775603c8dce73634d44a4e4acc4c4d713e70e8243c72eb184cf016fa0b5880b3

Analysis

max time kernel
149s
max time network
153s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
04/10/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

148b18725c4847f02f7acbfd3638032e_JaffaCakes118.apk
Size

1.3MB
MD5

148b18725c4847f02f7acbfd3638032e
SHA1

b3a474b01ae3bd2fb3aaa95ea7224cd77e20bab9
SHA256

775603c8dce73634d44a4e4acc4c4d713e70e8243c72eb184cf016fa0b5880b3
SHA512

bf2659edd7f05d2f80f3ed67e52afdc2b3d6b328fbb534737b80368cd8403c4856fe6d3241ef28d761605045c20e56891714693db006ce89b7d805a81206b5d4
SSDEEP

24576:DfoL0otaYtXMPQFx71O4NcGZcv2Kn+WUjTo+4Qj8XUq/13tdHbZKm51Ob83V:sQ7YtDWccGun0j/9j8XUq/1XHNKmjbF

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4257	com.wuhu.ffon.dafg

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.wuhu.ffon.dafg/app_mjf/dz.jar	4289	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wuhu.ffon.dafg/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.wuhu.ffon.dafg/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.wuhu.ffon.dafg/app_mjf/dz.jar	4257	com.wuhu.ffon.dafg
/data/user/0/com.wuhu.ffon.dafg/app_mjf/dz.jar	4324	com.wuhu.ffon.dafg:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.wuhu.ffon.dafg

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wuhu.ffon.dafg

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
23	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wuhu.ffon.dafg

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wuhu.ffon.dafg

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wuhu.ffon.dafg

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wuhu.ffon.dafg

com.wuhu.ffon.dafg
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4257
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wuhu.ffon.dafg/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.wuhu.ffon.dafg/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4289

com.wuhu.ffon.dafg:daemon
1⤵
- Loads dropped Dex/Jar
PID:4324

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wuhu.ffon.dafg/app_mjf/ddz.jar

Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.wuhu.ffon.dafg/app_mjf/oat/dz.jar.cur.prof

Filesize
645B

MD5
e2235e7d6d8374b6660cc3b9a05c6ec5

SHA1
3baf7c8d2d242f033ac99c59cbea75fc710fb05e

SHA256
4266ba502e580b6310790beae163870af95200baf35bbddf10aeefc98d528f93

SHA512
6bd70357f8db55948c4565704c44d9d45c0dd3a3b70b50ebbf1f682d1675ce84f513843b5ed6cb866cde2529409160bee36b6a317ad3f8f3d61acebfd6a54ab3

Download Submit
/data/data/com.wuhu.ffon.dafg/app_mjf/tdz.jar

Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.wuhu.ffon.dafg/databases/lezzd

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.wuhu.ffon.dafg/databases/lezzd-journal

Filesize
512B

MD5
7114a26cecec541db4fa20961ccbedca

SHA1
2ac34455f65329249c198a1bc505c6e496f1c2c6

SHA256
38b3a604af96daf64f7a9a1b320ff49ef7bb5d33e6f57d472e044a8deab64c4f

SHA512
c9c3ca470627ce096ac3a03d12398cb192682a02a3ab827bcce8a316157a1fdea4cad82679078037611d1a502f10220001a08e27929029947577bac2e1eb270b

Download Submit
/data/data/com.wuhu.ffon.dafg/databases/lezzd-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.wuhu.ffon.dafg/databases/lezzd-wal

Filesize
60KB

MD5
ebce74f19a204b69a5c8689382ced361

SHA1
5635a32175075cf02dc56632059bc088ca34a43b

SHA256
27f2d20ededa347f991aee7f2cf3c4bc39030c4fd96088e15cdfd72b528a7ee3

SHA512
fa421548ec68560926993b7a36df642cb4c9c3312090dbadd02f964f759c843f3fcfd4b0918cf6ed8edb2d893a9529d3431f9ccaaa7060f13fa228b97f73d515

Download Submit
/data/data/com.wuhu.ffon.dafg/files/.um/um_cache_1728067982215.env

Filesize
677B

MD5
ce5dfa76d4cec3377da9d4b85f57bc75

SHA1
0881b55cd863ed243b249428326246f3342fe970

SHA256
e06432ca1bbe851b2dbc76af9fc660f1f3d339184a0b2828bd7f6295444733bf

SHA512
f5a25a2849f20fe8060fbb28d3a00d337c8f00d26ffe800939ac74cd0c7c75e2fdc74f05e3869461c0bffbc4f307bed115de97922b37115bb996e4f473d53d97

Download Submit
/data/data/com.wuhu.ffon.dafg/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
3297f1cddd4ef35bc8e52cbb38d0619f

SHA1
86defc0221e5dff0d89e890f36008ce7d510264a

SHA256
21177154118d023f173337e590ae836118bde49a7d4c44d8bc2764b774b22d94

SHA512
0db37b02d165084367029915b6e51a0e7d92b9ae7b9e61e574192383df6496a11dfce3fb743c7e8f8455f7490069faeb31cc4d1af4523440e2d706d102695439

Download Submit
/data/data/com.wuhu.ffon.dafg/files/umeng_it.cache

Filesize
415B

MD5
18ca6b02ebedd3385ba8a44695361b9f

SHA1
1544a989f56a41c9252c035b58a14c9eeca7f76a

SHA256
6d2a5608edc5b2fa325c3d368f192b33df9029a2a44d7a2cda6fbf4a387a8031

SHA512
26663a1035231ccf0e8595fc78d743d4cc11c236996640209ec50d3391a10d5f54da374e1a66ec94e1250889e26e9d14e19474787b97969e6cde411abfcc3ab7

Download Submit
/data/user/0/com.wuhu.ffon.dafg/app_mjf/dz.jar

Filesize
248KB

MD5
9b47e78a6ff90cce5755ce4742047627

SHA1
831b24aa9e116eb8d7065efd430088d419dfd6c7

SHA256
30d7699b73fd7f276945415c405c12bff69c5958d12f56265a768443f6fd8cae

SHA512
4587a5b26f13cbd0524eade71ed29203fc55029fe150fce850016aa7d9c578623cdc4b6a551bed3dec9e31a39563f8927cfcc9d21e2d83c2c781808b958446fc

Download Submit
/data/user/0/com.wuhu.ffon.dafg/app_mjf/dz.jar

Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads