512 c442c3497b5101ffa420d7a5accb584cd9e061eafbd40ab3a5cab6615cdfcd3f75ada8446ba7068ee5b5e807ec0cf2544f8ca6cc9e8bdbc76adc6c23b25f5353
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.eexs.tnzw.vjcd/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads