9da270257a4a4dcefe0f75221baa1f39d0c63e2a4dcc50b1bebd02f0c98ceadb

Analysis

max time kernel
178s
max time network
187s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
16-06-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3df3bed219262ac41a292c793bca25d_JaffaCakes118.apk
Size

637KB
MD5

b3df3bed219262ac41a292c793bca25d
SHA1

cd16a1046935d2c1bdf92ba789c08624bbe3175c
SHA256

9da270257a4a4dcefe0f75221baa1f39d0c63e2a4dcc50b1bebd02f0c98ceadb
SHA512

b854065e6408ca9a9af4f0365e9f416e7f82da35b135f35ac7f52237f553e43d45c21886562fb554f0125ea9cd7e69cd1921ea1e18462131f5c23714cb909346
SSDEEP

12288:d4L4oQI8Y0FotaKIUtrbMN1y/gfOdFskKkaeFx2Mbe94vvQe6ERylTUr:JoL0otaYtXMT5Ogk78MiiydS

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.xzwt.lhyr.lkce

pid process

4484 com.xzwt.lhyr.lkce

pid	process
4484	com.xzwt.lhyr.lkce

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.xzwt.lhyr.lkcecom.xzwt.lhyr.lkce:daemon

ioc	pid	process
/data/user/0/com.xzwt.lhyr.lkce/app_mjf/dz.jar	4484	com.xzwt.lhyr.lkce
/data/user/0/com.xzwt.lhyr.lkce/app_mjf/dz.jar	4560	com.xzwt.lhyr.lkce:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.xzwt.lhyr.lkce

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.xzwt.lhyr.lkce
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.xzwt.lhyr.lkce

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.xzwt.lhyr.lkce
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

Processes:

flow ioc

17 alog.umeng.com
54 alog.umeng.com
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.xzwt.lhyr.lkce

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.xzwt.lhyr.lkce
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.xzwt.lhyr.lkce

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.xzwt.lhyr.lkce
Reads information about phone network operator. 1 TTPs
discovery

T1422
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.xzwt.lhyr.lkce

description ioc process

File opened for read /proc/cpuinfo com.xzwt.lhyr.lkce

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.xzwt.lhyr.lkce

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xzwt.lhyr.lkce

flow	ioc
17	alog.umeng.com
54	alog.umeng.com

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xzwt.lhyr.lkce

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xzwt.lhyr.lkce

description	ioc	process
File opened for read	/proc/cpuinfo	com.xzwt.lhyr.lkce

com.xzwt.lhyr.lkce
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4484

com.xzwt.lhyr.lkce:daemon
1⤵
- Loads dropped Dex/Jar
PID:4560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.xzwt.lhyr.lkce/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/databases/lezzd
Filesize
28KB

MD5
fdb8a92e5060ce104e8f0faca55a47ce

SHA1
270d7ca30673e18cec1d2b9add71cba96dc426fe

SHA256
194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a

SHA512
ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/databases/lezzd-journal
Filesize
8KB

MD5
8c4da1d777083a05e28842e4a316c90c

SHA1
a61d76b890dac4aff1dcb08204788bace6a4414a

SHA256
45d09250d082ebc6c7eadedd1269772a55c5db5d563e6ed014c22c2efccf9608

SHA512
d049c87b95c67dd6d185fa1f41599d4c61c31bd4464f87f8c4a71204516307d8901e175b0c8ce5991baab0427a53b7b7d83a4db358c63bfc2c1d307714c9be72

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/databases/lezzd-journal
Filesize
8KB

MD5
29eabd37cfccae2271432b7e0665e270

SHA1
70fc3e1679ea159c7bc5f525764308ef65b03c88

SHA256
53feafc3f141ccd73a94b52368177fdb686a8f40717db24b78fa05e36c7850af

SHA512
ef418c12739cd181f82b7fb0c6208f9db8d1c894c7b8446ee414812aa18e2a876212937f20789d0614eaff91c8c3a02f88edd08dce7f11a73ed033f720d4b2de

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/databases/lezzd-journal
Filesize
8KB

MD5
0279c79cfc982ba87c0f799ef807a9d1

SHA1
9c52e8289163d3997f026b40bbf634f9cc7321dd

SHA256
6de5087b0eeb59fcecf156c63f85eeec5e4ba1935fc9ae1dc0b8913ce0936202

SHA512
dd148b68ac7f1ede0fafeca70bcc0657958d8f07568f298f14e54846f0c1e1ec187e506ed7864d831191be4f96aead4bd15ef5873039d6c44eb767457cf18ce1

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/databases/lezzd-journal
Filesize
512B

MD5
36f2cc2ff6f63118963c1e97cb241b29

SHA1
bb6d59783f86eb5febda96ba34ad56f6205fcd85

SHA256
a84901bdb90c3a0f984fd98e43f5fea8c73c9416d4b4b54fdf9ff8c8e253ef8a

SHA512
644e5a75c356dd7678f476145a8559e713df851892271ca8544f5eb209e3c28e9a87bada045170cd5cb5bfa6af85bd460e58b779a30c2cd70a5d102384d91372

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/databases/lezzd-journal
Filesize
8KB

MD5
e6dbeb9cda76a42cd6538a696d895106

SHA1
d07157b650af690758e6e1998648f48cf7aba709

SHA256
6e0871143b423bb8ed7011f9246237380bb9ba62ffd1f0bfe293abec360046ea

SHA512
e4a478d76fc2d37eb6738abaae5fcd098d9f4a0fa109ba70c891ef706a2ac69f10bae00e2dd51b8c6561550906b794f35630b614874a283bbdfda9570aa5582d

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/databases/lezzd-journal
Filesize
4KB

MD5
c38ac524a3e93e7f345015e874e0d9b1

SHA1
6e52ba235a6d221fccadd481d172bb2f391c802f

SHA256
84c9e68921e4bfa2b6e290c8812039a4e8990c8c2d474a7c1c94f48903320e3f

SHA512
ffd14afcacd35aa087dcbba3d91e390412a36f012aad6c4aaf79a67031074bfd86aed2f08f30557dd241f9cbfbb34b03b60f09256f064421b12840165b9522f1

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/files/.um/um_cache_1718546480092.env
Filesize
660B

MD5
619c4cdcf45b590e8d51b2494976d3d5

SHA1
005929fc179f929785e6720405213b0141b166f0

SHA256
cd68f2a8986f048d188186e8b0f05f7e529eb5e67e97f0ffd4fc4ea790eb0d56

SHA512
3bcaa39fc941515e9bc518c8134c70d2aa2de322551b03cbc9b2c9dc10eb681f6e5d9bfc4fcadd75c7f484cce7ec5b2de395436e5f075a40c23851f0c61d4316

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
e5d62a2ffc698e35289397fcf0b99b23

SHA1
54f5326d5ce65949a3a501993b0e7d4b930787e4

SHA256
6d7281139883f0d0bd2fc0b4befe4389d37193753f62a0e4235e3ef9d7e6658d

SHA512
e53b9e800bc597807eaed5bd48c1e3726f9149333d5ab582e4fe7cf8bb1ac9cfc2074897650ff5e885fa6958621c5f9fb9f903877aaf191aa814e5186ac7508e

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/files/mobclick_agent_cached_com.xzwt.lhyr.lkce1
Filesize
806B

MD5
748d663c4b953404e7bc14815b41f8b2

SHA1
b70daa3f0400cc7e25c546a516f37ae366a874ac

SHA256
a4fdbd3657bfe5b8065ad4450df5760b90ff11f2cf89aab4328c5f7ccc88b8dd

SHA512
e86bb281bee13ed704d1294aa956699e2dd89d7a46e204654a05ed5a0bdb57b992c55d22901f5df9a626f5f667c5009d3e9c42d9760e3ef2d859bc83fbc93042

Download Submit
/data/user/0/com.xzwt.lhyr.lkce/files/umeng_it.cache
Filesize
352B

MD5
49b9831ed76565000a6b4bea771346d3

SHA1
b88b50181b35a5b6f59e66fb02bd910d10adb884

SHA256
c506d9dd8838a8e5a8157020200ca9a163b98ed6aff0bf3fee1c73212f92440f

SHA512
f95bcf9b6c1cf2b1e5224ea78c6fafa12cb9ceece89df35686d2d602d644920f72a3b8ea6d1087bdc33526e5886e034c3f98b9b17a0e625c83daed59cdad9c2e

Download Submit