42cab9ed3a3489aceb14bd7322784560c2f48f01817fc6c4fea1839a99fbcb6b

Analysis

max time kernel
179s
max time network
150s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
25/08/2024, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c1cf21119eca74e5b46ece90ab8ec47b_JaffaCakes118.apk
Size 1.3MB
Sample240825-3dnw3ashmk
SHA256 42cab9ed3a3489aceb14bd7322784560c2f48f01817fc6c4fea1839a99fbcb6b
MD5 c1cf21119eca74e5b46ece90ab8ec47b
SHA1 b8167f0dc5aa3196b535bddd63643402229c8912
SHA512 fb47af4670d7192f0dbae23adde30a9232ed06538c62c8b6423c2ef955e4138459678ded0c16f0340624dea5b02b84ffcdc1eb3fa004b82b41efbba270dea67a
SSDEEP 24576:ktcEoL0otaYtXM7SprkM4FqD5Bl0ZHqU+JjPo+SkjWByq/13tdHbZKm51Ob83Y:vQ7Yt9rkruBl0ZHUjzbjWByq/1XHNKmA
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4640	com.dabv.vetu.tvbf

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dabv.vetu.tvbf/app_mjf/dz.jar	4640	com.dabv.vetu.tvbf
/data/user/0/com.dabv.vetu.tvbf/app_mjf/dz.jar	4697	com.dabv.vetu.tvbf:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.dabv.vetu.tvbf

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dabv.vetu.tvbf

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
36	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dabv.vetu.tvbf

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dabv.vetu.tvbf

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.dabv.vetu.tvbf

com.dabv.vetu.tvbf
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4640

com.dabv.vetu.tvbf:daemon
1⤵
- Loads dropped Dex/Jar
PID:4697

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/user/0/com.dabv.vetu.tvbf/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar

Path /data/user/0/com.dabv.vetu.tvbf/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

tdz.jar

Path /data/user/0/com.dabv.vetu.tvbf/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/user/0/com.dabv.vetu.tvbf/databases/lezzd
Size 28KB
SHA256 194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
MD5 fdb8a92e5060ce104e8f0faca55a47ce
SHA1 270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA512 ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122
SSDEEP 24:TLj0kSBieszXtUku+haaL6nwyLGSiGQQ:TskS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.dabv.vetu.tvbf/databases/lezzd-journal
Size 8KB
SHA256 9621cd49b402a44a6e64cb94c49cf2e8ab782958acbac2ffbe1506822673419c
MD5 6a42a2ab6fa462d942e0d6ed18774f1c
SHA1 357c49be67b9f568e8926c1a3ce225908ec4ae30
SHA512 120746976f3e829dd3fcbd50b8fef82e050f9bfdce9b73046e33525c8cb51dd9c5141d8bc01fe644e661092586bdfd4c1052fa65f6edf2fcced3506e92eddaff
SSDEEP 12:7+t7qLWem6QADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPb55d:7+t7qLu6teszXtUku+haaL6nwyLGSu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.dabv.vetu.tvbf/databases/lezzd-journal
Size 512B
SHA256 eeef5bff346d6c5c67da0666949e5c980377fe066254ba7b3542d46b967fbc40
MD5 d72ae10f0062ca4d9bd8c3e0146738a4
SHA1 ca01065c70360e415e24a8e58300be655bafb17d
SHA512 cc8021215a0d5625565fa99ef6dd052f19fa877934cae9d6404aad52eab76a8784c00ef2ead86357a41e2e36e7a61f04c6e4092f344ced04d03374fc8e2d4d46
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/user/0/com.dabv.vetu.tvbf/databases/lezzd-journal
Size 8KB
SHA256 6d4860f2f631ce62ff00c66397724ef326ebf6cd96450baa90968cd78d27384a
MD5 fb120ccc7daebe433d17bfeed7effbc5
SHA1 add9a54cd1f6983e85138e188c0a7d3eeacfcdca
SHA512 5c25e0e44057866681eff0ba4eb9b1bea9c643bf2792d17a6c89a24c241b6f2c0233f6301854246407dd5d61dd899fb73cee4ed2e5d673f239b39b5fb2b545d3
SSDEEP 6:7+/l9sA+n1Jhg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKU:7+tGhqLiuWdYRmBEyPbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.dabv.vetu.tvbf/databases/lezzd-journal
Size 4KB
SHA256 f811653bbb32d233b9d32d6f49e0c9744995fc60a41611fc83247d7a5aa860a3
MD5 8ebd804ede6ad1fcf09238413f2e47e3
SHA1 d989664ae7591fec07dac270b8a593e22b564a28
SHA512 18f69c03bca4044717b163faf0f76f249e03b25f164d70fd3a8a7f5d76c2d8bb588a8b259822c2a3f63244a04bac47f24cf483265aad736f0c2d73ad9bcabc43
SSDEEP 6:7+/ligPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK6:7+ti4qLJdeWRmBEyPbl
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.dabv.vetu.tvbf/databases/lezzd-journal
Size 8KB
SHA256 7bb0e9618ac712cfbfd99f350c083a8867201b94dd14d662a21b11a57f356406
MD5 7633fce81e1343400020c7f9b4a7d66a
SHA1 5d7b01d3d295302c774507327f6d04a70c031917
SHA512 3c54be59caf2ffe51e135e2e7a9326eeb84424ae70e5b339c9ed3f61cbc120dbe09de307dd3f9e142f1f4e891e177f0b83ba14a79d6e71e10c10712f0cc08966
SSDEEP 6:7+/l9f/GPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKYh/C/3:7+tMqLmqKRmBEyPbBS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.dabv.vetu.tvbf/databases/lezzd-journal
Size 8KB
SHA256 1b2c2336695c0a32cb0c0dc6602e337f120e04a55c78e6b401d4915a4ea17940
MD5 d2ac33f2d594fb9191c7027d888b9d58
SHA1 81d6f2a3b32951e51d3c89b5a1241bc8e3fb937f
SHA512 c0bac57b4e972c929e8feacc860daf7a51b757afa44df127890fbb554d55d1e9276890e4b24c50386d1ae0923cdcd33cd11bffd985f1ff61a949215832d95b73
SSDEEP 12:7+tMnqLyKPjSyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbsXE+:7+t0qLy2TUku+haaL6nwyLGSF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/user/0/com.dabv.vetu.tvbf/files/.imprint
Size 943B
SHA256 b4a861c4e5e69583b1bbe17fdb3a56aef117e31bf4a465f2f1e7e13c93281c56
MD5 b299282e35607e9e9394bf45622dca10
SHA1 c734ba09559851cd076c8cb49a6c505a81d2eac6
SHA512 7b259d432dabe7dde0809548ce1ac5f7d6c6b3c26dc16e5ee29f77b22cad3e275e5c313b0d4b0d5cbe224790b7f0c9ee0d84d22bf9105e9465e8bc59659da326
MD5 SHA1 SHA512

Submit Download

.imprint

Path /data/user/0/com.dabv.vetu.tvbf/files/.imprint
Size 943B
SHA256 77d0c891defa437de5e5478355d6ab70f21f2d2c4cd46dbd68a5dc11676ca45a
MD5 c8bcd68bc07c6ee96cb34fd079a116af
SHA1 0b5af3daffe0428d442f7ec999ccce7e79882461
SHA512 ac8ed2f1b19a83b3e81d1e985785db16fdf24379e3793c95a58b85f1a49913aea5c206d63d440136391ee144e2a56b5528c10bc735f2482ae416970d41992563
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.dabv.vetu.tvbf/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 ac25927b23c8eec6b7d78b4361b747c17663f7a09f44034da6d9338b2f45bbd4
MD5 a2b70c5f736c086d3a7711e1a4530040
SHA1 cba72bd19b2e493c7a524b651bf03ee8ba658020
SHA512 3114e53d3457a9949eda424eeae8eecdd2faeb35146318d9fd4f1d88c0f13642cb389330ab60c29a75a0925dfa099950e46b4b45dfafd020240cf170c1556c3a
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.dabv.vetu.tvbf/files/.umeng/exchangeIdentity.json
Size 203B
SHA256 27060ba2ab394d28f8e22b3f78f367ec9197037edf429a1578db17d07a4cbb66
MD5 42f8657a231630ccf014f8f1d1308d48
SHA1 5093f5a5e401c7cfe0d43b4f38af7dc7a96757c4
SHA512 13d081b099e2eddb682265cedeb0bcafa23ed76b880eb63940abef30f2545b83a403e637a4412b4fef038f2bca07acbdf580e08e4ef9ca1c8b7054b92b211d37
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.dabv.vetu.tvbf/files/umeng_it.cache
Size 350B
SHA256 91bf542a6f381571f6fb19af48ea76253ece4f9182abc55fd2437e1f0a05c879
MD5 67fb83efe81d1b422bca20cdf3493eb2
SHA1 f060e84deda023e7bf05a2e7204cc6dfcadd9e8e
SHA512 cf1d965b48feab900f4ef098e1b8f1a3c4fddefe0d7d32030beb2903fff19e171e5852696b108739a34153bab87fe59e69aa16ff193b77c3f5feaf0c88f23391
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.dabv.vetu.tvbf/files/umeng_it.cache
Size 178B
SHA256 a89afd1e6812f5b1f29e4b90163ea4f6730f4855962ca0b6f25da2b4353ff322
MD5 841641e8bb3dba9500788d9899074952
SHA1 07cce6e68bf2f18fb160b37cf908c4fb46ac68d3
SHA512 5663143d8915999fc2234660c25926532bb2647d275225fc135655959b4ff61ca20c69b8b81ab2941d9334db93eb01f1f3d003875e2406c9e987184b7490f052
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads