50e079b51d035e383473bba56db1d25236be67efe6497ff23fdfa1e04d9efe6b

Analysis

max time kernel
179s
max time network
150s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
17/06/2024, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8a865ed2a6bcbe0edc5fb02701b2eb8_JaffaCakes118.apk
Size 637KB
Sample240617-pt7gfs1cmd
SHA256 50e079b51d035e383473bba56db1d25236be67efe6497ff23fdfa1e04d9efe6b
MD5 b8a865ed2a6bcbe0edc5fb02701b2eb8
SHA1 f2b3895038ba8746a2adff40bb455df252df6aea
SHA512 04a17ca50b3a6c0c7d96a9e5bbbe9972fde11976c1ca5c4a34e9ddb01708bafb8c6cc07f500b3ecca443d48e65363a5d16eb502845c6d70c027955ed18379d7c
SSDEEP 12288:TF4L4oQI8Y0FotaKIUtrbM+D954vqaHoCoxKI2AKYnIRIB0gXa46iyeFxGMr+94K:FoL0otaYtXMEWHHMkI2on/B0gXa46iTk
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4258	com.twlq.nyhu.iats

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.twlq.nyhu.iats/app_mjf/dz.jar	4330	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.twlq.nyhu.iats/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.twlq.nyhu.iats/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.twlq.nyhu.iats/app_mjf/dz.jar	4258	com.twlq.nyhu.iats
/data/user/0/com.twlq.nyhu.iats/app_mjf/dz.jar	4373	com.twlq.nyhu.iats:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.twlq.nyhu.iats

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.twlq.nyhu.iats

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
37	alog.umeng.com
11	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.twlq.nyhu.iats

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.twlq.nyhu.iats

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.twlq.nyhu.iats

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.twlq.nyhu.iats

com.twlq.nyhu.iats
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4258
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.twlq.nyhu.iats/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.twlq.nyhu.iats/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4330

com.twlq.nyhu.iats:daemon
1⤵
- Loads dropped Dex/Jar
PID:4373

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.twlq.nyhu.iats/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar.cur.prof

Path /data/data/com.twlq.nyhu.iats/app_mjf/oat/dz.jar.cur.prof
Size 525B
SHA256 5b1f152216ff4baeb73475517fa1a42d08eb1e5a9092d101cbc222b347cee548
MD5 6f89d87c42a16fd3853caaee8f7535cd
SHA1 6c3d4fe3e7e268b284b1cd3557f45599dc4c1752
SHA512 765358f645b0afed249f5066db7c10a02480a7c572915e1853c85557ca3fc436e3a5267fc0216ce8b584752df4c6615862af5583aac7bb97e4a27ace8ea41547
MD5 SHA1 SHA512

Submit Download

tdz.jar

Path /data/data/com.twlq.nyhu.iats/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.twlq.nyhu.iats/databases/lezzd
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.twlq.nyhu.iats/databases/lezzd-journal
Size 512B
SHA256 7654194f376443e5376cf8df7791471b67aee769b649012584c86efc7f8ea89e
MD5 925b28cff6ae19a618b730ec7fcd5bfa
SHA1 883671156a4c6145d6dda9bf54ac3c4c74c45b95
SHA512 51cddd053554ebec83b845d7b267221411e50af263a30cb4dddda434209869e39fe06ca622698b50f7bc8f3a6ec2be705b01a9a79c9eea63a98b42f37891ce3c
MD5 SHA1 SHA512

Submit Download

lezzd-shm

Path /data/data/com.twlq.nyhu.iats/databases/lezzd-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-wal

Path /data/data/com.twlq.nyhu.iats/databases/lezzd-wal
Size 60KB
SHA256 9138a6276854a0bb0ccffc9e2b1f07c506244f0bb4ce73b4b0f5b81dc34333d3
MD5 1387d37a42c708937c10111c0cb92bd3
SHA1 2a1b4b225ebf02e85e2780a54e4ee75c6a7a76bc
SHA512 4cd8d52e9c92cc8c370b4b246e0704e2fef8743b82903a58b26c0554b166f088b8eb1dc8a2600d2f42ea6cb296934a609b723d38c4557d9e69363306b007de24
SSDEEP 48:uzNSP/syz6SP/udUkthaTwnSP/ZBtFXtUkthaTwnSP/krukS0FXtUkthaTwnSP/:m0PkC/PDpPTupPvkcpP
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/data/com.twlq.nyhu.iats/files/.imprint
Size 1018B
SHA256 522e07356091fe15b9167543388e48ff93b32d02e85167be6f8d70198a8660fa
MD5 9d8e82d48f15f2c860b5208663d56109
SHA1 41383598050d741ea0a68a5fceeea908b8d3048b
SHA512 2b5f4f15f9c510f9145b4ce81163aea47dfc6831ae79aec061ef369b270464b0d271e34b927c8f4f924ad877075d13c6bd8d165d9020bda25a46cf65cce596c9
MD5 SHA1 SHA512

Submit Download

.imprint

Path /data/data/com.twlq.nyhu.iats/files/.imprint
Size 1018B
SHA256 96f7689bab680c8b123d70aa11900b93af29cfb17143c751430427a9420f1f01
MD5 ef0c08e74349e347d1127ba313c4745b
SHA1 ff38051b189a9a98c4c0ca96f8d9ca51b1cc4d29
SHA512 012b2ccf7d32a8daeca96b239d0ebb17be6da7dd83a778434683dc913bd20542e3a57e1145b50131a6d34e0c9d76920ed9695b5f5a31c39cc58bb56bbfec883c
MD5 SHA1 SHA512

Submit Download

um_cache_1718627973881.env

Path /data/data/com.twlq.nyhu.iats/files/.um/um_cache_1718627973881.env
Size 684B
SHA256 534a31a269516c517998fe46a9350c016092e564a9cd5a3cde5791702bc1d835
MD5 4bdc51b4dc43d2aec5f3773cb4e149ba
SHA1 2462ffd6f9fbde46ef473d562579ab32a749714a
SHA512 b085b55e04e31f909d08b905d08380dc43af126c1d8a7286f19bfd2f91b990f08bb14f4087587b3642e41924739a62ec9391a9ec4748770c6269eeb7b2d12739
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.twlq.nyhu.iats/files/.umeng/exchangeIdentity.json
Size 204B
SHA256 d6aa13b20eac0ecb3f1c20cb693c2651529acf805b0aee454132594241c2eca9
MD5 e6d95869792940445ac3e451b28522d7
SHA1 66fe4e2142b17c8ae3716427267090b033cc728e
SHA512 bbe209ef63d4816455d863b889c89175616e2040d3a90ac6f889f1034356ed249c4ca451bc879050e1e15aaa0419670ed6fdab49557319762b9732e6fc5885f2
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.twlq.nyhu.iats/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 567cb47408d2204821a57c9d23d2466a1f9d6ac4985a7cf2e28c46cb3c7c86e7
MD5 af7e9d0dc47aa96dae35b9a763fc7ca3
SHA1 45a505ec3bef12c0d29e5e26f10779cde214a909
SHA512 cf515959b9410bb4c4e1a7e922995b3e426b805b4e9836f1dd9b105b112b8b59110cd127b5e94aabf5693922b7b2bf18f5d3a399c00b7ae05b50e6da26d35b60
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.twlq.nyhu.iats1

Path /data/data/com.twlq.nyhu.iats/files/mobclick_agent_cached_com.twlq.nyhu.iats1
Size 1KB
SHA256 b94f3e82b497f67f419d728fb5f2946a803046c1ed648c0ec4e9cd0ae6b67c65
MD5 213c1b2559cf2dc43991615f876062a8
SHA1 eb5857fdfd8063a784c7bb17c80798319a771927
SHA512 bb285c5bf30f752fa57be3f0c23a83edebb5cd075a649a93cf8852bc3f7dd31510205c9dba9dc2d30381fa2d9ac5a8e69fc8fa794aa9c266a5ab5511dc775233
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.twlq.nyhu.iats/files/umeng_it.cache
Size 211B
SHA256 15415a05418b62728cf480ece7e85a1274fb9cb512476f808fac305101eb7305
MD5 166e86cdc9c53d765390d2e37ef3a1cc
SHA1 34e7b17323b85d83bedf3272e382e69b2c30c298
SHA512 0c6aee5e958a55a549fc3622314245687008dea3262b46ad8733f2ddc5a7458ecd156b1f9940d9954abae92ae3b6ea31110eb16d448acf5855da86ca17742433
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.twlq.nyhu.iats/files/umeng_it.cache
Size 415B
SHA256 1217037e9de03a81d2e8c46e4c49df054d4d302f077413126a7d56efba40a702
MD5 70adc656362afbe4ba39274b0e09b0b8
SHA1 07c9d37e33457d9910e7bf674e5ad807fc15e788
SHA512 3cc970c5a0d7ce907a3b460bcf731727af58e4573609a6a891c44b7164befd729b67c7ae22e9a558fdeff097ab38f71e7449f3b8d3365b25102f4b95b737ff60
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.twlq.nyhu.iats/app_mjf/dz.jar
Size 248KB
SHA256 30d7699b73fd7f276945415c405c12bff69c5958d12f56265a768443f6fd8cae
MD5 9b47e78a6ff90cce5755ce4742047627
SHA1 831b24aa9e116eb8d7065efd430088d419dfd6c7
SHA512 4587a5b26f13cbd0524eade71ed29203fc55029fe150fce850016aa7d9c578623cdc4b6a551bed3dec9e31a39563f8927cfcc9d21e2d83c2c781808b958446fc
SSDEEP 3072:No4SBiL5O8+ZfL6xlz50/zbAWGYXojtG9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6x77WG8ojtc5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

dz.jar

Path /data/user/0/com.twlq.nyhu.iats/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads