2124dbc520947e85d1d43ec8aa9da039248ea1e001e346845190d27d4335800d

Analysis

max time kernel
148s
max time network
151s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
16/10/2024, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f2f53209d19b63c752db43fb4f98e08_JaffaCakes118.apk
Size 765KB
Sample241016-1kwjdavblc
SHA256 2124dbc520947e85d1d43ec8aa9da039248ea1e001e346845190d27d4335800d
MD5 4f2f53209d19b63c752db43fb4f98e08
SHA1 9c66b6ccc12c0b57d0b0ee1b98e5e35e4967f121
SHA512 c04c0754d9a3a7d0605dbcb215936b65eacabe4192002f89fb6e470ee90a3c9affc237b08e9b9609ca477a995bd7122a3568f15d2d5a8e7ce1b1ee5bd810a8b3
SSDEEP 12288:+3x4L4oQI8Y0FotaKIUtrbMP2IIoYuc7yXqJi033lXCULd+GMjkWhdv3lbRSxsMD:EoL0otaYtXMuuYuMyXc3NXx+PoWLxc2o
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4976	com.ktz.yix.uhb

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ktz.yix.uhb/app_mjf/dz.jar	4976	com.ktz.yix.uhb
/data/user/0/com.ktz.yix.uhb/app_mjf/dz.jar	5039	com.ktz.yix.uhb:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.ktz.yix.uhb

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ktz.yix.uhb

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
6	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ktz.yix.uhb

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ktz.yix.uhb

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ktz.yix.uhb

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ktz.yix.uhb

com.ktz.yix.uhb
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4976

com.ktz.yix.uhb:daemon
1⤵
- Loads dropped Dex/Jar
PID:5039

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.ktz.yix.uhb/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar.cur.prof

Path /data/data/com.ktz.yix.uhb/app_mjf/oat/dz.jar.cur.prof
Size 730B
SHA256 2d6a60a777bb27736ed750cf28dcdd0ffa470daad8cb826e85559e10815fa5ee
MD5 a3919126af5900f0704ccb5757691a8e
SHA1 55ef72bbbd37c016ec47a81ffe9b9e909db6e867
SHA512 306a0e5968b10fb86f33d40d53a0af493248ee05f6e81630926ce53b2fd4e00bd7b22cf12f6b345c9a63f3db26d0c817eb861c37c4c06320e9d707d94a9cf276
MD5 SHA1 SHA512

Submit Download

tdz.jar

Path /data/data/com.ktz.yix.uhb/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.ktz.yix.uhb/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.ktz.yix.uhb/databases/lezzd-journal
Size 8KB
SHA256 28e312548a966bf06f7c6266bb4d287fcd263e01b2880b0812708cd25a585df5
MD5 2731f706fd97a0cdc255bd1cb7664d25
SHA1 fe21f0a47b0512eade2edab71219cbedef26bc9a
SHA512 b253eda4235077cec196e03328ff09447c5cf757fcbd8c005bae350e3a93e35e9cba7f73e4e056b28881051f387c7501e14e48fbd00bd881d4fe4414b3b4a975
SSDEEP 6:7+/l9HZlGn1r/pg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKW:7+tlbW/pqLiuWdwRmBEyPbt
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.ktz.yix.uhb/databases/lezzd-journal
Size 4KB
SHA256 cbef91e52460c17aa6a3ba8817454569c96c4702d12a59518b033240997c27eb
MD5 be0c4a65f1331e16e27417b25f816ed8
SHA1 be80ccd2ccb29af27d80ea3718e2366a5bc01ba0
SHA512 6f9e783e2ee4ed4611d94b00a49295448234e82bc35e0266b5fb34ce11a52037e16778d9c36af1af897c40a4d8e20d40f2dc67e4856008224716a055ca7ac9bf
SSDEEP 6:7+/lb4OPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKg:7+tb4iqLJdTRmBEyPb7
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.ktz.yix.uhb/databases/lezzd-journal
Size 8KB
SHA256 91a6c2329eb29d977dfc0fb6447811d5283ef9b9c1a9758373e2fa187751fe90
MD5 aafa51d080b12980821bb4025f4ed134
SHA1 9468ad452d19d004a806ae00f567bbd68306a375
SHA512 9a70b70f63c3ba7b021725b8108d9471c9c17668f4ea3a7634671f57d61158b03cfdbd7497427555774cf18c5ea383d5508071055de41b067a22f09c0576092b
SSDEEP 6:7+/l9T/8HPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKa/C/bn:7+tt8vqLmqCRmBEyPbkb
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.ktz.yix.uhb/databases/lezzd-journal
Size 8KB
SHA256 1c977017969666966a2fd5da8ee07c550c9318114d2fb5fe2ba2c9aaae0beb63
MD5 a5dc377f827e1b06ea63924b4d9618f5
SHA1 1cce3921495820076ea784e083e3b509fe3021d4
SHA512 3b5f6aa77b937b13e5ed26b3a68bb52f583c6fc323403e1c03e5249c4ea3318d3255d8872b00da69b9d194ce11b8557ca89d56b3150ad1f10a7bf7db46f48398
SSDEEP 12:7+t/nqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbRg8U:7+t/qLy9yUku+haaL6nwyLGSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.ktz.yix.uhb/databases/lezzd-journal
Size 8KB
SHA256 f10176ab12c8d5432fdfd7d9e8e5a65ed70bca1172e091e7f37161f5f686cad4
MD5 457a11a2f1b4febb5ea496a7ea46ec10
SHA1 8680667b5f1701dec30d6017af10b07cd2fc5e3f
SHA512 1ef0cfdea4fdd8287138b985c5ecd1cf1ff20ebc0d66dd4ecc86792e0634f7749a7d2a471480bb2210681836c71cc5494d513a2bee7f00c2f785fbbb710b70ce
SSDEEP 12:7+tRqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbtr:7+tRqLGqteszXtUku+haaL6nwyLGSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.ktz.yix.uhb/databases/lezzd-journal
Size 512B
SHA256 bfe97cd1f755e430c5475f20ee0ab42f11386f7305f7c26e83815373a6e20641
MD5 48a7ae526ff0777b81e7d5e44ac74751
SHA1 d6a9cb7c37ced7a8a972b01a93ee31368dc9921c
SHA512 650aed2a5b71d9b3425b9828ac4ffa485837cbcca908067e006c6c10cb55d5d95f55568d9856ac1dfc73cdc8a2db73e9f90d1a36f012fbfc5fe4719a5e00ae8e
MD5 SHA1 SHA512

Submit Download

.imprint

Path /data/data/com.ktz.yix.uhb/files/.imprint
Size 927B
SHA256 a322c0ed102d4a6800539247689196b2b065e29349a5db5d3588fa629c3dd29f
MD5 290f14e30fcbea95b95163aa353ff3d1
SHA1 a65ff01b4ddd5a759edb9e7ee48692096b077150
SHA512 ca370b840c47d87ff24f3555df8a1194c18da731854e9bdc241f5a0fc6d2d04c8c3cf972f3c69f0eb14328b10726ca118f70e7683fb7190651c78f63d8ac9fab
MD5 SHA1 SHA512

Submit Download

.imprint

Path /data/data/com.ktz.yix.uhb/files/.imprint
Size 927B
SHA256 12b8e2a4254bf384987780641b58e98e080c965c03db88c9f955ef2160bd6153
MD5 9f34187bd288cf853c8a4fb6d8058416
SHA1 61284b3883e9a3332970605010c99b4838be8ea4
SHA512 534f4ab127df67d031d1be232349cf55c13ac3d8cca05abfe0813c2717805f73a19de0de7a1ea5e9f6b9924ebcb2ad4e850b44e8e2953631f29ad7c6d22b2e74
MD5 SHA1 SHA512

Submit Download

.imprint

Path /data/data/com.ktz.yix.uhb/files/.imprint
Size 927B
SHA256 d71e8b94b4629e6089378f2d36bf01bb96db9cb2a6cf05abd552763648c2f0ac
MD5 82c2c9598758199c19ee05635eb17753
SHA1 4ad8d69811e654b994ec84d7d1a38e4e74100552
SHA512 88ad19f5f274b36c7be02fb8f5970958d392341f5e931ea633674e466ad7231b9fedcdb16deba197e62ac932885c1f0b93bc71a5a2eedfdc71e04630274cdccc
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.ktz.yix.uhb/files/.umeng/exchangeIdentity.json
Size 203B
SHA256 c06355572d30ca806495e15f85c3794ff9a695337b3c1e7916c8c1ab68a103ad
MD5 d848600f88fb20c10a18d4a94600b446
SHA1 9cf0f271b2a319c3d838e5f8333df5906eb9b525
SHA512 273f14df884b4034ac4108046064e085e22138d9bec81c1dec325fe9401860374d5b33ca620a5442a065ede9389da9ba4140ed53ce6f6a0d6b0f969d4d8bf6cd
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.ktz.yix.uhb/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 0e430dca091b58936d8df2ce4e5524040c47aa0b68b97092071b416fbcc63666
MD5 6e21f71b57439b05d030aa4b06dd0b06
SHA1 4568a64f84e6ca683b2f8c7fdca4a93ac4b61c52
SHA512 23b626e9305c885772f81ce09880fc4698bfed14568279acc43bf6c9763f3e971311b09e9f2111b3aa75c45cdff60eb97fc25245cb486d7393b5e63dae38fa2b
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.ktz.yix.uhb/files/umeng_it.cache
Size 350B
SHA256 96924cf64e4319897a6c9b082eae7e9af3c251415cdce366897e23891754c941
MD5 e4458fc2dcea780ae3ffada99e044d3a
SHA1 7335f4c55bebbd0083d7f171a88779a25a8beed7
SHA512 8dcc3c152023666a08597199eefda593b3f6ed244491712bc1331ff545dcd106d3ca8243e0f6ce4b7b6eb20e39b7065838a47043f4db4c464851d286d163de28
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.ktz.yix.uhb/files/umeng_it.cache
Size 178B
SHA256 464e407fbd38ef88f8884a176358fb6496313995d9a4155222fa74536e2611e7
MD5 6cf3ee11e361a2d794720a5cdbdd8ec2
SHA1 e45440616efe103b0eda97f5dcec1f3642386585
SHA512 a65722932981947127c377d4577fba885ec69797f4f21d70aafc346a78e2069011c353e6e5961175c24b40375dae4fe18aab125f249800499ca392121de6202f
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.ktz.yix.uhb/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads