Overview

overview

8

Static

static

6

b02433d25a...18.apk

android-9-x86

8

b02433d25a...18.apk

android-10-x64

8

b02433d25a...18.apk

android-11-x64

8

Analysis

  • max time kernel
    177s
  • max time network
    178s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    15-06-2024 21:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b02433d25ac373707f77171e7f015c78_JaffaCakes118.apk

  • Size

    1.3MB

  • MD5

    b02433d25ac373707f77171e7f015c78

  • SHA1

    02a7b4e4383973548a40aaac13db3f4dd7857293

  • SHA256

    aa036050d87a15c0f8f26ad006e4bccd5a12c26ac982498290777b5ba4a5e6ef

  • SHA512

    108e489e3c10f6728bd864679793129a8f225aabd8ef09b17c9cc430641577a23f26900a49716c41c1d408a552d05157228ca3532de63807afc9ab8096c35899

  • SSDEEP

    24576:LPoL0otaYtXMLeu2sepAvb6vsm0ZGpUvb1jDo+3cj/y5q/13tdHbZKm51Ob83a:cQ7YtGFeGv0sKUvb1jPsj/y5q/1XHNKz

Score
8/10
bankercollectiondiscoveryevasionpersistencestealthtrojan

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.uykh.cmfy.orwq
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    PID:4321
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.uykh.cmfy.orwq/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.uykh.cmfy.orwq/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4353
  • com.uykh.cmfy.orwq:daemon
    1⤵
    • Loads dropped Dex/Jar
    PID:4391

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.uykh.cmfy.orwq/app_mjf/ddz.jar
    Filesize

    105KB

    MD5

    23ba0b249042b7ba33e92c0199b0ea4a

    SHA1

    99b13ee9f7307316c2337953fceed87e9942b794

    SHA256

    1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

    SHA512

    0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

    Download Submit
  • /data/data/com.uykh.cmfy.orwq/app_mjf/oat/dz.jar.cur.prof
    Filesize

    530B

    MD5

    cdf150fd20075a308e49536a35db1a2d

    SHA1

    822c784da7b75d89c49fb60719a96158aa0f4d21

    SHA256

    e04a6917ca40149e48d32e16e30c428906e8e57ad42304d054a545bfba868801

    SHA512

    fa6f08444384cf1fc6c229b6db07196fa29da0c9ebc615707616ae5c254febfdfca89a590a4d9f668518559682a7db28ae470c2230f987f6e009161dafdc27df

    Download Submit
  • /data/data/com.uykh.cmfy.orwq/app_mjf/tdz.jar
    Filesize

    105KB

    MD5

    293ea5f01e27975bed5179ba79d80eac

    SHA1

    c5b0806a537fd1cb753e11f1a9684933317716b8

    SHA256

    8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

    SHA512

    c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

    Download Submit
  • /data/data/com.uykh.cmfy.orwq/databases/lezzd
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit
  • /data/data/com.uykh.cmfy.orwq/databases/lezzd-journal
    Filesize

    512B

    MD5

    1e606782a4ee1e0332050ac7b485df71

    SHA1

    092936d47e23a2c4da2aec6dfe2485c03ed830a2

    SHA256

    fca6dea7b487aa4ea10961c2db659c06d871c4592e939600275b75bea61f77a0

    SHA512

    f589759253cc34cb0cf72bf05635c2a494a93e239d2d66056618cf0c408927501a84ba4c3cc9eb71c4e3b2f8bf6c9027e504ee4f5e99c6d9435fcca8af7da24f

    Download Submit
  • /data/data/com.uykh.cmfy.orwq/databases/lezzd-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit
  • /data/data/com.uykh.cmfy.orwq/databases/lezzd-wal
    Filesize

    60KB

    MD5

    90d4cf7334257bcd5b527c04ffde5733

    SHA1

    32a315ce76ec1d1966a8d3046133383108a8db74

    SHA256

    bbfde46abf569eccf1f4ca75fde86b5111d79aa4ea4f6775d53780b66e96c847

    SHA512

    102874f329c75666cd9938b2b0d0a2d456a973019148704a20e5c5fdc2eee36641252e4250a091e7bbed46e4953c9e34cf9c7418ae29f54482dc1d2020fdc083

    Download Submit
  • /data/data/com.uykh.cmfy.orwq/files/.um/um_cache_1718486561771.env
    Filesize

    679B

    MD5

    e6eee8ecbdcdd6917f9dff97ddfe6d51

    SHA1

    3a42d7ea098f870bc5f50802405ae0f7a2887546

    SHA256

    0c8d5371fb8f90c06ca58089aeb6f2e0d4c96a5d4b794600f53f65c596ebba22

    SHA512

    85f8e34ef818b6c87e8d8fe48d0a1264e4b6ca4fc484f697a70886bf3d6d35f9ae91892c57fff3a3610819cce0db9db12610b43e12c0dcf79c3c85598bf80eb2

    Download Submit
  • /data/data/com.uykh.cmfy.orwq/files/.umeng/exchangeIdentity.json
    Filesize

    162B

    MD5

    df05e31f9a89790e6a78f1be1598c779

    SHA1

    46d907c2ec07de74b8dddad948224ed5cf5047ba

    SHA256

    256dc5ca4d57fd77014a4cbac0d018f5c43e8fd61e2921508ce34c67582b303f

    SHA512

    c74d42492e487542263edcd15ac6867580cb2b90fde067d007a73623f57a48648ca94129277ed2f2c907b5be2913232f33d78eb0c99e56a6ec4e5c3d3b42114c

    Download Submit
  • /data/data/com.uykh.cmfy.orwq/files/mobclick_agent_cached_com.uykh.cmfy.orwq1
    Filesize

    858B

    MD5

    2de0e3622115ca50fed252f74378e6ad

    SHA1

    7a6972d3047129f21ff06165fbacd7e8bd2408fe

    SHA256

    9c764c35b4025967402d7029ab2b4fc822b08ade41784e80229f7ebdc68b7681

    SHA512

    2f89026410696f62302a616bca6c206e8c49adab4b0db653d465a8f09b175010e580a0697069651e8d23097d96f5926c683c4d2c53b7c2ca9c72249771c96325

    Download Submit
  • /data/data/com.uykh.cmfy.orwq/files/umeng_it.cache
    Filesize

    415B

    MD5

    1ec679934869878b3b740b5b38459fe7

    SHA1

    4db177737cbd63e0924c54c0fee1898cf4203995

    SHA256

    2439c1470e1e887bdf718389dacfbf6a3d4666a14aff5cfb4ef1d031b17251b5

    SHA512

    5e891101556027c09918f237ea13a3df523cf9255bbdb5cd1ac18b6730f7748b51c1afaf32a8936dedefebc4c65228b7d528404409f2d55cbd8e9db189e0d058

    Download Submit
  • /data/user/0/com.uykh.cmfy.orwq/app_mjf/dz.jar
    Filesize

    248KB

    MD5

    9b47e78a6ff90cce5755ce4742047627

    SHA1

    831b24aa9e116eb8d7065efd430088d419dfd6c7

    SHA256

    30d7699b73fd7f276945415c405c12bff69c5958d12f56265a768443f6fd8cae

    SHA512

    4587a5b26f13cbd0524eade71ed29203fc55029fe150fce850016aa7d9c578623cdc4b6a551bed3dec9e31a39563f8927cfcc9d21e2d83c2c781808b958446fc

    Download Submit
  • /data/user/0/com.uykh.cmfy.orwq/app_mjf/dz.jar
    Filesize

    248KB

    MD5

    a54a18b58c6720991c021f433dfb2a46

    SHA1

    d2ffa07919f92b6e04914e39843f08fdb2a75b68

    SHA256

    3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

    SHA512

    e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

    Download Submit