97dfbc2165590884197f81b271e4e5707d7411c72d27a40febe47a6a626a93b2

Analysis

max time kernel
178s
max time network
178s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
16/06/2024, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5bc38a8e8dd14e5ab191f463c8dff01_JaffaCakes118.apk
Size 1.3MB
Sample240616-3et5gaxejp
SHA256 97dfbc2165590884197f81b271e4e5707d7411c72d27a40febe47a6a626a93b2
MD5 b5bc38a8e8dd14e5ab191f463c8dff01
SHA1 841cec52295ed2df37dda6d78fd17655dd632a74
SHA512 2364cecbd87925dce37d85063a1afbf03e9562778fe4b215840597db50fcb47971065b8e1cecfd14b53fcebb9594e5e0decaca4120284811ea6791c05628151b
SSDEEP 24576:GcEoL0otaYtXM6SprkM4FqD5Bl0ZHqU+BjHo+acjeBKq/13tdHbZKm51Ob83e:lQ7YtKrkruBl0ZHEj7LjeBKq/1XHNKmW
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5014	com.pixj.kkwn.hsoc

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pixj.kkwn.hsoc/app_mjf/dz.jar	5014	com.pixj.kkwn.hsoc
/data/user/0/com.pixj.kkwn.hsoc/app_mjf/dz.jar	5094	com.pixj.kkwn.hsoc:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.pixj.kkwn.hsoc

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.pixj.kkwn.hsoc

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
39	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pixj.kkwn.hsoc

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.pixj.kkwn.hsoc

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pixj.kkwn.hsoc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pixj.kkwn.hsoc

com.pixj.kkwn.hsoc
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5014

com.pixj.kkwn.hsoc:daemon
1⤵
- Loads dropped Dex/Jar
PID:5094

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.pixj.kkwn.hsoc/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdz.jar

Path /data/data/com.pixj.kkwn.hsoc/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.pixj.kkwn.hsoc/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 8KB
SHA256 7d66352df22cc1634d5a90bd0abfa17f1e1e023354a887a8abf4717e5251ec5a
MD5 a542e32b3582514d037a7ed15145aae3
SHA1 6bf08512b718cdbe981c1f647fa40792ac323962
SHA512 2183bbb96781d417f39a0c457d82edeece9d124900be37bd59c13587b7e6c0b8b02fe8981e02f780ab925d7d080ea2e3c523879600d17314a7123da4796c0364
SSDEEP 12:7+tQqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbSsh:7+tQqLGqteszXtUku+haaL6nwyLGSQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 512B
SHA256 77b0a562f5f0f36fd006880e0b2b0559c3caab5137b441d4245a14a8c532cdce
MD5 8323fca0edfed7edf210a9aa3ded7b00
SHA1 70863f8913afa94e90d16c292a3373c738dde940
SHA512 49dc27000f5e11033f046e027e46904744ac5e3086c8cd0dcf50940786076ce274a695735cd825a1f9cf048529fbcfd913a9219fe8d2ab0c486ac41b892762c7
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 8KB
SHA256 9a656852551f5e395f1e7d628e00dee7c14acd117e18fe007d5d528975c7796a
MD5 48ec97e842f995202c1f5297d2adcd77
SHA1 3cf7b70c732bfb6ad78ab5aca74651d04e815424
SHA512 e7eec64124e2f967d48c9e6cf2dbf690012e5cb10b93e3dd1aa89e85fe54f28047da6dabd8687488817812a76eba89b839bcf1714d1fa786846708d095e27bda
SSDEEP 6:7+/l9ln1Gpg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKopI:7+tkqLiuWdwRmBEyPbXI
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 4KB
SHA256 dc691acd373d1393c06e84be7a205c858f1b23c009cd9aed6121620e786d3675
MD5 2da4f7590474d85a6a9028977d629dc0
SHA1 0a62eb5b4b95afbf3dd0acf41ec4987b372a5f29
SHA512 9ede820850543870b231ae8a5d6eacf0536275976bef5d750e99a7d38320a0c70fb52dd89cbdb690654e500534febc7109249d24f98bcce7f9665b80df84f5d0
SSDEEP 6:7+/lTPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKE:7+tLqLJdTRmBEyPbv
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 8KB
SHA256 7b8d1b6ebe16f3e86fd47b9a029918249d516ae4eb11dd4648a4e01b949ce4a4
MD5 5bfe5cdaa6b7935b3017499a037ac29c
SHA1 58ee722582a65ee428be7dae6ac44ed29b472bd0
SHA512 c7b31b49f35547de8998b7979dcf0523bffd9e3fb4caa3d83e7a3a71e3888f8901414eedfb0740b1a93aaa304bb191582166400f357e4430cd7f458400ea0ed1
SSDEEP 6:7+/l9qWOPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKz/Dn:7+tgpqLmqCRmBEyPboD
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 8KB
SHA256 641c0dc2a25c5dab08d17927c68e902d95eb27458f8b09246f6a0ad9aa454513
MD5 a5af80c9aad4093c0ad30a49e4db394d
SHA1 ea3710a154e96b174499b3be4a1437da909769de
SHA512 34c5beaf7bfd940b6073db73378b48ac2525285283a150bdde4dda7d26771aaf68d5a507564f8db7577b86a8be03bbe335660582c61bf932612633908235881d
SSDEEP 12:7+tanqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbxYb:7+teqLy9yUku+haaL6nwyLGS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1718580485086.env

Path /data/data/com.pixj.kkwn.hsoc/files/.um/um_cache_1718580485086.env
Size 654B
SHA256 35dd3796dc61c315fc759c921f1e0d1379a5a58650d6a4bf239645871fe5afee
MD5 d806acc679fcd88a44dd1d1a3c146b75
SHA1 5127dacd12efc0a8504f6e3160d00bb7e61bb547
SHA512 95e6e72095b0306fa7e7c7c40139df95a2437dad422849e8eb190ce421d56d5845a3b249d29735d890155133cdc67ebf4b1c6c55284bd3df69339abc7b139e4a
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.pixj.kkwn.hsoc/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 34bd76ee0b4686e531cba1f99e8c66d9d21cd666e0790c186d1de99f1304981f
MD5 d07068d0344a6c5cc543fd98e2f9958a
SHA1 f82e5be2956293fc4044b31a32e054994eb39bb4
SHA512 eacb8542eaababca31c82d230b974b02f1ad37f986759bb21fb4c19c67c6c75fee6d489b2f572d4100be40ea4d3872c546c7919e7c50aa3e9c1e62492f04fe47
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.pixj.kkwn.hsoc1

Path /data/data/com.pixj.kkwn.hsoc/files/mobclick_agent_cached_com.pixj.kkwn.hsoc1
Size 788B
SHA256 7e95e9b8ba1345dc07bfd7ed255fea3faca239d6b61c1fd78df5dc5476834d32
MD5 b77b65856ea0d04edd5f4a5d59152d0d
SHA1 d1ea166dcdc17ca05a18b9fad42c1a63ea7f5c52
SHA512 430941e4a8b20110a99b158ce1786897f859fba8bd366d33e4384cb568d01aafc828abe286605341f9acf52b7f837538a26e9d37174e1dbbd1e1f843956a982d
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.pixj.kkwn.hsoc/files/umeng_it.cache
Size 346B
SHA256 98d9132c1ddb5409ff612737db15e98404667d679d5fa714c7656324f7195b56
MD5 9142f722776e88933e0d80e10c997c08
SHA1 e76a00e77c95ef9c8c3e76c101592e68deb36ee0
SHA512 bc0ba89d8d2fdaff12b869672570d5a175d97c4270bbf79222e8acdfb8caed60a9f16000acda0479d5cc68b1e124c62d6570b4afd98dff5f082761a4bb459595
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.pixj.kkwn.hsoc/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads