2124dbc520947e85d1d43ec8aa9da039248ea1e001e346845190d27d4335800d

Analysis

max time kernel
148s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
16/10/2024, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f2f53209d19b63c752db43fb4f98e08_JaffaCakes118.apk
Size 765KB
Sample241016-1kwjdavblc
SHA256 2124dbc520947e85d1d43ec8aa9da039248ea1e001e346845190d27d4335800d
MD5 4f2f53209d19b63c752db43fb4f98e08
SHA1 9c66b6ccc12c0b57d0b0ee1b98e5e35e4967f121
SHA512 c04c0754d9a3a7d0605dbcb215936b65eacabe4192002f89fb6e470ee90a3c9affc237b08e9b9609ca477a995bd7122a3568f15d2d5a8e7ce1b1ee5bd810a8b3
SSDEEP 12288:+3x4L4oQI8Y0FotaKIUtrbMP2IIoYuc7yXqJi033lXCULd+GMjkWhdv3lbRSxsMD:EoL0otaYtXMuuYuMyXc3NXx+PoWLxc2o
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4496	com.ktz.yix.uhb

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ktz.yix.uhb/app_mjf/dz.jar	4496	com.ktz.yix.uhb
/data/user/0/com.ktz.yix.uhb/app_mjf/dz.jar	4567	com.ktz.yix.uhb:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.ktz.yix.uhb

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ktz.yix.uhb

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
27	alog.umeng.com
67	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ktz.yix.uhb

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ktz.yix.uhb

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ktz.yix.uhb

com.ktz.yix.uhb
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4496

com.ktz.yix.uhb:daemon
1⤵
- Loads dropped Dex/Jar
PID:4567

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/user/0/com.ktz.yix.uhb/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar

Path /data/user/0/com.ktz.yix.uhb/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

tdz.jar

Path /data/user/0/com.ktz.yix.uhb/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/user/0/com.ktz.yix.uhb/databases/lezzd
Size 28KB
SHA256 194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
MD5 fdb8a92e5060ce104e8f0faca55a47ce
SHA1 270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA512 ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122
SSDEEP 24:TLj0kSBieszXtUku+haaL6nwyLGSiGQQ:TskS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.ktz.yix.uhb/databases/lezzd-journal
Size 8KB
SHA256 ed8e6dd5e0bea6a6bf02c813fbff176fecc6f4904aa216c1d29e6a5d50001cac
MD5 c9294284b8db66135d5d3f436971d9de
SHA1 2fa1eed231b1073253c91ccdc57a4f19e4ba5e1a
SHA512 24f514be7833bf40ed0eb2cd893a6db2fa1f85d438476b39ffba8d4e669fac8c97ffd007d46bb1dc07df60a17562a8d3d12835f28601aa3748110d17880fdbc1
SSDEEP 6:7+/l9VXlgPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKIlM/hn:7+tF4qLmqKRmBEyPbPlsh
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.ktz.yix.uhb/databases/lezzd-journal
Size 8KB
SHA256 6ff3e7c5796f5f7c15470ef883921b2d6a597169b7fdf7cae2f21520debb4637
MD5 443a313ad6fc23a6943a7bd02d2b2829
SHA1 986c6ce95c557ab064b4bd013e6e2d40264de63a
SHA512 6078a02e9b476dc595aadedd745bc1492de615dc911c38bdde2011fef2111337bc2c6e4db85dd43efdba210a45ef9a97f1450fa6a0251a9229e3c261c92312a0
SSDEEP 12:7+t0nqLyKPjSyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbUd:7+t8qLy2TUku+haaL6nwyLGSC
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.ktz.yix.uhb/databases/lezzd-journal
Size 8KB
SHA256 d97111cb86b56930141bf23ea1f58afbcbe70d7a4be8d0250b82ce696c24de28
MD5 e33f085a5d35b215fa089a57826b26ef
SHA1 f5fcb11b2c4af9f6d68210508fc79c5fc990004e
SHA512 f00943721dcf1ebddf77b804d83b0a1f2f740c8ae1a1a35a121351889e54ade143c30c0de4439db23ebd6ec976258d41d067598bcac6059f517c530bd5bacc8c
SSDEEP 12:7+tE3l/zqLWem6QADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyb:7+tEdzqLu6teszXtUku+haaL6nwyLGSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.ktz.yix.uhb/databases/lezzd-journal
Size 512B
SHA256 d8c77bb79f30052fe7a196760eb748695bd68ac9695ba1b0e2aa8e7896ce459c
MD5 da29ddda3e0ea3f8a70ea21b53b8050d
SHA1 df3da7c81fb26984e3fd061d03b25a13df0a782e
SHA512 fd3d042c7e8677be6e77dfd2bef762d0ba5e9777610131f3a6342055ad8bdd38a3ca5c315e7a280f775b243def3d72602e683ca06bfdcdbea2568ab86d3f776a
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/user/0/com.ktz.yix.uhb/databases/lezzd-journal
Size 8KB
SHA256 80a5d160a4482ba6d1a47be6fe7d37345015a88f8ec3a59c11441c6971861c15
MD5 5bc122022668fc852387e36d1c9611ae
SHA1 d33643116a25c0839babb3974451b4c0c230fdad
SHA512 846078110a1435003b5681fd8256aa7333ad16320d8148bf7e6ae863b514b8e2b5748403e04fa2e864f947160431d1e619ea2a90e502fb2d0e821d54776245f6
SSDEEP 6:7+/l9Jn1SRg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKrn:7+tEqLiuWdYRmBEyPbs
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.ktz.yix.uhb/databases/lezzd-journal
Size 4KB
SHA256 b3306a5185227c4e48910eaa1a0418df4c1f9148203d680ae82b0daae6c1d832
MD5 eb2f5fa11c1214bccaf14aa14b2772a4
SHA1 de7f9293694d18c7a2ab4bba97e9e28df1992955
SHA512 b3125aa9f6764022db2dc50d68ae97a50c98b942a2ccb630343cc49a599a1f4b2237debe27494a6f8e368aa9d4396b1f87b5c69a90dab7078930e8c4752469ef
SSDEEP 6:7+/lpOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK8k:7+tpiqLJdeWRmBEyPb2
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/user/0/com.ktz.yix.uhb/files/.imprint
Size 926B
SHA256 1639541ec62764fc76fad6f47a9227583e120d46566ee7d2c59ca8b0b5812467
MD5 41cbffa8929287c85f6ec744dbe52686
SHA1 16163af8e6c2201a3facfc6b9246fe160dc73a7f
SHA512 a4d7ed24778c5dc689fed50dbc45775def69cb4e149309226187a4cfc4a024510633e3d14243136727d02accd53103e5cf920d9ec39a7a1d9c79243612997179
MD5 SHA1 SHA512

Submit Download

um_cache_1729115055079.env

Path /data/user/0/com.ktz.yix.uhb/files/.um/um_cache_1729115055079.env
Size 636B
SHA256 cbca90fb7fdc32ef2bab1606b700c1f4bba1d220cbc100da18bee8a1219917d9
MD5 adff7c1f30dd558c71f3fc982b77c9b5
SHA1 f5f598000742b8bd43b6d7e3a497a27b9710456f
SHA512 ea6677ecaeda3b85130deb0a841439995569c79b6462db4b0825830e5bc2612d7f2bfae2e0220e053e54c23437ecff92fed5ab085757f4f3b83a86fb918e5542
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.ktz.yix.uhb/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 b708ce307d3dc7a84d82b094c72fc95f4f90cee5ac209f556b6fe8107fd61778
MD5 0a6490551c97b125ffb0fbaf22737e73
SHA1 8be51b6db8b7d25a7aad4aa93c92655a1b5c1e75
SHA512 32ea1706b0498254e9040e6583c316cad75860bfa9197ba34e651cb69544d449c7fc2e001982181325a7c7ac7a9137f82b41781437f60d6ab4649ecb2f9f7b81
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.ktz.yix.uhb1

Path /data/user/0/com.ktz.yix.uhb/files/mobclick_agent_cached_com.ktz.yix.uhb1
Size 781B
SHA256 3dfa53300a320208a0d8f269aba05052f377c85cd5e086b24029c18797f3f78a
MD5 272dbc50ea1b17e80a61dd75be3900eb
SHA1 3115aff6b0a703a5cc858ddb39a8f9775f0cd067
SHA512 04d86032ac7578cfef45a7800f77c2e871465eeeb65dbd530e4e1b85fdfa3253b47e7494c299abda0fd61b88730d3aa230b6471c762f95d73fbe3b7039da0252
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.ktz.yix.uhb1

Path /data/user/0/com.ktz.yix.uhb/files/mobclick_agent_cached_com.ktz.yix.uhb1
Size 1KB
SHA256 fbcdb71e4f9ca0ddbb0ae7efbae4edcffd4d9ad571925e60db14ae222b77a654
MD5 2213c2d5dc33e2affab42e0cc14e29b1
SHA1 6ec659158a4e6c50d9613954b005b660a8177aa6
SHA512 ab010e8d7e19cb6baa6faf4e88676bfdb43673032fe6592f9e37be593b7dc4c8dfa6cc770a439f26d2e7ef42e5e0da0f72b9bff6a04ad998ca428d9e38aca24d
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.ktz.yix.uhb/files/umeng_it.cache
Size 348B
SHA256 2834882d429fa57debe1eac38909484da150d650a5d93bf8194d71c7fa3c57a3
MD5 a31379f0d4780f854a4f34a9fc940af2
SHA1 383c64b9633f5ca831992699db62ff9956b92264
SHA512 730332b7266efb6308bc66049eb912b2326bf94b56cd51084f72938f93237f89c8d704ba5cc00157861ba1fe200a527c0a453baa01ae5fe05eb88287724a4350
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads