9cc6b5f14b4532c202b285716de4e7695e4dce425eca5097506e7219a32b0d60

Analysis

max time kernel
178s
max time network
185s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
16-06-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b56dc1280d0b1e17cea95f74fc79b9bb_JaffaCakes118.apk
Size

637KB
MD5

b56dc1280d0b1e17cea95f74fc79b9bb
SHA1

ddd0627c1f973b1b25e2fa1aea47277d142a7f52
SHA256

9cc6b5f14b4532c202b285716de4e7695e4dce425eca5097506e7219a32b0d60
SHA512

8a746020597e8c60d48fe4b649da94c87de6696dcf614f5ea43528454742a700c4338bd78dc68d593515c51501d596a9a84b75f49e89f4cbb6953610b49ace0b
SSDEEP

12288:y4L4oQI8Y0FotaKIUtrbMH1y/gfOdFskKkEeFxHMQF94vvQe6ERylTY0:IoL0otaYtXMV5OgktRMMiydN

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.fmfd.gqbb.kvld

pid process

5027 com.fmfd.gqbb.kvld

pid	process
5027	com.fmfd.gqbb.kvld

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.fmfd.gqbb.kvldcom.fmfd.gqbb.kvld:daemon

ioc	pid	process
/data/user/0/com.fmfd.gqbb.kvld/app_mjf/dz.jar	5027	com.fmfd.gqbb.kvld
/data/user/0/com.fmfd.gqbb.kvld/app_mjf/dz.jar	5137	com.fmfd.gqbb.kvld:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.fmfd.gqbb.kvld

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.fmfd.gqbb.kvld
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.fmfd.gqbb.kvld

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.fmfd.gqbb.kvld
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

Processes:

flow ioc

9 alog.umeng.com
47 alog.umeng.com
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.fmfd.gqbb.kvld

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.fmfd.gqbb.kvld
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.fmfd.gqbb.kvld

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.fmfd.gqbb.kvld
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.fmfd.gqbb.kvld

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.fmfd.gqbb.kvld
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.fmfd.gqbb.kvld

description ioc process

File opened for read /proc/cpuinfo com.fmfd.gqbb.kvld

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.fmfd.gqbb.kvld

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.fmfd.gqbb.kvld

flow	ioc
9	alog.umeng.com
47	alog.umeng.com

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.fmfd.gqbb.kvld

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.fmfd.gqbb.kvld

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.fmfd.gqbb.kvld

description	ioc	process
File opened for read	/proc/cpuinfo	com.fmfd.gqbb.kvld

com.fmfd.gqbb.kvld
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5027

com.fmfd.gqbb.kvld:daemon
1⤵
- Loads dropped Dex/Jar
PID:5137

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.fmfd.gqbb.kvld/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.fmfd.gqbb.kvld/app_mjf/oat/dz.jar.cur.prof
Filesize
611B

MD5
c78b0059c974ac8dcaf1ac03ab48bcb6

SHA1
7928897f2ad2e3ef144b8e1ed091b2a19433b248

SHA256
ff26e2d5abfba5b10b448474516838954fed479b27ab307525116f67d84c546f

SHA512
f8fa44f8879209c577767cb61bd030abd3d1a22bcbbe54307e09e82177e765d2f7ccf2ac78831508119c9d7cc8f507294b3fa18a07bcb2e635c32dab38f8261c

Download Submit
/data/data/com.fmfd.gqbb.kvld/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.fmfd.gqbb.kvld/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Filesize
8KB

MD5
a625303950b4db47ec19a3758a77ee02

SHA1
3333f76b8c26968ce580bcb5c102f6d5eb0f72e6

SHA256
4e7a9e6233eab097fe2eab91a90e4e8e511bd4d84ab151ef87795a05f35145b1

SHA512
10af405986f9f5ae613460fdcf5031ebf6dc98873efb2ab1d9556c0e4c3efa767a780525a09cbf887eb1d5e680b5eb19ded1dd2687bcb8345ec0e10af5553b6d

Download Submit
/data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Filesize
8KB

MD5
e6dd6c14a56024c12cc59880fd38a02e

SHA1
5e86380da29b876f745247b18309d7fd8ebac77b

SHA256
294ed88545089ce597ce05bd5a591808825ea3fe7194af333952682f3cc35a7d

SHA512
959b7999ce640e86ed56372534c86420251c6964aa8489d506b2cceb40e35d0128eb0dd1bc7917aa0a380626def2ec2c00a542413f665e3e118a812c346dffa6

Download Submit
/data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Filesize
8KB

MD5
48c55fa71805d7e1bbd532ee3057bbf8

SHA1
d6d84b3664c37953177bad5503847d064b58e0b4

SHA256
29bc917f9aeaa092f6a2ed889a2953dcd7f4348bbea1962b61a50c89205646f1

SHA512
be2f906732c8d32c3120eff070b44ffe11f04156837e92e23ffb2304ac58095a7005543f46166a9aba9ee8073706eaf9b276e6dfc625490a81714d314b722376

Download Submit
/data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Filesize
512B

MD5
da521c7da287e8fd9049e1925a51a006

SHA1
2715730d07c6dbcd494156bf8180b56027ee8551

SHA256
905026c08c09b64a24c98a3129e289de475ff47ce77d069e101a05ce61c99170

SHA512
d7ed87a6dfc058b09879a5013e8975616aa2804ceeec457f53b1bdb5cb94d1bd358b9f4f23d8c01da2e41e762bc7efcd431f4c93862555b94babb351a1fa2121

Download Submit
/data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Filesize
8KB

MD5
9b3d93c94c2b3ce399803e668c184885

SHA1
718a2cf8f851747582ceb63bf51e66cc2c30496d

SHA256
0f0e138e1ede8f362f511efed610caedf3ea37ec0139988b8c25b621dc7f5a3a

SHA512
8a332ff923daf7b91569390fa7a634aabe09fdc3c59124d00494f26d34a9fc28785dfbf3104ac21e596d8fde44dd8f9bd18dd1e3aecf809f40f5034bc37e006d

Download Submit
/data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Filesize
4KB

MD5
18d8819673bb29aff3f0ad114398b600

SHA1
af8030a29bfcd4e2c7df6fda8da3e7b7fcf85c76

SHA256
a83bc363e38e96ddb22ae63ed3af944cb76552c2539644477ff5ea65045112f5

SHA512
e924367216c51704b951bba4d3ddc76cdc9f7f543c921427fe7edbdf8594d41b3a4fc142344ad51fb10db34e3006f42bc452b0409c29e0e899540975c6514790

Download Submit
/data/data/com.fmfd.gqbb.kvld/files/.imprint
Filesize
949B

MD5
9e8dfbd4883dbde2b4c01b27b22b1481

SHA1
e1aa0207a527d4d5587ecd1c498e07ca6d47fdff

SHA256
e6b5d2685ffa062cfb0a8793794bf28c617daa150b06c6bf9d9908d3ce03c61e

SHA512
a48acf757acefc4ccd9e6e4188eeb746318313b04321297a76eb4cfe66b0fce9e5e77a8c5b9705c93247ab335ffa79469018e4416e7d367ec047dd3342c0dbe5

Download Submit
/data/data/com.fmfd.gqbb.kvld/files/.um/um_cache_1718575887816.env
Filesize
651B

MD5
f45d875251821acf5249662b68653c8e

SHA1
37402b4a5b965c7a3c61640014046677a448679d

SHA256
ca52402e6d29f927c19ae898240585bec8c02c43894c2e55868953467c7b1a2f

SHA512
fbdcd2f1818e256a20708c2155f91f794984ece6aaafe4ccea817eade52889343e96dc665540040b188fa5cc70ed130ab94d6f9ea67e827596f6ad342d07c2c1

Download Submit
/data/data/com.fmfd.gqbb.kvld/files/.um/um_cache_1718575996567.env
Filesize
1KB

MD5
27058f9d4de907c12dfe3c04bbc3babe

SHA1
a314277d0ad3bdad7a912dedc4b9b022549090d4

SHA256
2ea6117c36999868f5d5d1b886276bbcf334438ba566b7964fe1fedc258278b3

SHA512
49cb432b13af18ec457e04a7c23a48493151584ca041c17758eecb95670931a27f9e4a2cb51479949c6e68ea29aa605c091b79c61a04e6342fa3c2aee0e7781f

Download Submit
/data/data/com.fmfd.gqbb.kvld/files/.umeng/exchangeIdentity.json
Filesize
202B

MD5
a0a373370072aec2b6ef1814369ff16f

SHA1
f2ba874c4f3bfbabdc1f30513b2e64f782116b8d

SHA256
facfa1fad73376b42f2f1e6b63ff1cc73ce819486099baaef07a3b3f46d9799d

SHA512
164fb50adf15850160e85a967e2062da919b916234b39efd6a5c0853d16b08667676d2a57dee377128ba4e1e5d24d29e45edb8fbfcd42bf4931c741d00d06df5

Download Submit
/data/data/com.fmfd.gqbb.kvld/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
8131e18118e82e826df3839c0335840d

SHA1
2bd529d18086cca4a0f26c6501da0d9e98deb8a2

SHA256
280dfd315dce2e44856b05794a96827917f64e4bcdd1dc859aba7f1fc0974513

SHA512
da745039b253c4495cab52104050764816e6e8345a9c4e2ff5485484547e00121b1628a80f86f877606e1539b657521ef53bb2365b158d63708e61aef038c7aa

Download Submit
/data/data/com.fmfd.gqbb.kvld/files/mobclick_agent_cached_com.fmfd.gqbb.kvld1
Filesize
1KB

MD5
e76d745f38600d9b9e1abd2105717641

SHA1
8c7922a8e29b5cae3baaf147c476c8a46cdfa55e

SHA256
5f166c55bd390df18da1fd49846978f70938857022552a936122b65da5431eae

SHA512
05688def43b2ab773a5c585f207d3bd07bbde35c1224dca580b01c6ae6eb852605ea12f63427e69366c9ce1111a9b8007d6215dcc2c536d040356527e22efffb

Download Submit
/data/data/com.fmfd.gqbb.kvld/files/umeng_it.cache
Filesize
348B

MD5
adfb33fdbda2cd5ea2e468143b8c830f

SHA1
809eab01cc9d9571a5b88fd95058864de9424e8b

SHA256
ef900a55d3e4c25a92d188ca027617b5de0938fd9ba78f14afc6e7ade6ee62b7

SHA512
32fd9fc4ea863b3ce7ea6b1889533ce24fde67f1cca765e1d6b8425555942ee5cc24c90e4d0fa693f7afcf3088626e471d78fa8f0cec7f793f91ae576a30adc6

Download Submit
/data/user/0/com.fmfd.gqbb.kvld/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit