ae39258fabc1d1c9fecbf14f3fa89a3bc05a594232fa5834387c5da8dbde7ad0

Analysis

max time kernel
179s
max time network
179s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
16-06-2024 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b242dacd925c411494a4fca767074937_JaffaCakes118.apk
Size

1.3MB
MD5

b242dacd925c411494a4fca767074937
SHA1

706661da33b94806a3ab8b045a520f55ebbaf721
SHA256

ae39258fabc1d1c9fecbf14f3fa89a3bc05a594232fa5834387c5da8dbde7ad0
SHA512

618a19fd21461f9771ebe7ae97132d6a35329b626a82cff49495fd750e88211c78492845ed634007b9adca3556946ef51de6d6df13c8c51e1623bc3a6276b887
SSDEEP

24576:L6cEoL0otaYtXMdSprkM4FqD5Bl0ZHqU+ojfo+x4jFwXq/13tdHbZKm51Ob83e:LhQ7YtTrkruBl0ZHtjjCjFwXq/1XHNKX

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.kczq.yicq.anbe

pid process

5110 com.kczq.yicq.anbe

pid	process
5110	com.kczq.yicq.anbe

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.kczq.yicq.anbecom.kczq.yicq.anbe:daemon

ioc	pid	process
/data/user/0/com.kczq.yicq.anbe/app_mjf/dz.jar	5110	com.kczq.yicq.anbe
/data/user/0/com.kczq.yicq.anbe/app_mjf/dz.jar	5239	com.kczq.yicq.anbe:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.kczq.yicq.anbe

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.kczq.yicq.anbe
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.kczq.yicq.anbe

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.kczq.yicq.anbe
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

Processes:

flow ioc

39 alog.umeng.com
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.kczq.yicq.anbe

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.kczq.yicq.anbe
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.kczq.yicq.anbe

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.kczq.yicq.anbe
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.kczq.yicq.anbe

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.kczq.yicq.anbe
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.kczq.yicq.anbe

description ioc process

File opened for read /proc/cpuinfo com.kczq.yicq.anbe

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.kczq.yicq.anbe

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.kczq.yicq.anbe

flow	ioc
39	alog.umeng.com

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.kczq.yicq.anbe

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.kczq.yicq.anbe

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.kczq.yicq.anbe

description	ioc	process
File opened for read	/proc/cpuinfo	com.kczq.yicq.anbe

com.kczq.yicq.anbe
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5110

com.kczq.yicq.anbe:daemon
1⤵
- Loads dropped Dex/Jar
PID:5239

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kczq.yicq.anbe/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.kczq.yicq.anbe/app_mjf/oat/dz.jar.cur.prof
Filesize
727B

MD5
23c181a2d36eccbada96c4a58386ff94

SHA1
4cc44adf7fd391ba6474547827d07722270af8e5

SHA256
562322ecfb89a7d02c0bd6a17a66cd1f96c81ec7bbf0e322bce177358f74307a

SHA512
59429c8524df4f4d1d1e2ca1c507f41a82364f2c455aed7000dd95191b5d47da4fc8aba9cfa7439bcaf7bffdaf29f5d550efff8bc06d432e179620c95ab90857

Download Submit
/data/data/com.kczq.yicq.anbe/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.kczq.yicq.anbe/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.kczq.yicq.anbe/databases/lezzd-journal
Filesize
8KB

MD5
41087661c32934c6896d151ee8b41eaf

SHA1
f51e0588d91aeb6ebcb1bfc38087b9a6da44514a

SHA256
93cd7bfbe9f0ece3045d25fd468a66987070a8ee09f15996f364a95827856552

SHA512
937e1ae97f5704f2c991182bbac7df68ba49aeb831d87affe2179ee15bcf6407662c3ee73dd22dd71056b04447d881050abca8ad4f57cd9dc8f3741a46dbf0d1

Download Submit
/data/data/com.kczq.yicq.anbe/databases/lezzd-journal
Filesize
512B

MD5
45fe68573fd9b5c8619a8b206b469aee

SHA1
d80f3ab0c480974ea5d18de5f39dddce08ab6571

SHA256
8f79e0be56ae4b14a916d5ce2262e914de4a25861f60f8e45dc685431ae75ae6

SHA512
d0532c7317c0ea9184d630d88092f9252f7463741e761f7dde66b30eaed994f2d524004ceee79de9b0c17e6de3c94c96460f581831c032530b53807bd156a491

Download Submit
/data/data/com.kczq.yicq.anbe/databases/lezzd-journal
Filesize
8KB

MD5
c8c31dd9426d41b29d7811aeda022e27

SHA1
8e6164c6ff6b19838d47daaedaafd8b955ff0d13

SHA256
a200fce3375e5f8132b6328277e8f88dc6e6cf541c88e7aa7826e7eeddbb2bf4

SHA512
3b8d38303aaa765bacce8a2545908f8ab71b9d00acd0234e0fdb578bdf8e5fba5408f4ea1e1c1d6b131efc76859d0c854e52489ecb5f0f648fb01724cf33021d

Download Submit
/data/data/com.kczq.yicq.anbe/databases/lezzd-journal
Filesize
4KB

MD5
1c7aaf37676fd93dda25e04b92e81ba9

SHA1
2e4f8be08c32daed5b64d26b27b98d297a232cdb

SHA256
1bad738d951789e5d7b87a21d9573c52f57725d0f101c9a7207c7a099d1fe0c8

SHA512
e0b63bcad9766358a9e9030cf3d73003e13af37b355a664eeb39e46f129b9b58154341d1625125511157b07aa43dc1f53979f3109a220c0def5cadf6b510ba54

Download Submit
/data/data/com.kczq.yicq.anbe/databases/lezzd-journal
Filesize
8KB

MD5
4e18075f221f226a15c4d886875458c7

SHA1
c9300f2e560066f7b4c997793f8441a30edb6692

SHA256
a094cce04399cefab7ddc888b3d828f66f0f7f73580d93c1f1ebfee4e6890877

SHA512
b8732bb1db85e4128bdfa0ed303de5ad084d36cf2650c769e71670c629ab119fcd128ecc574ab648b016736561bf2e44b4a3a7ce664c4cf7158c887726d3cff4

Download Submit
/data/data/com.kczq.yicq.anbe/databases/lezzd-journal
Filesize
8KB

MD5
891ee4041ccca736d789b3ac10bf00bf

SHA1
a83f0813b765514377d4fa7cf93c2203d7dbadba

SHA256
b6fc4b9ca50632786729468798a7290f28e0bdd820eb386e25f5f59579074ffd

SHA512
d2a8997e19ab970dc623830058a52b64d4e126f244a2e9cc4b35bec92865616c7dbcd855bb4109459a6cfddbc344d359e6bb88664d26564b78e69f19f706dd62

Download Submit
/data/data/com.kczq.yicq.anbe/files/.um/um_cache_1718521488268.env
Filesize
651B

MD5
9eb68755e5687941cb23e4152cb800b8

SHA1
6b0d18eca99572fa89faa0834cbfa24c355d316d

SHA256
426ef94ed70663854e43415717777f5614cb2b1bd84bdbc52b429db21292cdd8

SHA512
ab262aecce3edba434edfb13a6a1564a2ec541ba65c98cdbfb40de6bb81b1b5d60127d78da4aaa3f166608ccac0dcc4fb77c48e155fc143c603fa8bc006df5c1

Download Submit
/data/data/com.kczq.yicq.anbe/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
3d6f5e6a5dfd130bf3b1f742b14bd48a

SHA1
377aa690868be97dc963bedc49a51c04a2376deb

SHA256
ac818a5a091c035f3a8b3188a23de3a23ff61e097e1ab265a0a916c4d514e7b4

SHA512
b04521d211e715a7faaaaf49fb6a75cbb02c2f74731aaa24dc94b047a0119fbbb953082b2fd19b0547f32256bd5c8fde1698cc186127969b9d9599239fbdcad7

Download Submit
/data/data/com.kczq.yicq.anbe/files/mobclick_agent_cached_com.kczq.yicq.anbe1
Filesize
794B

MD5
86e11a42b99b07e334fcb64cbe439c90

SHA1
228e96e3065b9a94aafbf210f053fd8832611e26

SHA256
4d4df65777baab57c4dd6bb424ca1dbcabb1c3682f546fd4bb94314c8a241c1b

SHA512
bc93fe790fcc15bc8cc855f2d02e3b10f17a37619b5e4faf89ce60b1153bb32f078be370c822dbde53202b08ad892938d72967606c7520a5d4a810a7d56a1369

Download Submit
/data/data/com.kczq.yicq.anbe/files/umeng_it.cache
Filesize
350B

MD5
b583f5f0ac60e5b6f97e68ebf0e99839

SHA1
c70cbc5d0d483d5518825253c378c43f30c36176

SHA256
855b04df625da03d96f9bad3cb1dc2b9bd3a34a094bb9098f11bdbd4d77f1030

SHA512
8647622c90f82c49634f2bd75f10efdce22fe6f23fec1da89fd248b4a7aed651aed192fb58be6a86b080411b568b904defa6132a28be605c62bcc22e481cc2af

Download Submit
/data/user/0/com.kczq.yicq.anbe/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit