ff3b2dcd3e9bbdc41e611786e6fbf6af9d10133d390d9ad8bbcf46406c6796e7

Analysis

max time kernel
148s
max time network
151s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
02/10/2024, 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09af2f25d4f395d589a5008896d38cfc_JaffaCakes118.apk
Size

1.3MB
MD5

09af2f25d4f395d589a5008896d38cfc
SHA1

10a708923e598476980a6693a96fc5e418f7091b
SHA256

ff3b2dcd3e9bbdc41e611786e6fbf6af9d10133d390d9ad8bbcf46406c6796e7
SHA512

5220be08694487cdba473acf07051e476ed663fe7c7a43f8dccbe85c8bfaffdaf1545b84f377a976beb4a2fd01e16d4907a004b0144bbdda75b25db13ae3c33e
SSDEEP

24576:nwx6LxO7Q64ECHcTnuwyDHv2mcfH6pe95o+vcj/apq/13tdHbZKm51Ob83O:oE64EbuwkQfqMp0j/apq/1XHNKmjbe

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4212	com.tssq.pira.drsn

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tssq.pira.drsn/app_mjf/dz.jar	4276	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tssq.pira.drsn/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.tssq.pira.drsn/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tssq.pira.drsn/app_mjf/dz.jar	4212	com.tssq.pira.drsn
/data/user/0/com.tssq.pira.drsn/app_mjf/dz.jar	4313	com.tssq.pira.drsn:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.tssq.pira.drsn

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tssq.pira.drsn

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
20	alog.umeng.com
31	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tssq.pira.drsn

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tssq.pira.drsn

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tssq.pira.drsn

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tssq.pira.drsn

com.tssq.pira.drsn
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4212
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tssq.pira.drsn/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.tssq.pira.drsn/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4276

com.tssq.pira.drsn:daemon
1⤵
- Loads dropped Dex/Jar
PID:4313

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tssq.pira.drsn/app_mjf/ddz.jar

Filesize
105KB

MD5
7f1e0fe2e6a0618b6c84d48ea0586b6d

SHA1
dea54fa91f9f431b85e8c4048244a1c3c4b16665

SHA256
4225d0ce3922e9bfd5828c3507b26226b8f08f3b03d8fcf594dbf36835a9519e

SHA512
7a9e77b9ee66c7cc5d406389c8dd4f344b02c8449cfcd581586d16ce895ed0fa77f6fc8c767c32b92e75863d8133422b4ed3057f54999c3fef031146602e5df6

Download Submit
/data/data/com.tssq.pira.drsn/app_mjf/oat/dz.jar.cur.prof

Filesize
635B

MD5
af04deb82ed190a16a1942da2e2af65c

SHA1
de43914da5d386511dc97b0d9b2b2b78664a155f

SHA256
91f13da0bc47f19a0e76c10a68a1a322d11394907cb069752cbafc4a95381855

SHA512
56edf5e44a9c6eef50492d02c2185a23a47b1f66d9dc90bbe19c146f21ede0ba2d6fabe7d8180d01c7292ef90647591dd9506df22f3db5fc3dd3a951047ff1bf

Download Submit
/data/data/com.tssq.pira.drsn/app_mjf/tdz.jar

Filesize
105KB

MD5
fc1eb8c18ddc0f8727b5fb5eba8ca870

SHA1
af6d64fe2432bece4c523066a57f35be8f175a48

SHA256
7f4e38a3ac4fae5a400648d200d8b9897dc28606722dba44c43e5582182e5fe9

SHA512
25e5c0eafb925a6b3c6d9f8622b95d07fd8e63be2689859733b10ed65fa7f7e56e5453da64d9bd7bd7c3345f6c1a90a5dd34de9b0788f4ba080689758d5d4e66

Download Submit
/data/data/com.tssq.pira.drsn/databases/lezzd

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tssq.pira.drsn/databases/lezzd-journal

Filesize
512B

MD5
e2b1a469d07634186e3dcd3e9122db7c

SHA1
2fb9978a21f7029d97c22fbd6d00111721479ac6

SHA256
73ef0df5589177549be18980ec9350a77828b1eaaec21f3c712a3728a3123eac

SHA512
6ea4d830f1966446ec1b99e0fe9f8c9354c185b773dceff2c58e858a2d0f84d1725c3c86fa48c0e9296988f0dc0dfd55d6bec73a2ba3471842232a8bdcd2403a

Download Submit
/data/data/com.tssq.pira.drsn/databases/lezzd-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tssq.pira.drsn/databases/lezzd-wal

Filesize
60KB

MD5
3ac3f8827a94ab949d5ab2ea0a023b55

SHA1
64911c239a8ccfacc89b755b37e2d6fa640c301a

SHA256
8b4226a3136806b931106cffa246afa0e9506a71bc9c730a75b98860a57fe0ac

SHA512
94f232a697d4060a28a50a2e6c34eecfb9c0829b947fdd3d75ee184a083a734aea12a49590ad474965908dc98880acb2861c6987195aee48cf0a9c5daa18cc05

Download Submit
/data/data/com.tssq.pira.drsn/files/.um/um_cache_1727856461781.env

Filesize
683B

MD5
ab21cd377bf7fbe1636150f9538866e8

SHA1
da7cbec3c56c3223c816c8f67b53daddb045befa

SHA256
24662a226bb6ef997776f3fab63a3bf2b942e64ff76a59d895ec58505d50c5e0

SHA512
7e54fa234a54c5d88b15f0a052d2f252fca64a4a68f4eb3d8fa7a22042cb8559ea0569b631d473af579f97ec4279b43528ed76daf5e7d9ffb2fc17271b1cb55d

Download Submit
/data/data/com.tssq.pira.drsn/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
f0cfb6870a1d7e64fbb368fdcc2eefb5

SHA1
642429bd23d11998b89171c3fd6005080a4f01c6

SHA256
8e6b0b8ce88aa699071a399f1f64aa78ece101ebe76d62201eda7f87cfdd2bce

SHA512
d77a7da28ffaa20aeb21d12f817adbff397e9160386fefd92cde9aea9eacc0e3ddf05792b32b2d112438fc4e9eb0216bbb7747e6724a7507340fc07214fd2d3a

Download Submit
/data/data/com.tssq.pira.drsn/files/umeng_it.cache

Filesize
415B

MD5
d871227407ab89afed82145cef824b8b

SHA1
0a579a925fca9bca38d49681d923030d8f6cc2c6

SHA256
908c907efa0026c54a103a15301b8deb1976411ab23468a57e688c73d16a5a42

SHA512
c151acc5412001a0cfbb096790ddc5b3d4bc1fab892d6678163d4cee098ff0f075351c494b72dd3bb716dbf3e994923ce081fd6f138e1d9ce842c3be47bd1295

Download Submit
/data/user/0/com.tssq.pira.drsn/app_mjf/dz.jar

Filesize
249KB

MD5
eb4b1f8a3354e8b5c30a253c771196ab

SHA1
5c721a6d50b607c91d6b900b4a21a09680f6149e

SHA256
dee0215de8f0bf8acfc41aa199e605f30178a969cb5821a977e865b69773b3e2

SHA512
a7ce9f9612de9c987392c28f2ded37dbe991f3b61022ac5ad797230c294606a69030182a62df3f8ce98ee50b42a4a38eda9bc297332cc4b46b3f478cae6fe1b6

Download Submit
/data/user/0/com.tssq.pira.drsn/app_mjf/dz.jar

Filesize
249KB

MD5
789a4162427149dd5e519f917ead0e29

SHA1
d2bd738c28ec21c0441c6daaefc206a6a76f8e1c

SHA256
830643d652f95c85fa7665c202f93822b08f106cfeae9202a8a7d894292a36c0

SHA512
b6a8d5c20792cea1035a7f7684bc03b3f184a0bbba3f5c322b26cc75fd50002e749882d6ac6177a93115ce93b1b3d4721f4449d2007ad700e0633a11579f7e37

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads