5a1bb0075d82f03714725edce910ec2f15274ac06de8867c09fe32d5a4448cdc

Analysis

max time kernel
149s
max time network
152s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
02/10/2024, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c4c36aba19ff1859a4bce7a907d5184_JaffaCakes118.apk
Size

1.3MB
MD5

0c4c36aba19ff1859a4bce7a907d5184
SHA1

3069811b1b56ab699f840c003453d3adaa350073
SHA256

5a1bb0075d82f03714725edce910ec2f15274ac06de8867c09fe32d5a4448cdc
SHA512

92df9916bccc08dcb4785598f42066f0ba327373c36f8883e676875361d4bc648232e8bcad6a5e5a5457008508f66765968025a9050257afd843097706dae069
SSDEEP

24576:noL0otaYtXMhep8X3lUKfcfIkuovSp0ijDo+9UjNUDq/13tdHbZKm51Ob83B:oQ7YtoX1wvTvSpVjPyjNUDq/1XHNKmj9

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4254	com.juls.iewy.hqyk

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.juls.iewy.hqyk/app_mjf/dz.jar	4288	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.juls.iewy.hqyk/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.juls.iewy.hqyk/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.juls.iewy.hqyk/app_mjf/dz.jar	4254	com.juls.iewy.hqyk
/data/user/0/com.juls.iewy.hqyk/app_mjf/dz.jar	4323	com.juls.iewy.hqyk:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.juls.iewy.hqyk

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.juls.iewy.hqyk

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
23	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.juls.iewy.hqyk

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.juls.iewy.hqyk

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.juls.iewy.hqyk

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.juls.iewy.hqyk

com.juls.iewy.hqyk
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4254
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.juls.iewy.hqyk/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.juls.iewy.hqyk/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4288

com.juls.iewy.hqyk:daemon
1⤵
- Loads dropped Dex/Jar
PID:4323

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.juls.iewy.hqyk/app_mjf/ddz.jar

Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.juls.iewy.hqyk/app_mjf/oat/dz.jar.cur.prof

Filesize
744B

MD5
fc430025fab036614aee4044c8f2e19f

SHA1
a30ea0c55dee1ea4a3acda1e473476202a1dc7f2

SHA256
4e25bd01ab115319fd8719ee313b0e324741fb70631a5bc31eb2ae37df36564d

SHA512
bfd1f92433a9e9bc1cff1989ea0d49a6c188883e60ab47845572e500080028e5c7b95ef122825d4e6ceb04ec4a612636ea0f5f9d6dcb8fee7efa843aa71eb0c0

Download Submit
/data/data/com.juls.iewy.hqyk/app_mjf/tdz.jar

Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.juls.iewy.hqyk/databases/lezzd

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.juls.iewy.hqyk/databases/lezzd-journal

Filesize
512B

MD5
eeda1fe8a83526f9f0f5295ef5a5eb4b

SHA1
5206dbf82fd53ae110e499a1eceb172336b939b1

SHA256
0493ef277e357ddbda05648e4b4695743ec3501e14cd895a2019c3827140f2d9

SHA512
20e4544e8c1577658ceceaf2c326f0bd47e7e0d5c3bafc79bd428b29a419c5a7f5bbc17e77412864ae6dfdc1f335bd8944d3c96be9f1d75f48b17b26fe12fac4

Download Submit
/data/data/com.juls.iewy.hqyk/databases/lezzd-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.juls.iewy.hqyk/databases/lezzd-wal

Filesize
60KB

MD5
5b31a2d172c91d740fe555cc0da984b7

SHA1
3248f914615fa8eea7fd9bf22d744e2f6d663cd4

SHA256
8d553471d91481f56fbf01f63d329d10bdb7dea8882ae80c59326012ff22dd85

SHA512
a07a1a7de05b1044df2ba9ead811932b18dbf582ae13461c55e8f71c5be3835fc3ffed8cc56a6f68ba5722ca97c419c6826bbd9c68c3f019a1c70bcc72e1fafb

Download Submit
/data/data/com.juls.iewy.hqyk/files/.um/um_cache_1727900009841.env

Filesize
685B

MD5
4eeefbed9a719f3ade3791be8c036651

SHA1
6ae76bb30c119304966a75b046e4a4f01402a194

SHA256
8e08daffdd664ea823b1d7992c9c6081d24a36f5b252f3429b9888150e42cf45

SHA512
f60648ef2b48e63c5df85d4c7d1f88834f54df5a0a9a3e2554e3d551221b42042a8bc86eb5a260c5ad439814b4e0d495bb580e23db3010397f8f5a0418f9198a

Download Submit
/data/data/com.juls.iewy.hqyk/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
8cd95544f9f0b7127f4005bd8e4ccbf0

SHA1
1ff359cf12ed7cc6821e9310a7da3be967ab28f8

SHA256
497da7f6a0393387fa3c95d0e0ce04dcdf72367d1854b9adfb8f6416719f0024

SHA512
10936d8aaf7e411d0af093a3af5646ca66d0871c1c1a3ed32286d1ca4e81378b930ee3b339472a395fe8b18e967c3bc3e3aaf56b21076e527801a4c990bd8382

Download Submit
/data/data/com.juls.iewy.hqyk/files/umeng_it.cache

Filesize
415B

MD5
5cc0f4d9eed9d1dd3f8fca0b3b5398ef

SHA1
9117e915ed6657bf8c8b6e30864d2ca977e9950f

SHA256
434b3aec1f4321d98ff1046898d6b4056ae5765c500b12a20bf5acafd76efbc1

SHA512
0b875c0150faea378563a2618ba06dfb30fef67717c57c9ffbd1fb1f9d4152a6ab80857fd54858930b315c7ddc4f0bf6a163b80bbcd7283f68e3bf312eaaca0a

Download Submit
/data/user/0/com.juls.iewy.hqyk/app_mjf/dz.jar

Filesize
248KB

MD5
9b47e78a6ff90cce5755ce4742047627

SHA1
831b24aa9e116eb8d7065efd430088d419dfd6c7

SHA256
30d7699b73fd7f276945415c405c12bff69c5958d12f56265a768443f6fd8cae

SHA512
4587a5b26f13cbd0524eade71ed29203fc55029fe150fce850016aa7d9c578623cdc4b6a551bed3dec9e31a39563f8927cfcc9d21e2d83c2c781808b958446fc

Download Submit
/data/user/0/com.juls.iewy.hqyk/app_mjf/dz.jar

Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads