882ffb9d7c981ce74ca5e5a1f24252bd1ff1a17aa77edba2bd4863b55ae8c0e6

Analysis

max time kernel
147s
max time network
153s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
13/10/2024, 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e31882f3b46400ef17c92806e2767e0_JaffaCakes118.apk
Size

1.3MB
MD5

3e31882f3b46400ef17c92806e2767e0
SHA1

684b8645d2eb11fc20f1c91a05a88fd7c0d9a96e
SHA256

882ffb9d7c981ce74ca5e5a1f24252bd1ff1a17aa77edba2bd4863b55ae8c0e6
SHA512

76a69596a1f7767739e97fe3bcb8c23f1a7c3fbb9eca275f7f27cb2884a39b10d07c5472d07b92510842b5b5bb560abda477d4d9a89fe4d4c5187a05c77c1eef
SSDEEP

24576:WoL0otaYtXMPQ8x71O4NcGZcv2Kn+WFjro+TkjvCNq/13tdHbZKm51Ob83l:lQ7YtGWccGunljnYjvCNq/1XHNKmjb1

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5067	com.fjkh.wvbd.fwas

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.fjkh.wvbd.fwas/app_mjf/dz.jar	5067	com.fjkh.wvbd.fwas
/data/user/0/com.fjkh.wvbd.fwas/app_mjf/dz.jar	5121	com.fjkh.wvbd.fwas:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.fjkh.wvbd.fwas

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.fjkh.wvbd.fwas

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
26	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.fjkh.wvbd.fwas

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.fjkh.wvbd.fwas

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.fjkh.wvbd.fwas

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.fjkh.wvbd.fwas

com.fjkh.wvbd.fwas
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5067

com.fjkh.wvbd.fwas:daemon
1⤵
- Loads dropped Dex/Jar
PID:5121

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.fjkh.wvbd.fwas/app_mjf/ddz.jar

Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.fjkh.wvbd.fwas/app_mjf/tdz.jar

Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.fjkh.wvbd.fwas/databases/lezzd

Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.fjkh.wvbd.fwas/databases/lezzd-journal

Filesize
8KB

MD5
4506594771597edce66ab89c5c42a133

SHA1
45fac71295403efd34e969458f06bf00d72e8695

SHA256
f449187851da9626357c4b95089dbd5db3baf3d152728d8cdd1449b8323322a1

SHA512
f8a97df7624aaaab400f2badd06196eb1a41558e8b9bb88b92c0e3addfac6e2fe5101b39ba67403c9894f22a07bcba3bdac3983ea4deaf0d97c303133aaee35f

Download Submit
/data/data/com.fjkh.wvbd.fwas/databases/lezzd-journal

Filesize
512B

MD5
fee358703ac81c9099d457bf620bf1d2

SHA1
b928570908041a78d748f473ecc007bc1ecce229

SHA256
5190b8fde960e4e70b831ee82caeb2ae4c9e49b163f1035cc81308769b11fdb7

SHA512
7096baaaa7aaa5037f78b4312689585cd7b26336a326cb95d5f00c50aea0d9fe34bcff8d8fcca5c393ea1315696d1bf78c375e396104b1fb9123a0e89147d460

Download Submit
/data/data/com.fjkh.wvbd.fwas/databases/lezzd-journal

Filesize
8KB

MD5
dac9adc31ba843a9e814631146c2a89f

SHA1
82f66bb2b3a60f0ddf288cbbe4218aec34c97f4a

SHA256
5aa060a84de86ea5262cd016d174cabec8fe45f55bb184ecca5fcc989a87e847

SHA512
b53648569da118a1b89941f5cf3db7bcf728644d59bc76fef2bfa74a277a7ef0e53c4ba7cb4e1c737dd453bedba49e020723c5e99d5ce1b8d84e173dcb3e3446

Download Submit
/data/data/com.fjkh.wvbd.fwas/databases/lezzd-journal

Filesize
4KB

MD5
355ace6fc5b93a0c36ab00365ec313ea

SHA1
eb4b31ef71ce5782bb6d950ea286e9818a2e98c5

SHA256
0a44077c00fda48f63630c6024f974ac4f346eab266cf61daa1e2bd05f028ba5

SHA512
67d01a5c7f84c48a5ea684d7fe3494e63208712db4587d469cbe0a1b95e196cf717f488692a03e834d52b0676b8bad7d40ae345e258aee3ab94cc186ff9c84b0

Download Submit
/data/data/com.fjkh.wvbd.fwas/databases/lezzd-journal

Filesize
8KB

MD5
6a6a84ee561d87b85e038f3e16e2c0af

SHA1
14cec8b587e91f6e252799a1b8d39a49766a9466

SHA256
f95e589219a6a0fb2556e9dee86677b2572fa8b19a4548cc5311929e8464b9d7

SHA512
6464cebcae689de6492a225525cf60977a697f3b6a6c9f25e9b2d0c826d7c048b776d4247f0f474c79a363b33d81cea5f0199ff9070286e402370ba3acab7bdd

Download Submit
/data/data/com.fjkh.wvbd.fwas/databases/lezzd-journal

Filesize
8KB

MD5
85c9fc6906cdffeea25c768309d30b19

SHA1
cbcf85fd53953c49bea196167b2e381b85a99361

SHA256
8608b5094d86ad51a9cab1d20192c137bc92b62c181e5b7bd1b00561d4491979

SHA512
74856c5f79bbda9b5c35a51f52f764a0f56bfb4c9a493ec55a8ed5527a010ad7c7bfd16dfa70e7e3c3b417b4bb4a42bf4e25930d1a37e7d51959ec9571868148

Download Submit
/data/data/com.fjkh.wvbd.fwas/files/.um/um_cache_1728799249514.env

Filesize
655B

MD5
c2875559c2a6d1087ba952c90eec0a91

SHA1
313f82ae0d6bc3f51e195114dbc001eb11729c71

SHA256
710b8c52302e4dba9489ac0b6e4553680250d93e0a8e55ca33933311ccc49179

SHA512
832ef0d4837ca23d3fb1a138c183ea3ecf4edafa2f50820aff9d8d74f55ce173402893cabea5237a8fd5042998684da91c128e42b77726b85ae21b39e367d174

Download Submit
/data/data/com.fjkh.wvbd.fwas/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
558a9dfb2276b15b31d04589d3684a49

SHA1
1f8aaa8dded499accd437d95b3f889b82ab2abda

SHA256
7d9c8ca73c8f04a51fed6a7aaf3fa229c1b53592efefa71bdef6df2098831c1f

SHA512
312bb79c39c0ac74d8c00e9569326ea9533fa900b535957de56678903605d62fc92e7c13870c25e270445b7aa87c76f9891b777f6c212db0ace8650ea2a617d0

Download Submit
/data/data/com.fjkh.wvbd.fwas/files/umeng_it.cache

Filesize
352B

MD5
141d146295496ea31a8c1e683e952ccf

SHA1
78a38eb49696b432377633df8656940f6c359f64

SHA256
a64788eca50d3fda76ead6b3594a1c8773b73a1f5c15cba86b198ec4ba952b5c

SHA512
7788112786fbfaf6b8e5761e688802c7959632dd7c1fe6932f11bd98bce7b4b8241ce3fe04e4353f7c0ba16acd9afdb3252f537283e6dae5c08e9c10361b7dff

Download Submit
/data/user/0/com.fjkh.wvbd.fwas/app_mjf/dz.jar

Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads