775603c8dce73634d44a4e4acc4c4d713e70e8243c72eb184cf016fa0b5880b3

Analysis

max time kernel
148s
max time network
153s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
04/10/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

148b18725c4847f02f7acbfd3638032e_JaffaCakes118.apk
Size

1.3MB
MD5

148b18725c4847f02f7acbfd3638032e
SHA1

b3a474b01ae3bd2fb3aaa95ea7224cd77e20bab9
SHA256

775603c8dce73634d44a4e4acc4c4d713e70e8243c72eb184cf016fa0b5880b3
SHA512

bf2659edd7f05d2f80f3ed67e52afdc2b3d6b328fbb534737b80368cd8403c4856fe6d3241ef28d761605045c20e56891714693db006ce89b7d805a81206b5d4
SSDEEP

24576:DfoL0otaYtXMPQFx71O4NcGZcv2Kn+WUjTo+4Qj8XUq/13tdHbZKm51Ob83V:sQ7YtDWccGun0j/9j8XUq/1XHNKmjbF

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4960	com.wuhu.ffon.dafg

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.wuhu.ffon.dafg/app_mjf/dz.jar	4960	com.wuhu.ffon.dafg
/data/user/0/com.wuhu.ffon.dafg/app_mjf/dz.jar	5016	com.wuhu.ffon.dafg:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.wuhu.ffon.dafg

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wuhu.ffon.dafg

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
26	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wuhu.ffon.dafg

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wuhu.ffon.dafg

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wuhu.ffon.dafg

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wuhu.ffon.dafg

com.wuhu.ffon.dafg
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4960

com.wuhu.ffon.dafg:daemon
1⤵
- Loads dropped Dex/Jar
PID:5016

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wuhu.ffon.dafg/app_mjf/ddz.jar

Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.wuhu.ffon.dafg/app_mjf/oat/dz.jar.cur.prof

Filesize
734B

MD5
ad70d5493c5d67325ade40bfa925e7ca

SHA1
0b82a38ca1b2da0c4df4935d75ad36e3481aa616

SHA256
3053a0ea90d74afa8ad601c8b8b4d183a8a8b22e46efaa2ddcd4b7db54f7d9bc

SHA512
0b3af28049c57740b0186b8c53d8ad8c76d182245c98a19ebced66cd151194ed59cdd4217313be181ec2dbc65eadd0bad1efcff5a8f4b48c729349649274672d

Download Submit
/data/data/com.wuhu.ffon.dafg/app_mjf/tdz.jar

Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.wuhu.ffon.dafg/databases/lezzd

Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.wuhu.ffon.dafg/databases/lezzd-journal

Filesize
8KB

MD5
31bb66a3ef0a74b143e60ef85ffa1719

SHA1
d813f550822e202da9153e127254fa8b60685a6e

SHA256
d4840acfb1fa778f61282089f9b554ad9e77bdb6c11e0ee3a4fa7f41298f9d3a

SHA512
f7159646c420f9bd2937e0335397ed693cb7a5707ac4c42e8804b06596fe2c0ac5f9904c2f67069173f48524a99844dea16bfbfdb8b5e1de92797344cb942ee7

Download Submit
/data/data/com.wuhu.ffon.dafg/databases/lezzd-journal

Filesize
512B

MD5
914a25f682a298b8a0e4f1faf4033027

SHA1
115ec6244627b32d68bb1591b715304dffc782bd

SHA256
9d1dedc5760953acf79ce1420582c3728fc576d9159144a88fc922bae75666dc

SHA512
2895dcac84c746cc152690a1ebb14adda6e069b9f81f9d013df43e91a1eb94d082f7ab816aeeace3cb932138344a1ddbed1b29a670009a7f8cbb8f5390896f48

Download Submit
/data/data/com.wuhu.ffon.dafg/databases/lezzd-journal

Filesize
8KB

MD5
dbcff7769808e16e18340d56f7fb279a

SHA1
99a33f391c1fccf51950ad226647bd2c2c5e3cc9

SHA256
a1643302f26f6e1660482f158b981b5a00403365571fdf281ac9afb163baf388

SHA512
f785f517a35941db4bb16a4cd7973bb58056af80bbe41d39f27781e38955267703ee24b805459d6a123820c56fe5f1872e2f5fe1a0baf527ead4ad0d9fb16f6a

Download Submit
/data/data/com.wuhu.ffon.dafg/databases/lezzd-journal

Filesize
4KB

MD5
c2631a3fa62237371233aebcb67ddfee

SHA1
67f454df5c76bf311daf98b559bbf3f0916aa67a

SHA256
c5d5b8bda52d153e7a2b7a12b194c135af487ebbd1ca1875aa7921a8f063758e

SHA512
51f92820a9bef636e3326fa5fad4fbee3775f6d8aa9c0c59eb08ebf12b9ee8f9bd088d71b79312151f6fad4fb9dacd307ec98b8f97d5a1d5dbd0627fdf24877e

Download Submit
/data/data/com.wuhu.ffon.dafg/databases/lezzd-journal

Filesize
8KB

MD5
91049787702ccbbcd4a55b7c258ac330

SHA1
ccfb2a782859a0754e0c37a14a5e991fa04bc90e

SHA256
b050b0bb25d6f607b7e33718900fa42d9ac250ccfbf6e5e6a30120bfb8f5ff2f

SHA512
8bf2009a768519a58acfbca6644c0c1af434589e24dfde89008d1c45b0eb823bf8e446794441efd78eb383b7a34bfb267c76fca2fa9dad1809e7f2046ae2d3d0

Download Submit
/data/data/com.wuhu.ffon.dafg/databases/lezzd-journal

Filesize
8KB

MD5
28ba30975ac57d1a8f3f84901b3f99c1

SHA1
b89eb50d57a47a1c8ea93bbde534acccf65297c9

SHA256
c99de06b3d8a2bf22f5e64cb08b4c9d72ca0482c49c390b3375fbbbc44cd1556

SHA512
f8d63271e2030ba3afa755e213d2b31a7c7b8b7a3eadf3e283833f1bc7c339b19486df5dd16ca9be40ba46582272b013386e5b2f75e777f41993dd2574bfc45b

Download Submit
/data/data/com.wuhu.ffon.dafg/files/.um/um_cache_1728067980339.env

Filesize
649B

MD5
2b2e18de6c7a413113034da370716def

SHA1
0823cb50899087675e56069db91a4a568b7c0b2c

SHA256
0f08f78d4f615b8fbb6527474c8ecda78702f6c5e0bc0bd2e5b7ec9f67fc8f80

SHA512
604c7d2a06317570b7c9b54cfc5b6eadac7051866b8e4b517f1e13ae14c6ee19691e07fd38515f5cba98bc395c71deccbdce74f0602bd6cc2ff5082a50e38d79

Download Submit
/data/data/com.wuhu.ffon.dafg/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
4a8eb5d65981b461212f223ab2ed4ec1

SHA1
ea400ba0ac7c5a8caa3879800d1d1573059cdd88

SHA256
10cfac3efb1f19c540358ba00c6d02536299d4db5dd6f51370b87b429d770454

SHA512
755d400b9c4a45b1d2e927a678a645327ff2b9432c04ccc7e363c8ee708626d311384e9f69a472c5dd7d224078c165ae8aaa3c6e52d84c441a8a68998348ac99

Download Submit
/data/data/com.wuhu.ffon.dafg/files/umeng_it.cache

Filesize
348B

MD5
7530d0d383692b7ba1766dffe73bf799

SHA1
127552e9bf9d6cc488001c6d42f7a773f1578bd1

SHA256
b074c60f9670f40382536fced4f11e4113934ffd522a5b8e47ef278a2b532110

SHA512
dcb0c98379b604c2c70c7343ea5371ca1df0605394a67b1fef1781d60dc88b5ef7b20b26bf02b49f250457f14ecd06296505298c30015f8a83eb1f84f83f6365

Download Submit
/data/user/0/com.wuhu.ffon.dafg/app_mjf/dz.jar

Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads