210750dabe8e34822418d90e7e15fda6508342a9e88617297839b6137a074612

Analysis

max time kernel
180s
max time network
150s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
25/08/2024, 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0e8863ba90e1f086ee28e43a69c19a0_JaffaCakes118.apk
Size

1.3MB
MD5

c0e8863ba90e1f086ee28e43a69c19a0
SHA1

7757da1fcdf19bef7e50b0851665bcd61704b6a4
SHA256

210750dabe8e34822418d90e7e15fda6508342a9e88617297839b6137a074612
SHA512

e03e0ba88271a4190aac36d5fd789e53e9f4809b553b4d95c21cdff2324e2d49cc7ea1d57ec27543277087cc1eadfc8fdb3650593720e8b7385ef697070c42f3
SSDEEP

24576:g2ZqVoL0otaYtXMieqHJCddRtLKaAENssa3o+4IjwDMq/13tdHbZKm51Ob83l:tfQ7Yt9eqpCddRNKaVNsbLdjwDMq/1XB

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4215	com.cgne.vwyq.akeo

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.cgne.vwyq.akeo/app_mjf/dz.jar	4282	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cgne.vwyq.akeo/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.cgne.vwyq.akeo/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.cgne.vwyq.akeo/app_mjf/dz.jar	4215	com.cgne.vwyq.akeo
/data/user/0/com.cgne.vwyq.akeo/app_mjf/dz.jar	4316	com.cgne.vwyq.akeo:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.cgne.vwyq.akeo

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cgne.vwyq.akeo

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
15	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cgne.vwyq.akeo

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cgne.vwyq.akeo

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cgne.vwyq.akeo

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cgne.vwyq.akeo

com.cgne.vwyq.akeo
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4215
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cgne.vwyq.akeo/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.cgne.vwyq.akeo/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4282

com.cgne.vwyq.akeo:daemon
1⤵
- Loads dropped Dex/Jar
PID:4316

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cgne.vwyq.akeo/app_mjf/ddz.jar

Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.cgne.vwyq.akeo/app_mjf/oat/dz.jar.cur.prof

Filesize
684B

MD5
2daf4573f0e30fcbd1fee245c6670084

SHA1
92ec048d216dee496e2cda981c78ed866fe0dd0b

SHA256
2081bbdb3f259e041253a6f07d785c91bbe456892e1f535aca4b0f6cb7580944

SHA512
c3b8967df92a35805c9b488265c6e4f9b3a19f8f5311b019cc6e13ec9fa5c28feafc856184673358caaf361e2c573c585df29ce3063472aec4f47215ea17aa47

Download Submit
/data/data/com.cgne.vwyq.akeo/app_mjf/tdz.jar

Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.cgne.vwyq.akeo/databases/lezzd

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.cgne.vwyq.akeo/databases/lezzd-journal

Filesize
512B

MD5
001723e0c3dec035b6709573e6b0197f

SHA1
845a514f4dcf9b145d5631b829f1d950e139a595

SHA256
bba6edc597e65722bf13a9aa1186d6eb4d8945e127f017bb9ef0042eb7162abf

SHA512
5c4568b868163ccfd94cea76b477d3fea40e6cbf15ce326a0552e29e37e887f93c2940b482d90404c11b37201c46b2810345ff068733d7c87b13ca2e46ac3593

Download Submit
/data/data/com.cgne.vwyq.akeo/databases/lezzd-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.cgne.vwyq.akeo/databases/lezzd-wal

Filesize
60KB

MD5
d0689861a68fdb2e3a9c03041df6baab

SHA1
4d34f6e06f212a4f560c8cb126f37ebfa16a29a9

SHA256
7c9075c0a055e05bef993268d5a6e00c08cfff7de9be7936997be92ed593fe38

SHA512
ad1633bf9765c1c5b527931c2f1381c33a8345429de1e1f3d0db0388bbf166b293873a7eb2321131763d8dbdf24a0fb6ea33fcfe07a2db037ef284e3bd998b94

Download Submit
/data/data/com.cgne.vwyq.akeo/files/.imprint

Filesize
1015B

MD5
a631f385192d866fa951d7395a2688f4

SHA1
d135f9b13222a279c9b890d4961038d6882bba8f

SHA256
9a8ec543ea754bc4e3581d695ad976ec988121d28def99389208d9a64baa12a9

SHA512
570cf02eb3e9effca424326ba9d5a06514ed23722e037256d65a3aedd6d27cb61148d7fdb31383ea5cac5e816fe796c5387a7318dc592b0434fab060e23d7ce3

Download Submit
/data/data/com.cgne.vwyq.akeo/files/.imprint

Filesize
1015B

MD5
31ae804298114dd0dc44f69633c7febe

SHA1
bbbf5356aa266c63d6e4f77349a08740a562cfb3

SHA256
3fa02ca33504ec308e5e089a0b245be8c9d3f5003b53887c6adc56227cba5d91

SHA512
d78d4d83823b5073b40ea75c8ba53e804be60a2a0ccc73d48f10a06a833789e321fe7db6472c011818688822ff7e86d8f4ef7dfe1b512264d7fce4f9f279ba72

Download Submit
/data/data/com.cgne.vwyq.akeo/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
2328e42d622d2a8e9b1ec8e12389f3cb

SHA1
cfecffddcf0d88b5e5dacdaa9316da2c23b05db8

SHA256
9b1431a7c219a5f3e543df32b4b38e8b459766def606531c9989f38095c74826

SHA512
61cc258a4bdf958ff3c33fa6ad8c14ff0ccca7685fb2e723ce45c61a0fc7d2b2f265d540a231f60c581b13f2831b4f5431b8067afbd6bfd3961837c93fbb836a

Download Submit
/data/data/com.cgne.vwyq.akeo/files/.umeng/exchangeIdentity.json

Filesize
204B

MD5
199c3c7cdab833d0e3e36bd0f3b43b1b

SHA1
ce52811244f08d1db9baacc4c9e5e50a09103f4c

SHA256
9fd8fdf0859963700a90d3f3b06f092354eb1eccfc16f0ff788f4ea0a179ddeb

SHA512
610ccba580880b83c7c096d7a457c928d62ecfe49fe857fcbe3e47f35622ac8b491878b2121253ed38e382f1c591c2c75f90161343f2a5b5ac177f51991102eb

Download Submit
/data/data/com.cgne.vwyq.akeo/files/umeng_it.cache

Filesize
415B

MD5
053233acff12ef04a071be7cf56fec30

SHA1
ba6272bed1151da72f9551c7c226a27c1725d6a3

SHA256
0d1b268107fe8d249c0c0dd0101781e749523e099bca81764744961cbdece042

SHA512
1c9d6d49f829d01b6b00b493493a7d42c974f0eda830fd3531bffe387fdefcc178465fd22bfa14c21291670086f1dd6958698f61b83e5510249879292406714b

Download Submit
/data/data/com.cgne.vwyq.akeo/files/umeng_it.cache

Filesize
211B

MD5
77f840a7d511333d2ee4344c32854402

SHA1
28f5e5456ef223bd1739761a722193885accef96

SHA256
586d599a9e75463c2ac6520643f77861e7ec46511ba5ee0d86682e844485a134

SHA512
59e23f2995c1479a4c4037504766b841681938a36a18f03bf4646bb1c466c4f43a9bc6066d6d08ed7c07f9811a2c06fc5ee9324660ac4b74b1d58202d03d6442

Download Submit
/data/user/0/com.cgne.vwyq.akeo/app_mjf/dz.jar

Filesize
248KB

MD5
9b47e78a6ff90cce5755ce4742047627

SHA1
831b24aa9e116eb8d7065efd430088d419dfd6c7

SHA256
30d7699b73fd7f276945415c405c12bff69c5958d12f56265a768443f6fd8cae

SHA512
4587a5b26f13cbd0524eade71ed29203fc55029fe150fce850016aa7d9c578623cdc4b6a551bed3dec9e31a39563f8927cfcc9d21e2d83c2c781808b958446fc

Download Submit
/data/user/0/com.cgne.vwyq.akeo/app_mjf/dz.jar

Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads