01b1c40231c994f14457a65db196ffedbbd1312c8b685e5ac282f6bb6ba646ac

Analysis

max time kernel
147s
max time network
154s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
14/10/2024, 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43f8e613910e21ad26fad0150fca523f_JaffaCakes118.apk
Size

1.3MB
MD5

43f8e613910e21ad26fad0150fca523f
SHA1

7a17643a10e6dc0f4d3d58da8475d1fbee4eda3b
SHA256

01b1c40231c994f14457a65db196ffedbbd1312c8b685e5ac282f6bb6ba646ac
SHA512

8c1ddaece0eefdbb2cff5a89ffebb1d2fef50c02b7ba9f5993c550f683e1b328771b839c83d10145e86dbad95f034161bd30f2358c37ae3516065f32f948d9f7
SSDEEP

24576:moL0otaYtXMjG0dJZXs+bS8oaPnDAUCxFMyjTo+38jTmhq/13tdHbZKm51Ob83F:1Q7YtsdJZJboaPDAUcFRj/MjTmhq/1X5

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4969	com.xsfg.nwfo.cszd

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xsfg.nwfo.cszd/app_mjf/dz.jar	4969	com.xsfg.nwfo.cszd
/data/user/0/com.xsfg.nwfo.cszd/app_mjf/dz.jar	5028	com.xsfg.nwfo.cszd:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.xsfg.nwfo.cszd

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xsfg.nwfo.cszd

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
26	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xsfg.nwfo.cszd

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xsfg.nwfo.cszd

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xsfg.nwfo.cszd

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xsfg.nwfo.cszd

com.xsfg.nwfo.cszd
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4969

com.xsfg.nwfo.cszd:daemon
1⤵
- Loads dropped Dex/Jar
PID:5028

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xsfg.nwfo.cszd/app_mjf/ddz.jar

Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.xsfg.nwfo.cszd/app_mjf/oat/dz.jar.cur.prof

Filesize
724B

MD5
df1ff980a354417d0c471130c49de84a

SHA1
ec6f5a0c8501b74abb9b35ee5e72cc245be59a6f

SHA256
8628b7439382f5cf1d2ffc743a19cfb34ab6444186c21755c919b23586967cad

SHA512
4b1761a91eb352dcafad7e33405e9416028ad859e975a16d8a72cda68e9f6a10ba09de0e77e9a6d7518dc747d33546d31f9aa63803b319676bf0fa092e19e889

Download Submit
/data/data/com.xsfg.nwfo.cszd/app_mjf/tdz.jar

Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.xsfg.nwfo.cszd/databases/lezzd

Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.xsfg.nwfo.cszd/databases/lezzd-journal

Filesize
8KB

MD5
d7d3bddb22a3622d4f4f41d08d7cb44b

SHA1
0880b09b276dcce4f9ec7b9b6d60a974ed85a302

SHA256
c9b91911e1732c2fbd7789fcdbd6ee2965ae30ef3dd122db7ae5431793d37786

SHA512
47971b4890e798df3996ecf1706f6fee9b6c9996202359eaf5d238c87120fcaa06fef67fe10d7d576ae517038498b37d90414ae220ab88d3d9b238876fbf8cb6

Download Submit
/data/data/com.xsfg.nwfo.cszd/databases/lezzd-journal

Filesize
512B

MD5
f21c1df73204c81d01dfcdf313488de1

SHA1
c37e0717269454ee1dd701846132cc1e9d39c663

SHA256
2e627df1b67ad1df61ece0fce73a9fa6bdf3c8c26b7d7cd15b223af86e7a3e9f

SHA512
66170f8fa1e16ee959592f0dc82ec4321c82a20ac0f2c7b337b90149d65832e53db81e1fcee04fee5ffd189f35c3787bf21ae83105e034367224cd19fd990d73

Download Submit
/data/data/com.xsfg.nwfo.cszd/databases/lezzd-journal

Filesize
8KB

MD5
474d46d4d1976570928d9eed97aad4e9

SHA1
c71d2e2dd4f7cc72e66466f24225161191693e4d

SHA256
721da1f4d369580db082c0ca79416ec518b533359cb88f9e79343ade1752d780

SHA512
6aebaa2237bc648ff87dcb1f76629f03aae2fd920d34cc0e49fde917d9ad440ecf0ac4171f45d1ebac8e72dc0498b5905d21e14520f78ae04e8cdfece6836e2a

Download Submit
/data/data/com.xsfg.nwfo.cszd/databases/lezzd-journal

Filesize
4KB

MD5
8e22efb943e25e64c59d53976cf78751

SHA1
d8a350a475c5757b9d31a37dece6978cf53249a4

SHA256
cbcca7fa5f784516af44f04933407232641ee361edac20fb476f285a041048b4

SHA512
db88734c5ce054ad550063dbfc3e1489e5cbd3c3c364223ec2e2573ae2555777f38e74e1551b07aad93d15f28b54f352c66146420213550a9e29c313039af0dc

Download Submit
/data/data/com.xsfg.nwfo.cszd/databases/lezzd-journal

Filesize
8KB

MD5
303dacc32040e2dd4a42f002f69e0e58

SHA1
5a6fc6cbd9873405bce66600fb42bb1fe8ff52cb

SHA256
bbadb054e61d21fa7cb3af4279de2686570cbe0d8e6c2c77a4713163de3f2e1e

SHA512
8fcbc8a87dc1ebff1cc56588ad36014e582be10bff8840ac6a53b211d08ccb5c04c0d912a00270c8b09db8847c91b4ff1c79ea2e828198e0c4b2e4fa45a46d36

Download Submit
/data/data/com.xsfg.nwfo.cszd/databases/lezzd-journal

Filesize
8KB

MD5
4fb7ad0dc0e9fb98270e61bf87fa5a0a

SHA1
1ea6d329cbd1d59a954cb429654eef42bac43d65

SHA256
9fdb78b07bda94af783cb14ee5a82b245b177f016c30bae7f5b58ebfb1857fbf

SHA512
16b5c9f95dbf9b457f2a5bed71f0f0ad22f6b37143bcdfc461e060e5c3f432e1bffb984614c2abeb8cca0da4209917811d95546b7c795160309f27c04d3668cd

Download Submit
/data/data/com.xsfg.nwfo.cszd/files/.um/um_cache_1728936703161.env

Filesize
659B

MD5
5d9c8deb6e6b68b33583b961d714716a

SHA1
a8abd3661fc76b5c7ce7b0774e1c40ed2c83ad3c

SHA256
0985ad75c9e33b901fdb1941fa2ed380046e3ee9944ee9b2afbead7ae94add58

SHA512
ef060b1b762edc3966c42d206d4c231f984bd5af03f65f91be329919fcb4d0c3e65a1e0794c1a8965ae0b9ff5b9b0fe0ce9a46bf65da05123251472e6c66808c

Download Submit
/data/data/com.xsfg.nwfo.cszd/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
48ebb1003022d85c43643b52d35c1688

SHA1
d0f4d64f67c00c734afa7bd8c133fe592cf68f12

SHA256
28fe8021513fe8568b464548cfd23f6aa72ae3d7334af09bfc496780fd01ad23

SHA512
9f015536c67e6f39ee74d540dd4696f1ff52470f6e03eb34ccda96849c77e2d74a96489ea2259412b6fa90a3e906cae2c0a8c31249b94fe52f78e4a310ec1634

Download Submit
/data/data/com.xsfg.nwfo.cszd/files/umeng_it.cache

Filesize
352B

MD5
5056e0129b9163b881bf3f3cc43ef955

SHA1
824ecb0eecd69416322c90c87a624d4efb205e56

SHA256
ba0dfed91260dfecdc963d37faa00a4b460a95fd6fc55ce17c579c71dff5e8c5

SHA512
9fd06d1c6194a9b6bb1e689f78c503d6d642d9a49c509022f65e70cc7eec3ce7bc816da3d676ac4bd05ad4a0e911e845ab9978adda9fdf38d59c2218071a15e1

Download Submit
/data/user/0/com.xsfg.nwfo.cszd/app_mjf/dz.jar

Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads