97dfbc2165590884197f81b271e4e5707d7411c72d27a40febe47a6a626a93b2

Analysis

max time kernel
178s
max time network
181s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
16/06/2024, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5bc38a8e8dd14e5ab191f463c8dff01_JaffaCakes118.apk
Size 1.3MB
Sample240616-3et5gaxejp
SHA256 97dfbc2165590884197f81b271e4e5707d7411c72d27a40febe47a6a626a93b2
MD5 b5bc38a8e8dd14e5ab191f463c8dff01
SHA1 841cec52295ed2df37dda6d78fd17655dd632a74
SHA512 2364cecbd87925dce37d85063a1afbf03e9562778fe4b215840597db50fcb47971065b8e1cecfd14b53fcebb9594e5e0decaca4120284811ea6791c05628151b
SSDEEP 24576:GcEoL0otaYtXM6SprkM4FqD5Bl0ZHqU+BjHo+acjeBKq/13tdHbZKm51Ob83e:lQ7YtKrkruBl0ZHEj7LjeBKq/1XHNKmW
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4577	com.pixj.kkwn.hsoc

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pixj.kkwn.hsoc/app_mjf/dz.jar	4577	com.pixj.kkwn.hsoc
/data/user/0/com.pixj.kkwn.hsoc/app_mjf/dz.jar	4641	com.pixj.kkwn.hsoc:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.pixj.kkwn.hsoc

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.pixj.kkwn.hsoc

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
47	alog.umeng.com
56	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pixj.kkwn.hsoc

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.pixj.kkwn.hsoc

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pixj.kkwn.hsoc

com.pixj.kkwn.hsoc
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4577

com.pixj.kkwn.hsoc:daemon
1⤵
- Loads dropped Dex/Jar
PID:4641

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/user/0/com.pixj.kkwn.hsoc/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar

Path /data/user/0/com.pixj.kkwn.hsoc/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

tdz.jar

Path /data/user/0/com.pixj.kkwn.hsoc/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/user/0/com.pixj.kkwn.hsoc/databases/lezzd
Size 28KB
SHA256 194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
MD5 fdb8a92e5060ce104e8f0faca55a47ce
SHA1 270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA512 ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122
SSDEEP 24:TLj0kSBieszXtUku+haaL6nwyLGSiGQQ:TskS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 8KB
SHA256 9477e244e9bbc2b8d55d90492e1fa365896d7cb1ebd05d5a180fbd24329ea0d0
MD5 b29653795dd653ac192e05ab1c5ecc03
SHA1 eff5d0026fc80f37437777b18d83e803cb221d34
SHA512 53195c3b13ce812fc3801bdd4aa57c09cab290f797e4923f71929642144c383aa43f6cd072379408f6e89ed578f40f491b6c765a176e96a064907695c54f09f6
SSDEEP 12:7+tW/FqLWem6QADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbv:7+tWtqLu6teszXtUku+haaL6nwyLGSvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 512B
SHA256 be7d02a78a1ad03a73a0f29ec5c2df55e14909e311468f93542b4c2a223e0804
MD5 ad4558fedda9a9e83079a7221a63343c
SHA1 600e935f4557b3332df49399b00faf31adf1560b
SHA512 0d5f181d661133e02fb10bbbd44cdac3713ec2cc0b5de71a899e32e62a02b011d0dd7b5847a4fa922c88682aa697857a369e9a9e36b5456b9de57688bf89381c
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/user/0/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 8KB
SHA256 7e52c5b3197190534db188c429e5771e3078553a563d54883e4c6c76db0023a0
MD5 685f8d1398112fa9f66de4d9575b8c68
SHA1 775872c0e5f5edc7963079125c7730250437b11d
SHA512 d30bb72db7fd8ad9921f9b19a82c93182b3c66d31456f25f9d2020d5404ed483b3add382687675106588fe08778b0fca8b2aa846e03bd3dca8988f099c7bb215
SSDEEP 6:7+/l9H1Hn1fWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKr:7+tdWqLiuWdYRmBEyPbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 4KB
SHA256 6537e55d0e05c87f1ebdde6628781c89d6bddd34bb165b4590c80f14f779d88a
MD5 440816e2ec9ef5fe43d7be8e3fcbfdcc
SHA1 655bc4917d48407266fb12e3c4e251311e20c0ae
SHA512 a2a5027231c0ae775d9c5dd11cb5a4ad04874786a5665b209cf66c73cabbf03e2ba1727b42cb3f590a380d9fd4eecbada8ae7c481b670fc14da743236e9cdae4
SSDEEP 6:7+/lHvsl4Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKg:7+tH0lwqLJdeWRmBEyPb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 8KB
SHA256 3390ef1eb7c4a5cfb2dc024e8f88076dbf1741dc3ac3c4d08ccf3f6141b30366
MD5 2916625552f013ab854ba983e39e6095
SHA1 beb7020e6745bb63e4859495eb716484647029a2
SHA512 d23283d9e32acad4e90bb1b9c6ca00fb3563cab437eebc9221c56853d48ab3e80adb78f2a02d17185237486924058d4481fc9b9a4d65ab19b52173b1baf0c2dd
SSDEEP 6:7+/l9PGPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKz//Ga:7+th6qLmqKRmBEyPbY/
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.pixj.kkwn.hsoc/databases/lezzd-journal
Size 8KB
SHA256 8e584e246ba443d32ca1a296974da744615dcb0bf72647abb1a04f1478c2a1d2
MD5 37f9f9cf1012d1eb253d5cd62b0c8212
SHA1 5576b2cdfe07c757104b384895a73252fb0fc62f
SHA512 6e7c03ed0485877c524a408fe4ce75bd56e366bef34957f2cc8ce7e4df567f171637f903c960fddbe510c1fb23c0b5cb099170df59baab1c526510daf9efe242
SSDEEP 12:7+th5nqLyKPjSyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbG0JI7:7+tvqLy2TUku+haaL6nwyLGSGR
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/user/0/com.pixj.kkwn.hsoc/files/.imprint
Size 940B
SHA256 51642e4e28a5ffe073000117d2b0b773b66907b485fde619b9034c75d9c0e390
MD5 aef30e783c88fd1b9b68122cda2bec5c
SHA1 643319e0e878482b29a9f5869528646798e56e8b
SHA512 2cf301ed00b874e152751f1827a5f9e4435e8e136170d6648af495e0de427ff91930dccce629ff3dfa6e0b57c7efbdde14d7db1d8dfc4b688e730dbb3990c5c9
MD5 SHA1 SHA512

Submit Download

um_cache_1718580545142.env

Path /data/user/0/com.pixj.kkwn.hsoc/files/.um/um_cache_1718580545142.env
Size 1KB
SHA256 6b851a97aeb7872b9bb38e741ccbd1c70b44a1a2b5820c44858278ffbe44095d
MD5 96b212ccd8711962cf353daa5b6733ea
SHA1 eb5fcd6fe556e389afd514d8f553fe2b8b4256ca
SHA512 c06a444f1f9676343e3428f0244e030e136e6f6949059c99cbcfa4edcdcd7634d9229c1eadf1932bb1199ddb54dbacdb92867032ff4ff2080a143cda7b4444fe
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.pixj.kkwn.hsoc/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 e260a9e220aa82a5dcf856b21e891af415b1428333d7b0897a53e5767d94a707
MD5 2d914e13e9febaf4029445e609e6aabb
SHA1 1ff0f9ac912fe89ad44ee4589e04a979e5f7ec1f
SHA512 aac771a85a88be16418ea1580a1120ad439ad20c7e2a4ec5564bae2dd614d87cf4c401370de6a26453dd11866b45aa7c535c0c3fb45fd4388464b26a157822da
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.pixj.kkwn.hsoc/files/.umeng/exchangeIdentity.json
Size 199B
SHA256 3c718409bc5d38c86037a2eb14bc5922921ea511480165c24dd7b51b093be546
MD5 b4f590cfd089b11cd999dd8867fd4671
SHA1 c1ce6704fd687566d30a6a49bf994ad56facb9a0
SHA512 64c1e60628b4fae6ddcb3f113ceac301137331539451b96e4785aeeb8092a5090b8e5195aa13d95c1ea1ab366a9dd47ec6c253f4258732ff8eae78c472dbdb4d
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.pixj.kkwn.hsoc/files/umeng_it.cache
Size 342B
SHA256 bdff72bd1bd3c23f3c661318778a57ca970c1ecdda240984b1fa8d9c8f356595
MD5 a2ba7287b8eccb8fd2219041aa3331f6
SHA1 bb372df68a6f07463c682c4ed3713627aebf6286
SHA512 b3b526d7d02b56b1af29739522d6646a29ac48b0b7e87df97ae76e81461783af75af5027d9e6cc40413ef955b293826fa9f3ec9a9dae564f06d22ab869efe54c
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.pixj.kkwn.hsoc/files/umeng_it.cache
Size 174B
SHA256 94c6c8d162cf45c9814fd2d2e298f308f464eb2d738a303af33d2f796eb82bea
MD5 32aa87a7b4c98d93c9fbaf598d39ca3f
SHA1 cfd66339020096e9b6fd2e714716a30adbe31486
SHA512 c30aa0e4f6148ece10d75c3601b7da25c7f93014b3e5c6879692263a8a565142d50f577f6cfb1022ecaa32f2cc7afb3c06486672b12324970b91e62055e5ce38
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads