ebc8bda1e5e3bcf0a954eaad46baa742a484b346c5ffcee5a3c8f9034cfd12f7

Analysis

max time kernel
15s
max time network
176s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
16/06/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b1832e5b71c405dc2454e64617c0ea62_JaffaCakes118.apk
Size 23.4MB
Sample240616-dvtq7s1fml
SHA256 ebc8bda1e5e3bcf0a954eaad46baa742a484b346c5ffcee5a3c8f9034cfd12f7
MD5 b1832e5b71c405dc2454e64617c0ea62
SHA1 e03f0c34cfb60d731ea35acfea16ff9db7c63783
SHA512 02cd24da5b1a5716392f4f2f844465164ff1781b74b9378e07369a50b16a25801e65b62263407b468acd78c3e640dd42788c7fc205407ca8752d3a59788429bf
SSDEEP 393216:y/sP1BQcOUDWwQdshskHBCFjKA/dZk3dN0fdhnUeltqDhPd9FhJp2pKpxJRil:y/IvQcvrQdLqwFRlZkevUStqDh3HHBnA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.techsapp.sitjsubranch/files/com.xkzz.tsndzh.jar	4440	com.techsapp.sitjsubranch
/data/user/0/com.techsapp.sitjsubranch/files/com.dpqpiy.jar	4440	com.techsapp.sitjsubranch

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
24	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.techsapp.sitjsubranch

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.techsapp.sitjsubranch

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.techsapp.sitjsubranch

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.techsapp.sitjsubranch

com.techsapp.sitjsubranch
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4440

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db
Size 20KB
SHA256 a0ff436350e364b855530fe524f03fb90873e08f16d92246c25bb88d80204fe5
MD5 c177e909aa97a7b771ea5f60e7f75bd3
SHA1 f873bcecef5c46f5d18fdccd10130a102961c70b
SHA512 2d5259763753cfc3caa369cf6e130fed8e01fe76351ca44c087068a3f5dd1cf05be67755f31c0003dc738c84c17f71bb4475eb45b555ca8630e3fddf39757fc3
SSDEEP 12:TL+/3P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/h4L:TLl7sL7yot3BVrHotGGSP/o4Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db
Size 36KB
SHA256 90cfda445e88de4fe0389f825ad7ed23ad14cce4afbd21d63952a950523c2a3f
MD5 57952a50779ea9cd14a26eac42103ccc
SHA1 3e8e0adfc2f4716fe08a32cde41602bc11f56662
SHA512 befb970c833eba73743f27f8ede6f84232621b36719e582beec7dfb9604d9a30f7e4d2e4a17b7afd3f0f554cf4d0426a67ee2d2bd8ed9b52e6c736691d618a3a
SSDEEP 12:TLWEmlP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/go:TLsO7sL7yot3BVrHotGGSP/g11DBC
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db
Size 20KB
SHA256 43e8c9b350b52483a5051076d7251cd6402e32323d5920554652d5751efc7498
MD5 a8ae6c92eebd1909a49d161e05a9ad57
SHA1 b1b860e52886ae0618b0c24d27537baa28cb8c96
SHA512 d4ff86689db204606d4eb3498bd494f7eab03c1a5a42ca6395919433f744ab2851187b81f74c21a318d9107a4c04c37fa8e739c468ba64fdfcb20ecc5c035215
SSDEEP 12:TLg5P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/M45s:TLF7sL7yot3BVrHotGGSP/j4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db
Size 36KB
SHA256 3a4a389f09256d3fc2910603a6cfa1ca0a9cc9d11e5bec1298d47b3ada8adcd5
MD5 fc771c74ba1c53db2a3d4199fc59b5e5
SHA1 3390acaa9b563983dc67635ce53941ed549af0ed
SHA512 56df2d387b95acffbe7659aa7864eacaab935aab003877b52544be23e732234279d12f828890bb7d8eff7fbcbcd3076ecfc15cb07d7d6ecedba97173feb112fe
SSDEEP 12:TLzgP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/TFQW:TLV7sL7yot3BVrHotGGSP/Tylk
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db
Size 36KB
SHA256 9727cfe4be8ad731770612724eda3de75c90a84ea0b1a42a129391ab117bb50a
MD5 48eb06681406078543b176ac4c6e8cd1
SHA1 d60d76513df190ff7161288d0746fe1f59263cdf
SHA512 bdaca3e260483799a1f1c169f4453d269326f8e34283ccd03ae33984fa5f9908890393a285672593907d81488527d41e3c6ccb038c993a2f14e857a1e4566a4b
SSDEEP 12:TLyEilP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/lc:TLy07sL7yot3BVrHotGGSP/M4DQ+U
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db
Size 36KB
SHA256 c422190539b6414072fc3950da19a17985c0c4c2172740b2f74682b520af5231
MD5 4cfe777c9f6e7859f5efe2197401d8e5
SHA1 bb3774e8879ad5f6db0c37f151c3d6bc7b4b207a
SHA512 6be469864edaf8eaa110f618f8abd27962da92e20945dcd38073ade2b60b10f00552d54d5db9d9f75ca133213031030e71e2e30113ff033e5ef507a28fe0b1de
SSDEEP 12:TL/0P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQ:TLV7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db-journal
Size 16KB
SHA256 af7219d6572d84e742883b1f67f3285a0cf0a95e652500613f90995068ddecfb
MD5 50e6fc1d6824812b6bf862ef5fa95b2e
SHA1 bb8ad10ace48731b0bec19a9c3801110eea1b118
SHA512 77cfcde2257b6c18aa995a9d2f077fd9f7c4d1f531e4f9370046ab739459c3f5ed96745bfafbebb546074048dd99a67440668c8115edfa1341d886aeeffbb969
SSDEEP 12:7+t7xWLqL+/3P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBE9:7+tlCqLl7sL7yot3BVrHotGGSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db-journal
Size 16KB
SHA256 fb8cb42c5c8c5e6b12b9ac80205a47e38be105f8265641a6cf8665acd70f1d98
MD5 fb9beb08cb2ae57912ee8717d0019e64
SHA1 7af8d3b829c3e98af6bb877118887e00bc7f41a0
SHA512 34266c2ff5e0b8734a99abe3a8a7d11d1af6bdaceb2188d9220d5bd567a2744d1beb570a236066cc9f83d65a208bc5d0f6cda6cafe1b1d1297492bd65b30b069
SSDEEP 12:7+t7FWKyFL9pqLa/7P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtbQ:7+t5crpqLac7sL7yot3BVrHotGGSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db-journal
Size 512B
SHA256 c871e41b56adbcd7dca166fb180b7633e123449bd3009f43e59407a6b5ae8ef3
MD5 8cb98fe822d3432ddf0c57bec54bfc06
SHA1 080ba11000751439cb4b9ef915907392b23ea267
SHA512 03060ec6f763591b3d69cad720a39856139515e42ca603be5fec034bd632604fccd3aab3f6a0286391a73458cc76c2eba9d62beb550dac5c2aebea5433819755
MD5 SHA1 SHA512

Submit Download

cc.db-journal

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db-journal
Size 8KB
SHA256 f3c096a40940f9ae41ccdd0f7112b506f53055e403bfe645da2b66ec82bc082a
MD5 79dd5afc1924d4b144c773b29c5c0886
SHA1 126cac2fdb572791fce79b4827a810a80211e68e
SHA512 d38f0b9d08a6949fd2dc1d685308b849dbb2386cde9d603ccb9415d4fb47e833e24419fc49195a120b40dcfeb62c9da005a156e5d66ca3e18d34f3ea3b3507e6
SSDEEP 6:7+/l9PHn11Wg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKl:7+tFWqLiuWdYRmBEyPbi
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db-journal
Size 8KB
SHA256 6f3e1f2dffef719ab14c8bfa65bd2170852bf0cd88895efa8c9f4e9e33381b91
MD5 327fdac2685630948f0a39ca62dbd031
SHA1 551edb0a78fe038da131f19d8ee9e953d20a871b
SHA512 0ea96aaf4e2deac8850ae744c6822c16388c28283671b0f5408706fea1cc35c38581b72f43f36a9121af07cec3bbd852e86f0f07a5082ba4ea626c523194cf9c
SSDEEP 6:7+/l9+Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKf//fH:7+tgqLJdeWRmBEyPb8Xv
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.techsapp.sitjsubranch/databases/cc/cc.db-journal
Size 12KB
SHA256 cd11e86a2b7e5247a365ce97849540afa7c9fc0de8f152b99f33623706baaf8b
MD5 aad642d3c4a9903b99177ffb413f0910
SHA1 1c2271bbe60db9262c5adda47b9f34d15826de5d
SHA512 06532b52a7808905cb835336730d37556f38f1ed0ea9e09d07244a1f633b89ef4f0c863a5d2aa8a300bd6b1651b206ca4373d26b5af1d2418a6857fba5420114
SSDEEP 12:7+twVepqL/0P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyJ:7+twMqLV7sL7yot3BVrHotGGSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/user/0/com.techsapp.sitjsubranch/files/.imprint
Size 918B
SHA256 800616734acd46c9af72fcd860aecc4c716615ca2ce702801880ba82088538bc
MD5 b096dcf0adde757c40d5e0b75ff0d9e5
SHA1 c07c82f79dd79806c72a3405003ae8c958c19634
SHA512 cf1ef65cf7358df7a30c81954ee311a4a95b54e2c9f0526d2e3275402e1238064e4311c9dfdc9f44cc733cc230a2da52c17b0cd5064d3deaaaf6df19ada95699
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.techsapp.sitjsubranch/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 1635eff7fa8b10517db79f6575f88b542a09714eba392e1001b52618650b9c1e
MD5 31b21f0de24ceddf68b000214a01f8ae
SHA1 14bd3e4e065e96cdcd9fae8d278b6ceacc78dc3e
SHA512 b9fec654887290303af48965f64f20056dd20865905a0cf3e11ba80f3229d53c98d5cae166a0aae5590598780dc673e4251cf1bace8f7d0529d8c0c75215c90c
MD5 SHA1 SHA512

Submit Download

com.dpqpiy.jar

Path /data/user/0/com.techsapp.sitjsubranch/files/com.dpqpiy.jar
Size 215KB
SHA256 13cddacc9f95f85a699d08cab7ff3a9c54ab9dfee3c4f2fae6f561fce9b762a9
MD5 3e6dc4daf00097937e5a3d38e3fd9c47
SHA1 43e07cfa96e03ef2ec22f0b267b0c43bc2447e57
SHA512 963df2871f784cc48b770e499d0e9e8b45f59b1b53dc6e064a31d4e83891c93a258469dc76e5e3c0e87ccc946ff537a7a5a13a99defd4e54f48d07819c159e22
SSDEEP 3072:1XHo9QxVMwvcfYmsm8U3WUT7K8/E0HeENSPOecnbhE1N4frmEpc7SfYttQC8lZyz:VE62UcJxF7x8UeTPfqbEWXACpl0Z5
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.dpqpiy.jar

Path /data/user/0/com.techsapp.sitjsubranch/files/com.dpqpiy.jar
Size 417KB
SHA256 3ea43479d4ec679d414969d16bd7722373e3029070d4ff720d75401eed09e48e
MD5 c5d8987d49d25fa48486f00a4d57576b
SHA1 ce3f2ca5ec4d5e3bdcb3125db502885c414036af
SHA512 ee6b5ca955ea0a2495a7b34bf61de29a85ef569d6ae5dec93dfbdf8d01f0b74484de7d4e93cc9b41e4197474cfcb2bb35cd795396282002d6c8dcad7f5cdf11d
SSDEEP 6144:ojivfVLmkFv8eKwj4f6HheeLgl30S0pw06rXt5zI13M7d6IWY1v9:ojOMQ8iHhPlwbXt5pkFY1v9
MD5 SHA1 SHA512 SSDEEP

Download

com.xkzz.tsndzh.jar

Path /data/user/0/com.techsapp.sitjsubranch/files/com.xkzz.tsndzh.jar
Size 43KB
SHA256 600bfd6f8ec7420c0007958b0e4b87662e7414afcec615d9af821f5caff77c4c
MD5 d29f9a021e4d797e3d724dbcd5171fa0
SHA1 797a598bf1ba23306e196e961721744f01c7f046
SHA512 a3aab012a439c9523a6448c4ac3c8ab551ec910becc2a531579bf576eeb2cea3efe708d27c90d411caace7ac50565383f0ff62acc71e0c62a18c285136df9c37
SSDEEP 768:9lZBdZUl8C4MCaD41CFbukh2+49o8a+xz2eDwkH06CWWY9h/ZD6:NzZS8CW+4YFbuk628dnU8Z9FZG
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.xkzz.tsndzh.jar

Path /data/user/0/com.techsapp.sitjsubranch/files/com.xkzz.tsndzh.jar
Size 112KB
SHA256 b17b4c80c28ded1cc4e8612a3342b0d39a76cbe8484e53d0d20fb17df02fccb7
MD5 15c5705d0dbc7deb03281bec8cde301d
SHA1 63bdd70c843e840e6ac365159664d1ffe9cbe5a0
SHA512 40d51e69353c5b77cad263d3ef113768fba387e5c29f97e45b02d5f8f5846cb9826e7b42b5b1b9130ab4a7fdaaf61721f59d83d73e42a8405fc241680df1b614
SSDEEP 3072:tHqSMvQKiWG9QDKebLmCZSrzC7HAXShsoD:tHqVv5E9NCB
MD5 SHA1 SHA512 SSDEEP

Download

umeng_it.cache

Path /data/user/0/com.techsapp.sitjsubranch/files/umeng_it.cache
Size 435B
SHA256 8e1d4e06deee6de455e4c23bb1c14fea152230baf8278c0813391b086958628c
MD5 88b89b8f6f86ed0bf0c4b9beb0ba4442
SHA1 524dcd37ff3f839dada0ab1ab79fa7073beb9a3a
SHA512 568bfaac1112730558eeffb6239cecd39e5013043cf96b0ed28657ddf11b7fc95221ca151ffdffc5b77d326c382a0f0ac71147451a4251141dfeaf3594bb8644
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.techsapp.sitjsubranch/files/umeng_it.cache
Size 221B
SHA256 73c455aadea496e16e4bafa020d65938d34c3c73acf51761acd092178fdc5da4
MD5 67f4fab483858c648e04ee0bf5b5bc0d
SHA1 246d3fd2fce4e55170c1498092e161676cae64bd
SHA512 3f8d214948e2870bfc2db9c98cfb1d63af74e79aab89297b9e632fd58e3cd7e046d114d6444f89be758a84ebc4beea3f50135b994c38284863c09c9584a16389
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 4346cd905c4e83dfcb723d0d2c499a4cd39f2886b4d2f7f191cbebba8579f5f5
MD5 65d06a66a85270cae05a0c6d75326c61
SHA1 1d05616c53ed42701f1859879a4614bb74b304e1
SHA512 8332ab5f5182762d58a6b0b90a2a206115a9efe6ae948c1f5c730abfa0cd764a8481da8b4ce4904816834b823437bc1629efa03cf641a2fa5012aa39ae202827
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 005be2e5a8034634670d4eefd8de19d7d5e641f6fa05f5fe9f97ebe058b4ddf7
MD5 e3071e11ba0ad573afbd4ecde5e9e8d6
SHA1 fda597c46c0799dced7135a783fde7ff76760c09
SHA512 a75ef7658fba85b27a497e0761880a679e41ecc8cdeadce6fbd1ae6609a02779b17dd26a6aac8ac7931e88d88356fc8b8322750e67f57e6b240f898c1d417b02
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 408B
SHA256 4f44610229f039185690137c2372dd931529c3767bcef2a97ae799fad0aa932c
MD5 96e01ff70f71f234f4c010ee4fa29092
SHA1 ba2448c0d5f3d8e0b8436c69d3db5a8ae2a4f8c1
SHA512 a025912ab006af08bf305a4184be2042663a8c1c670fa190970793ee845d267217f4c8be58c73f6a954a2faae62d75f6c86b506dcf7c8063c631bbbc8f874ad3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads