50e079b51d035e383473bba56db1d25236be67efe6497ff23fdfa1e04d9efe6b

Analysis

max time kernel
179s
max time network
167s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
17/06/2024, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8a865ed2a6bcbe0edc5fb02701b2eb8_JaffaCakes118.apk
Size 637KB
Sample240617-pt7gfs1cmd
SHA256 50e079b51d035e383473bba56db1d25236be67efe6497ff23fdfa1e04d9efe6b
MD5 b8a865ed2a6bcbe0edc5fb02701b2eb8
SHA1 f2b3895038ba8746a2adff40bb455df252df6aea
SHA512 04a17ca50b3a6c0c7d96a9e5bbbe9972fde11976c1ca5c4a34e9ddb01708bafb8c6cc07f500b3ecca443d48e65363a5d16eb502845c6d70c027955ed18379d7c
SSDEEP 12288:TF4L4oQI8Y0FotaKIUtrbM+D954vqaHoCoxKI2AKYnIRIB0gXa46iyeFxGMr+94K:FoL0otaYtXMEWHHMkI2on/B0gXa46iTk
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5010	com.twlq.nyhu.iats

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.twlq.nyhu.iats/app_mjf/dz.jar	5010	com.twlq.nyhu.iats
/data/user/0/com.twlq.nyhu.iats/app_mjf/dz.jar	5109	com.twlq.nyhu.iats:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.twlq.nyhu.iats

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.twlq.nyhu.iats

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
57	alog.umeng.com
9	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.twlq.nyhu.iats

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.twlq.nyhu.iats

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.twlq.nyhu.iats

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.twlq.nyhu.iats

com.twlq.nyhu.iats
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5010

com.twlq.nyhu.iats:daemon
1⤵
- Loads dropped Dex/Jar
PID:5109

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.twlq.nyhu.iats/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar.cur.prof

Path /data/data/com.twlq.nyhu.iats/app_mjf/oat/dz.jar.cur.prof
Size 611B
SHA256 7d214963e4eb2d2fed4efd05cf7f05440d6cacc3e760499286aadfa2e299b059
MD5 f4f951705ad4f6c7ded344849e939d07
SHA1 ed0104775b2106d78c6687d1ac189d0607c89ed2
SHA512 5b6a36b0a8f0fc1dba3a554499d20116deec2ba2715ca6d8931fb4f3b543651e959d91a94de99546819d6e3c567cc095a700c98c5a2176c88e8b427d797cdbcd
MD5 SHA1 SHA512

Submit Download

tdz.jar

Path /data/data/com.twlq.nyhu.iats/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.twlq.nyhu.iats/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.twlq.nyhu.iats/databases/lezzd-journal
Size 8KB
SHA256 98b4f539bc674a4dc3ea6c8355133e69b2dbf4da4cf54311a6f424999dcd0336
MD5 b4ea3aab3323328a54ce576fbeb82db7
SHA1 106bdd6736bccb7693f9a324239b4370bd8999f1
SHA512 781b36874286291074d6c7cffe0b0ae936da60e33ff74fcda4d4c340bd250a2e917cc67b3e5c07f0e842ab67a34f3f0952ca217bfd84f80877a45a43616025ee
SSDEEP 6:7+/l9+Pg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKL/hZn:7+tUqLmqCRmBEyPbIP
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.twlq.nyhu.iats/databases/lezzd-journal
Size 8KB
SHA256 605af55e29ff3cb15f292afe84b6778816ca0e329fdaab33a5a271714e384c4c
MD5 91f3a114633c9489e5bfca0bfef1eb30
SHA1 be7c44b15521a2f5caec122cd56b797274e4dd4d
SHA512 62400d878313b38044d726309b89c511a7628e48859d71b03a5030ccea7fca06c2bea6b1451427e6f8d5a8b6b6184a944035eb43b8e7d1ad3da155a9f9b4ebc4
SSDEEP 12:7+tWnqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbntkXb:7+t6qLy9yUku+haaL6nwyLGSns
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.twlq.nyhu.iats/databases/lezzd-journal
Size 8KB
SHA256 ac27d72319ebf6966d5377e041ba8bc91c2a7324a13ed35409d10f6dfabc59d4
MD5 f4134178ef4d32601a19cbb43ef36225
SHA1 e49146e39c52a9b2b97f21d96f8ba20c3c5a9b94
SHA512 f2f9c1abf49671ce522b5dbf9e50238aedf718aab6d4a11436d893821ead5f95052cd8686a260e78b89710d5d696cf05563fe47bf60821afceeaddd4f8c6be3a
SSDEEP 12:7+t3tqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbTy:7+tdqLGqteszXtUku+haaL6nwyLGS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.twlq.nyhu.iats/databases/lezzd-journal
Size 512B
SHA256 6585f1c07a344e7b5e79784e69c6c03f3c7c894642ea571256832c2e5d8b8c26
MD5 dfb2cc32de710f59660c446bb118c5d5
SHA1 4664af20f805555b15f8c19620a72dfeb0807371
SHA512 4354198b0a3348607be915923f655586338ca0370539746ca799f0dc2248450bfcd80717e4fa7e5e5ee2104d0e9646b36a5a9408823f001d8f9c51557acd62dc
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.twlq.nyhu.iats/databases/lezzd-journal
Size 8KB
SHA256 bd0179705afe95e238d2eb2d52157155016b6ca83588005a708fd616530ceaef
MD5 feaeb8d44e14cc24ab2304570b112ff4
SHA1 5e658260df8e051ccf7f434f4ad14cae91135037
SHA512 e6a3b65541400846fe204a81c4c14721d20c15729a7006c0eae72d412d2ee9b139cbffd40d7517c41aa3e7423237fc02867c8ab6ce1ddd83432657ba1af50731
SSDEEP 6:7+/l9/jn1gg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKkY:7+tdiqLiuWdwRmBEyPbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.twlq.nyhu.iats/databases/lezzd-journal
Size 4KB
SHA256 b7f7c2b861bce13e14ef9e8c258d9724a15447e91e20685edde29b46002383a8
MD5 b167b855f3e1031b4b61c9b2badcc137
SHA1 308f1a33e2446c7adbd2e6b7943acb2a826874e8
SHA512 074d9d7dad242230e60c5a7c61fef474f6d0b5ceaed30d30641497e763b970d9a6dbaae013175148636daede46170e5650e4c2f6f9cabcadbb9dafbd8ebea0f3
SSDEEP 6:7+/lr/Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKUn:7+tDqLJdTRmBEyPbf
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/data/com.twlq.nyhu.iats/files/.imprint
Size 951B
SHA256 41db3214f6233c2caf4630e1f127d168c72d2e9073cc2692d845489cedb29858
MD5 a0b6e5a777d68682a4c9a5803b53af4b
SHA1 50accb7d85bd132688758e43c0d2d6d30c82c246
SHA512 6911ce79d73a024ffb6ec0c9f489df046c84ba035818aea2f4b843da07c98f7ac0df17eed4a50583949c0faae76b88f32833d77e2c51892c6ab4086bdf29a5db
MD5 SHA1 SHA512

Submit Download

um_cache_1718627973481.env

Path /data/data/com.twlq.nyhu.iats/files/.um/um_cache_1718627973481.env
Size 657B
SHA256 213812c4daf269e410e9427a3b28e395639c132bad10213ccbee2d378352609d
MD5 2a80f0c8ba4dc865f57b2dda4b08fff0
SHA1 38cb90cabfa6980e27eb37f5fbf0c6c3d807a93d
SHA512 532fbce02ec897e5d38f0a9a531b0249adda17c436727a171351bc6bc878c6e028e8b5cc3505dc5f4dc20627b568a1340a896ceecd3ccb735f201285203c7da4
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.twlq.nyhu.iats/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 af0b83a5ed2093f2cc6678d360b9c053206c9edeb10adac76aa4018d60b6c86e
MD5 e582a3dad9f41dbbe5476049e9bd3a84
SHA1 04c3da02cccf6981d6a2c7b0e7be495826360731
SHA512 58836bddf9cd3f1345a24d15915a9ec66c9b7c3aca365811892abbcbfee42be109f2d52839a6f176357d5dfce4c992829ccd6f5b55048cc140a691c5e1de1405
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.twlq.nyhu.iats1

Path /data/data/com.twlq.nyhu.iats/files/mobclick_agent_cached_com.twlq.nyhu.iats1
Size 806B
SHA256 1f040232b9054a7a1ad693d06fded64a072ef89a10836598eeb9272ba2c589df
MD5 945305236377760c8a38bec0e25928e0
SHA1 790bc737e1e7240ee4775956524046e91662ca18
SHA512 1bb1244517098ff9aaec4ca2f6973beff03c536ff18add447b3733388525af66ed1feafcb2e769c8aae982e96375de2299f86612d13443f6bb89158386a3fd60
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.twlq.nyhu.iats1

Path /data/data/com.twlq.nyhu.iats/files/mobclick_agent_cached_com.twlq.nyhu.iats1
Size 1KB
SHA256 4b60d8b14b9dcdb7bbcb418e4db6da8887f4521b3c690306ad9d42b48d5ec866
MD5 9b7d26ba46c409629fd7c2508cf48ec9
SHA1 f09d83717db3cf469e87934a7ae429e578b7dd1f
SHA512 80dc7f890dfeffe433ff3370045812b01be1bb5df15b4215bdf860d6cbf4e282c54e5a8cb5ffb99c0ff2609b8d8eea5cdd66779a4975cbce9c9326d6ec0904ff
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.twlq.nyhu.iats/files/umeng_it.cache
Size 352B
SHA256 773116c1ffc36dc26176061d02accb122cccee274a294286af27e852f4d8e1f1
MD5 7b7f37f54d194bf913ae3f47defa6b66
SHA1 562ef92f22d3f5636e70cf0922cf121bca97e151
SHA512 4ab1ce44703e70cfb1d89a711a2acd59e16d601a4101803b12ac2046760d005d6a973165617e5087f6e0eec835f6934a3fe7a7db4da185b9d76d00b349469b3a
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.twlq.nyhu.iats/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads