0c89f9870d0ebd8fae3c65af56cba370de78af9399a2b04122e7b2443440da98

Analysis

max time kernel
178s
max time network
181s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
16-06-2024 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b23ee7c3ca43a01810e36abdc048d3cd_JaffaCakes118.apk
Size

1.3MB
MD5

b23ee7c3ca43a01810e36abdc048d3cd
SHA1

4f48cfe6d8372b154f709171606c06281e4a4c13
SHA256

0c89f9870d0ebd8fae3c65af56cba370de78af9399a2b04122e7b2443440da98
SHA512

28930f63785760a1f1c1f76815b8cbb57470f81841f3944484716d9107ac758210d66b0d769b2d330f7bf540677ce26faf7fee779befca7d0ce9867ffe61b36e
SSDEEP

24576:6oL0otaYtXMZMPc7T61VaxP5PFA1rypq9o+P8j7+Zq/13tdHbZKm51Ob83t:hQ7YtDcX61icdysVUj7+Zq/1XHNKmjb9

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.eyyk.qwit.yomo

pid process

4438 com.eyyk.qwit.yomo

pid	process
4438	com.eyyk.qwit.yomo

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.eyyk.qwit.yomocom.eyyk.qwit.yomo:daemon

ioc	pid	process
/data/user/0/com.eyyk.qwit.yomo/app_mjf/dz.jar	4438	com.eyyk.qwit.yomo
/data/user/0/com.eyyk.qwit.yomo/app_mjf/dz.jar	4501	com.eyyk.qwit.yomo:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.eyyk.qwit.yomo

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.eyyk.qwit.yomo
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.eyyk.qwit.yomo

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.eyyk.qwit.yomo
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

Processes:

flow ioc

40 alog.umeng.com
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.eyyk.qwit.yomo

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.eyyk.qwit.yomo
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.eyyk.qwit.yomo

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.eyyk.qwit.yomo
Reads information about phone network operator. 1 TTPs
discovery

T1422
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.eyyk.qwit.yomo

description ioc process

File opened for read /proc/cpuinfo com.eyyk.qwit.yomo

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.eyyk.qwit.yomo

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.eyyk.qwit.yomo

flow	ioc
40	alog.umeng.com

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.eyyk.qwit.yomo

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.eyyk.qwit.yomo

description	ioc	process
File opened for read	/proc/cpuinfo	com.eyyk.qwit.yomo

com.eyyk.qwit.yomo
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4438

com.eyyk.qwit.yomo:daemon
1⤵
- Loads dropped Dex/Jar
PID:4501

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.eyyk.qwit.yomo/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/user/0/com.eyyk.qwit.yomo/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit
/data/user/0/com.eyyk.qwit.yomo/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/user/0/com.eyyk.qwit.yomo/databases/lezzd
Filesize
28KB

MD5
fdb8a92e5060ce104e8f0faca55a47ce

SHA1
270d7ca30673e18cec1d2b9add71cba96dc426fe

SHA256
194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a

SHA512
ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

Download Submit
/data/user/0/com.eyyk.qwit.yomo/databases/lezzd-journal
Filesize
8KB

MD5
47a5b4e25c391d613953094e95a865f6

SHA1
a74cf2a59a942c06513789fcae705767be8d850b

SHA256
5ad60574ba9ec384767972a6e14c6ac9279351b4721e21f21b44a8e84840f596

SHA512
9546631f89c7439dd37f01c9a7b5eeb55cf26be0172a54f1a0bfa1c55a870d429621723546ec98b2c5bdad719bf8b871774b67ef3cbeda5cb7596ccf5453bcab

Download Submit
/data/user/0/com.eyyk.qwit.yomo/databases/lezzd-journal
Filesize
512B

MD5
f3a3d6ff21b4b3196f3c91e647642667

SHA1
f9a4957e0bd36313ea808f3cde84350c4b5e3048

SHA256
94034da17816183594c5d994a2969404b2094423cf0b3a7262191ba0f440a2ff

SHA512
7f4440ee35ee809751d35d75ec6cff9e623bf54cddf959cfc327653db01166f48a0399dacbb7b41c94c15afc33c4f8a951bdda61776b65386260f3ad626c0388

Download Submit
/data/user/0/com.eyyk.qwit.yomo/databases/lezzd-journal
Filesize
8KB

MD5
91bf249c91f827b5c886528f3bb5d0f3

SHA1
e18ad55c4b980becc49f62881cbb30b6b9c56d96

SHA256
7aad6624869d761265b0b42b8bfbf64febf61b9d227695dc49c12a4531de33bf

SHA512
95950bc446860e7824bfc116eee79265b9d20579a2990e434fa36667c616500a3f89ff379c2bca4341ecd193222a3c48db41359e318ee2da5afc1078df1a5367

Download Submit
/data/user/0/com.eyyk.qwit.yomo/databases/lezzd-journal
Filesize
4KB

MD5
ee92f7151cc9acb17b9b0d3689431141

SHA1
dfe2c36d4f9b0465f285f1e97bc492a7bc005cce

SHA256
24a6e48061aa268eb7f1495edcba7ef1ef272f8b36f69c295b4e1b19ad14c05a

SHA512
27a9147e2c83f9e4d54902b0e93667f7bfe6fe502492dc80dce1468e1d9ab6b2bee235c744dde27b7a7b6006cda5af80e0b9c6de8e50c25de1354767e1b00313

Download Submit
/data/user/0/com.eyyk.qwit.yomo/databases/lezzd-journal
Filesize
8KB

MD5
610e723ce2dcdb55e9729f62f49b9083

SHA1
de9e4965c9cc9e2a9dae21029d8a670d47c69d28

SHA256
c652d4d07b71ac790538aeb6d57910109f5b0940fa2be15f3810cb4b07077c84

SHA512
66a1ca329c5cd5f852ef0a9b8bdd2e490a2ed9f643b9fa8131d8611720e90128795937b97ad96361d4eba1134d1a0b0c9a9df6757ed3e7116bf1cfe5fa150d67

Download Submit
/data/user/0/com.eyyk.qwit.yomo/databases/lezzd-journal
Filesize
8KB

MD5
86e3426b60a617382ab326d433137f5c

SHA1
58cfa15908bfa4f081dd2dd6411ee1b49ca84c9a

SHA256
59a7a4f666712e9761740df65a8c77f85a3d931d826123c635012d46f11740ed

SHA512
7ed491d6e794beae0f8cfd860267486633227e3d9b9fba2f4d8e35b978509c5a6fecfe57b4fd6ca2a2fcdeed3655b4862c5f508024c7af4b03a42869772fa1e0

Download Submit
/data/user/0/com.eyyk.qwit.yomo/files/.um/um_cache_1718521241795.env
Filesize
654B

MD5
9cd107f8210ea67f2dce3a4d432b917b

SHA1
d43d67bbd7b2b575fdabf8d7d33056b11e9feec7

SHA256
98ff40b6e8a01e96d04cd482b2bcc9a6dafb429bb184ad3ef57f9c633f65160f

SHA512
bd7e38af2d46441f323fd1781795f26169038e91a856dfbbca0327635a2ea99c2f1419323b210027e0a7f8b288da269c2c091bdb391abda1d0bdab64639ed279

Download Submit
/data/user/0/com.eyyk.qwit.yomo/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
cacb1c74083bbbfa21618a215e787c21

SHA1
985e0a2ad4fedfe7f81ba1908bad81940fb3c7f0

SHA256
8d6cf0ef595d1c25d16a913468f5b9d1693535aa83c9b262df8420be65d9f599

SHA512
a3092f926b65e847539aca9e2733695372307d7fa1e6b9f9536d626d66caad1b10ead1c414729c1d4cf3159c1b7e1563e5509b03e9d0b2959ea2beba3d1d0c03

Download Submit
/data/user/0/com.eyyk.qwit.yomo/files/mobclick_agent_cached_com.eyyk.qwit.yomo1
Filesize
797B

MD5
619a39b2a5c0d3ad289583ee6526e301

SHA1
4c707e43ca2cd9cdf4c4f691b316663d4be7cb71

SHA256
0d89e082e88d2decede22844307e0ba0ec801228b24b589f3e3d49f1e7fb7b9a

SHA512
6fa6b74d87951b82ad06ace29b64f83d50dbfd16d5b9a6e5e0ff8594d060bdbe51ced532a781c4be146a916cad3ea30e601fabd01bb4383490e016a5c6cd8f77

Download Submit
/data/user/0/com.eyyk.qwit.yomo/files/umeng_it.cache
Filesize
352B

MD5
c23ad7b1368b1f3faa31c962e6967830

SHA1
6fb1706ae3d42b66696f31a9103dd623d7a4863d

SHA256
7a35112a0b57ef43ce183d5d8b0be5dde784c4432ceba43a3a25918a9f948bb4

SHA512
3b5c6ee66af062f4364b5372cad6c5e2587d73f1916b7df5e736cd8aa9fce89e322a0f054e46ffaba03164b74b7fd6d294f55aae9e77264e52848e7bbbc56e39

Download Submit