aa036050d87a15c0f8f26ad006e4bccd5a12c26ac982498290777b5ba4a5e6ef

Analysis

max time kernel
179s
max time network
183s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
15-06-2024 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b02433d25ac373707f77171e7f015c78_JaffaCakes118.apk
Size

1.3MB
MD5

b02433d25ac373707f77171e7f015c78
SHA1

02a7b4e4383973548a40aaac13db3f4dd7857293
SHA256

aa036050d87a15c0f8f26ad006e4bccd5a12c26ac982498290777b5ba4a5e6ef
SHA512

108e489e3c10f6728bd864679793129a8f225aabd8ef09b17c9cc430641577a23f26900a49716c41c1d408a552d05157228ca3532de63807afc9ab8096c35899
SSDEEP

24576:LPoL0otaYtXMLeu2sepAvb6vsm0ZGpUvb1jDo+3cj/y5q/13tdHbZKm51Ob83a:cQ7YtGFeGv0sKUvb1jPsj/y5q/1XHNKz

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.uykh.cmfy.orwq

pid process

5030 com.uykh.cmfy.orwq

pid	process
5030	com.uykh.cmfy.orwq

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.uykh.cmfy.orwqcom.uykh.cmfy.orwq:daemon

ioc	pid	process
/data/user/0/com.uykh.cmfy.orwq/app_mjf/dz.jar	5030	com.uykh.cmfy.orwq
/data/user/0/com.uykh.cmfy.orwq/app_mjf/dz.jar	5109	com.uykh.cmfy.orwq:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.uykh.cmfy.orwq

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.uykh.cmfy.orwq
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.uykh.cmfy.orwq

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.uykh.cmfy.orwq
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

Processes:

flow ioc

40 alog.umeng.com
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.uykh.cmfy.orwq

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.uykh.cmfy.orwq
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.uykh.cmfy.orwq

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.uykh.cmfy.orwq
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.uykh.cmfy.orwq

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.uykh.cmfy.orwq
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.uykh.cmfy.orwq

description ioc process

File opened for read /proc/cpuinfo com.uykh.cmfy.orwq

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.uykh.cmfy.orwq

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.uykh.cmfy.orwq

flow	ioc
40	alog.umeng.com

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.uykh.cmfy.orwq

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.uykh.cmfy.orwq

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.uykh.cmfy.orwq

description	ioc	process
File opened for read	/proc/cpuinfo	com.uykh.cmfy.orwq

com.uykh.cmfy.orwq
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5030

com.uykh.cmfy.orwq:daemon
1⤵
- Loads dropped Dex/Jar
PID:5109

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.uykh.cmfy.orwq/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.uykh.cmfy.orwq/app_mjf/oat/dz.jar.cur.prof
Filesize
728B

MD5
a87dc1222e6546c25bd22b812f178fe6

SHA1
a7ff038b70956810393286e7548b0520db8b0fec

SHA256
6c57fb585b9619a0b77b41356f48ffe452d24bc8824eb273facb7952e208997f

SHA512
4fd4fc5fb5cad953ac9e1240526c3ad3f864d197b08bf98713b70992ba1d5def64aa3d104786fd16828cb5e064cd931893c11189b4f8d82bc701d01a62bb4d1d

Download Submit
/data/data/com.uykh.cmfy.orwq/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.uykh.cmfy.orwq/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.uykh.cmfy.orwq/databases/lezzd-journal
Filesize
8KB

MD5
8eeb148337b9c8ce474a5df03c11dbb8

SHA1
69a4648afe68bc273f671d51c2fcb05ee45973ab

SHA256
b80664f53437e8f23467aacd30a5992deee3b195239bf0828c43653429749733

SHA512
3d4de872e601c8200271f474b0e3c3ccde7a998fc6ffdde4dd3854ec13c9b0fdfbe5beaf0dcbe66da28662482bbe43d216eb18ac9bd53dff9a554970b065ae43

Download Submit
/data/data/com.uykh.cmfy.orwq/databases/lezzd-journal
Filesize
512B

MD5
cbd4892a7906ad60a8fd87e9a4ab3f03

SHA1
dfc692741d6623a13528f9cf80ce30bebe8f8abd

SHA256
78ac1b2f5de5d8d86826453bf90b97d266fa2d5f87f8d5b2fd2f7d0dcf5c951e

SHA512
229fb2f170d1f4bbe3529e6124ebd75e806a0f52c77c95dbb983ea55c2ee0346b75a05f31df400ba2ee7e34f8aad63be2f28056bf3ad16dd11ac7f3ea7f5f494

Download Submit
/data/data/com.uykh.cmfy.orwq/databases/lezzd-journal
Filesize
8KB

MD5
3e16fb1b5305b87b2b27acf8361159b7

SHA1
d60436290f3c6c031611b1f32c0ecf453ead7c04

SHA256
7aba82a88dd55298c697e8d05139b2bfe711d4d2c26c98b7d99fc2444a9f2d40

SHA512
160ac37ba51544544ad085385d997d57cfb29c6810dcd2c65594226b5075e6199e309966f1f85f1fb2d256582a01809a9ab3505112adce538661649df64a5366

Download Submit
/data/data/com.uykh.cmfy.orwq/databases/lezzd-journal
Filesize
4KB

MD5
5d1a5785f9a493114b0034988bb71cfd

SHA1
5b4a71c4adb7c02dbf0a664d447f33f58445760b

SHA256
87250c4fb6e55cf90cb09ddc7ddaca09fe90ba9e9b43bf10f19b0895eac5fbd1

SHA512
d0025fc311adc2221b76dd3bdc1265a3a56fe3f63ecb9cc65d04b0ff6534faa42bda79fe4886a632209593b8ee77ad5d24e0a658ed3f605e4c885340438cdd75

Download Submit
/data/data/com.uykh.cmfy.orwq/databases/lezzd-journal
Filesize
8KB

MD5
edd96642f3764ebb8e2dd742245d6c12

SHA1
184e21165ed5ebaf3e58dddab14ddccaf3efe57c

SHA256
51b3f8c225c47f25b19a389c860ede04fa798278d1279334d34c65eaa630588e

SHA512
02e4975a7e9588129d8585289c7ac01eb8cceda6da954a3947a4083c5b2227ed9b1964100edb563694d83616f5b3fc5871e060d35ef1372b1b2030355f4421cf

Download Submit
/data/data/com.uykh.cmfy.orwq/databases/lezzd-journal
Filesize
8KB

MD5
9160767c0fd4b91837c250d0c2670ff6

SHA1
925b970606bedece9eaab4ddfe151b015063b1b2

SHA256
12a52a61a44ef3bf76a0c159df0a914def78c652005da43d97ae5541f97fcc6f

SHA512
4ed30c6ee0e476e06f7fbe2c60d7a3c57b6fedb1ec8dfea6814a7baee49d04d0ba11901c8f601cf9ffeb10fdc4f9af397cf25f566abb6cf885611b20cf3b2d2b

Download Submit
/data/data/com.uykh.cmfy.orwq/files/.imprint
Filesize
943B

MD5
72e2271b4c2c38b6eba37d6565d11e6c

SHA1
9d3addbb01c3de33684594b4ae41bc99841dc2ab

SHA256
6027314774747915e768f24757455455e7ca2e9223e09dc91f27ff32472c4a82

SHA512
f6d5e4fdc31d176c0721aa972d51b964fd6cc0206c30a999d89d205fafa7dd6e64879b4cc33b365718d3f7557dca2bd3c3601e7f60f9685b5e95f8b7c3811af4

Download Submit
/data/data/com.uykh.cmfy.orwq/files/.um/um_cache_1718486621913.env
Filesize
1KB

MD5
a40edb7c3367495845b67b715dc2e683

SHA1
c7dd1077538e5c8fec53871b906ab187175ce213

SHA256
147da785d441a386b205d548c6c26a4a8b9da3a2169d152bf12f860a6cb2bb0a

SHA512
2995edc0a9e638f22e6b680d3ab3c722553e3bba9a6294bc5cfa74e972b34e4b1e6f2eece868a0c4e1c9a4ff6ee9fa1da8295391a6458a23e4b7e3fe0b4e51db

Download Submit
/data/data/com.uykh.cmfy.orwq/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
526925964a8929d3bc0c51de28c2e633

SHA1
4346681d6a1b0dbf59f7ac5525f9594a19ac7356

SHA256
1cfc2a2acfaa139f91432331dfffead534e4797bc302c7b0eeba27e28c215dfb

SHA512
c17cc4188e8b667a81d1c6d666251ddfa728cfcc6c639e53e7fe0511c16cbd4127c5f424ee2a5d03c3442f02d9c409c6291800b3db2d7bf61b4ab734be74c974

Download Submit
/data/data/com.uykh.cmfy.orwq/files/.umeng/exchangeIdentity.json
Filesize
202B

MD5
1d7012e895ab00b4adc4e8fabca20417

SHA1
c525ba1acc2bafa0a29bd38abe69b1b35f92e3ba

SHA256
c4baa8c8585472a57cdf656757c14e11a7ce39707815073fec4c2e3aca111b15

SHA512
37bde579dcce905a3587c9ab26a6450889175fc3cff79cddf5e6dc3b45b65dc4fc5cbc82a520ec6cdcfefa12dfa65fa27d95271513f71e4542a17506a60d163e

Download Submit
/data/data/com.uykh.cmfy.orwq/files/umeng_it.cache
Filesize
348B

MD5
e9925a3ae55820139e7bf126b829ded7

SHA1
e5902b2ef20ef6370a3f71b0f8783abf39a89576

SHA256
8b36e604379e6c08aba7be6a77bd922cd0104425c20a09f844ec4788d69fb44f

SHA512
d9302dd757fb709bbdbadf62a7a360ab84c538df2f620e9d64f4ff59ff8b7d36707dc3eb381e46da0a5d6630d26b9ce8084ff1fa64063f2424956f08471dc08f

Download Submit
/data/data/com.uykh.cmfy.orwq/files/umeng_it.cache
Filesize
177B

MD5
8c148803697c7d2784040508a0847fbb

SHA1
8c377577564a5fb3f5cb0536fb3e22157916c4a8

SHA256
346353038f6ea68a94ff233a5d45a52d2d7910657ca0386b6963df2d036f87f4

SHA512
d281c8fd8f84219643eb6ee11ac6c967e42c639a169e6b0257099596971b27224b24f9337d593c2c81f640b84241318ab7d073f3c667ba6ad56355a9771878bb

Download Submit
/data/user/0/com.uykh.cmfy.orwq/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit