9cc6b5f14b4532c202b285716de4e7695e4dce425eca5097506e7219a32b0d60

Analysis

max time kernel
178s
max time network
185s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
16/06/2024, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b56dc1280d0b1e17cea95f74fc79b9bb_JaffaCakes118.apk
Size 637KB
Sample240616-13fkwavanm
SHA256 9cc6b5f14b4532c202b285716de4e7695e4dce425eca5097506e7219a32b0d60
MD5 b56dc1280d0b1e17cea95f74fc79b9bb
SHA1 ddd0627c1f973b1b25e2fa1aea47277d142a7f52
SHA512 8a746020597e8c60d48fe4b649da94c87de6696dcf614f5ea43528454742a700c4338bd78dc68d593515c51501d596a9a84b75f49e89f4cbb6953610b49ace0b
SSDEEP 12288:y4L4oQI8Y0FotaKIUtrbMH1y/gfOdFskKkEeFxHMQF94vvQe6ERylTY0:IoL0otaYtXMV5OgktRMMiydN
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5027	com.fmfd.gqbb.kvld

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.fmfd.gqbb.kvld/app_mjf/dz.jar	5027	com.fmfd.gqbb.kvld
/data/user/0/com.fmfd.gqbb.kvld/app_mjf/dz.jar	5137	com.fmfd.gqbb.kvld:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.fmfd.gqbb.kvld

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.fmfd.gqbb.kvld

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
9	alog.umeng.com
47	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.fmfd.gqbb.kvld

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.fmfd.gqbb.kvld

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.fmfd.gqbb.kvld

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.fmfd.gqbb.kvld

com.fmfd.gqbb.kvld
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5027

com.fmfd.gqbb.kvld:daemon
1⤵
- Loads dropped Dex/Jar
PID:5137

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.fmfd.gqbb.kvld/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar.cur.prof

Path /data/data/com.fmfd.gqbb.kvld/app_mjf/oat/dz.jar.cur.prof
Size 611B
SHA256 ff26e2d5abfba5b10b448474516838954fed479b27ab307525116f67d84c546f
MD5 c78b0059c974ac8dcaf1ac03ab48bcb6
SHA1 7928897f2ad2e3ef144b8e1ed091b2a19433b248
SHA512 f8fa44f8879209c577767cb61bd030abd3d1a22bcbbe54307e09e82177e765d2f7ccf2ac78831508119c9d7cc8f507294b3fa18a07bcb2e635c32dab38f8261c
MD5 SHA1 SHA512

Submit Download

tdz.jar

Path /data/data/com.fmfd.gqbb.kvld/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.fmfd.gqbb.kvld/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Size 8KB
SHA256 4e7a9e6233eab097fe2eab91a90e4e8e511bd4d84ab151ef87795a05f35145b1
MD5 a625303950b4db47ec19a3758a77ee02
SHA1 3333f76b8c26968ce580bcb5c102f6d5eb0f72e6
SHA512 10af405986f9f5ae613460fdcf5031ebf6dc98873efb2ab1d9556c0e4c3efa767a780525a09cbf887eb1d5e680b5eb19ded1dd2687bcb8345ec0e10af5553b6d
SSDEEP 6:7+/l9XiFPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKU0t/9:7+t1IqLmqCRmBEyPb9019
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Size 8KB
SHA256 294ed88545089ce597ce05bd5a591808825ea3fe7194af333952682f3cc35a7d
MD5 e6dd6c14a56024c12cc59880fd38a02e
SHA1 5e86380da29b876f745247b18309d7fd8ebac77b
SHA512 959b7999ce640e86ed56372534c86420251c6964aa8489d506b2cceb40e35d0128eb0dd1bc7917aa0a380626def2ec2c00a542413f665e3e118a812c346dffa6
SSDEEP 12:7+tsQtinqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbe5n:7+tlGqLy9yUku+haaL6nwyLGS0
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Size 8KB
SHA256 29bc917f9aeaa092f6a2ed889a2953dcd7f4348bbea1962b61a50c89205646f1
MD5 48c55fa71805d7e1bbd532ee3057bbf8
SHA1 d6d84b3664c37953177bad5503847d064b58e0b4
SHA512 be2f906732c8d32c3120eff070b44ffe11f04156837e92e23ffb2304ac58095a7005543f46166a9aba9ee8073706eaf9b276e6dfc625490a81714d314b722376
SSDEEP 12:7+tvtqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPb/z:7+tlqLGqteszXtUku+haaL6nwyLGSL
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Size 512B
SHA256 905026c08c09b64a24c98a3129e289de475ff47ce77d069e101a05ce61c99170
MD5 da521c7da287e8fd9049e1925a51a006
SHA1 2715730d07c6dbcd494156bf8180b56027ee8551
SHA512 d7ed87a6dfc058b09879a5013e8975616aa2804ceeec457f53b1bdb5cb94d1bd358b9f4f23d8c01da2e41e762bc7efcd431f4c93862555b94babb351a1fa2121
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Size 8KB
SHA256 0f0e138e1ede8f362f511efed610caedf3ea37ec0139988b8c25b621dc7f5a3a
MD5 9b3d93c94c2b3ce399803e668c184885
SHA1 718a2cf8f851747582ceb63bf51e66cc2c30496d
SHA512 8a332ff923daf7b91569390fa7a634aabe09fdc3c59124d00494f26d34a9fc28785dfbf3104ac21e596d8fde44dd8f9bd18dd1e3aecf809f40f5034bc37e006d
SSDEEP 6:7+/l9rq8Hn1W+2vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKL:7+t9q84JvqLiuWdwRmBEyPbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.fmfd.gqbb.kvld/databases/lezzd-journal
Size 4KB
SHA256 a83bc363e38e96ddb22ae63ed3af944cb76552c2539644477ff5ea65045112f5
MD5 18d8819673bb29aff3f0ad114398b600
SHA1 af8030a29bfcd4e2c7df6fda8da3e7b7fcf85c76
SHA512 e924367216c51704b951bba4d3ddc76cdc9f7f543c921427fe7edbdf8594d41b3a4fc142344ad51fb10db34e3006f42bc452b0409c29e0e899540975c6514790
SSDEEP 6:7+/lL/8lFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKt1:7+t4vqLJdTRmBEyPbQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/data/com.fmfd.gqbb.kvld/files/.imprint
Size 949B
SHA256 e6b5d2685ffa062cfb0a8793794bf28c617daa150b06c6bf9d9908d3ce03c61e
MD5 9e8dfbd4883dbde2b4c01b27b22b1481
SHA1 e1aa0207a527d4d5587ecd1c498e07ca6d47fdff
SHA512 a48acf757acefc4ccd9e6e4188eeb746318313b04321297a76eb4cfe66b0fce9e5e77a8c5b9705c93247ab335ffa79469018e4416e7d367ec047dd3342c0dbe5
MD5 SHA1 SHA512

Submit Download

um_cache_1718575887816.env

Path /data/data/com.fmfd.gqbb.kvld/files/.um/um_cache_1718575887816.env
Size 651B
SHA256 ca52402e6d29f927c19ae898240585bec8c02c43894c2e55868953467c7b1a2f
MD5 f45d875251821acf5249662b68653c8e
SHA1 37402b4a5b965c7a3c61640014046677a448679d
SHA512 fbdcd2f1818e256a20708c2155f91f794984ece6aaafe4ccea817eade52889343e96dc665540040b188fa5cc70ed130ab94d6f9ea67e827596f6ad342d07c2c1
MD5 SHA1 SHA512

Submit Download

um_cache_1718575996567.env

Path /data/data/com.fmfd.gqbb.kvld/files/.um/um_cache_1718575996567.env
Size 1KB
SHA256 2ea6117c36999868f5d5d1b886276bbcf334438ba566b7964fe1fedc258278b3
MD5 27058f9d4de907c12dfe3c04bbc3babe
SHA1 a314277d0ad3bdad7a912dedc4b9b022549090d4
SHA512 49cb432b13af18ec457e04a7c23a48493151584ca041c17758eecb95670931a27f9e4a2cb51479949c6e68ea29aa605c091b79c61a04e6342fa3c2aee0e7781f
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.fmfd.gqbb.kvld/files/.umeng/exchangeIdentity.json
Size 202B
SHA256 facfa1fad73376b42f2f1e6b63ff1cc73ce819486099baaef07a3b3f46d9799d
MD5 a0a373370072aec2b6ef1814369ff16f
SHA1 f2ba874c4f3bfbabdc1f30513b2e64f782116b8d
SHA512 164fb50adf15850160e85a967e2062da919b916234b39efd6a5c0853d16b08667676d2a57dee377128ba4e1e5d24d29e45edb8fbfcd42bf4931c741d00d06df5
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.fmfd.gqbb.kvld/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 280dfd315dce2e44856b05794a96827917f64e4bcdd1dc859aba7f1fc0974513
MD5 8131e18118e82e826df3839c0335840d
SHA1 2bd529d18086cca4a0f26c6501da0d9e98deb8a2
SHA512 da745039b253c4495cab52104050764816e6e8345a9c4e2ff5485484547e00121b1628a80f86f877606e1539b657521ef53bb2365b158d63708e61aef038c7aa
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.fmfd.gqbb.kvld1

Path /data/data/com.fmfd.gqbb.kvld/files/mobclick_agent_cached_com.fmfd.gqbb.kvld1
Size 1KB
SHA256 5f166c55bd390df18da1fd49846978f70938857022552a936122b65da5431eae
MD5 e76d745f38600d9b9e1abd2105717641
SHA1 8c7922a8e29b5cae3baaf147c476c8a46cdfa55e
SHA512 05688def43b2ab773a5c585f207d3bd07bbde35c1224dca580b01c6ae6eb852605ea12f63427e69366c9ce1111a9b8007d6215dcc2c536d040356527e22efffb
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.fmfd.gqbb.kvld/files/umeng_it.cache
Size 348B
SHA256 ef900a55d3e4c25a92d188ca027617b5de0938fd9ba78f14afc6e7ade6ee62b7
MD5 adfb33fdbda2cd5ea2e468143b8c830f
SHA1 809eab01cc9d9571a5b88fd95058864de9424e8b
SHA512 32fd9fc4ea863b3ce7ea6b1889533ce24fde67f1cca765e1d6b8425555942ee5cc24c90e4d0fa693f7afcf3088626e471d78fa8f0cec7f793f91ae576a30adc6
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.fmfd.gqbb.kvld/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads