1c3b5517a71d4610f330b94c3c8b977cd97dbdf769cad0e620e8c1cf9eec4376

Analysis

max time kernel
149s
max time network
153s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
16/10/2024, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b54f2170e694d6b89e0ecfd2e44ff74_JaffaCakes118.apk
Size 1.3MB
Sample241016-epgp5asakf
SHA256 1c3b5517a71d4610f330b94c3c8b977cd97dbdf769cad0e620e8c1cf9eec4376
MD5 4b54f2170e694d6b89e0ecfd2e44ff74
SHA1 48ed996d502b7030f5a9151326d590e6fc2712e0
SHA512 d0de16f7e67e28b5de9e255fe04d67f85cec626dfb52948cf824eeb493bc046f56cf1b6dfa5a4cc77d3000ce5ebb6eb0b354082ce3c5536a1238dd96acb0b00f
SSDEEP 24576:TeaoL0otaYtXMhezuEKvUcGmSL534l40P3o+swjsvwq/13tdHbZKm51Ob83Q:+Q7YtTzTtcdSL5IRPLhjsvwq/1XHNKmo
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4970	com.sixz.ewxd.hody

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar	4970	com.sixz.ewxd.hody
/data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar	5024	com.sixz.ewxd.hody:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.sixz.ewxd.hody

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sixz.ewxd.hody

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
25	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sixz.ewxd.hody

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.sixz.ewxd.hody

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.sixz.ewxd.hody

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sixz.ewxd.hody

com.sixz.ewxd.hody
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4970

com.sixz.ewxd.hody:daemon
1⤵
- Loads dropped Dex/Jar
PID:5024

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.sixz.ewxd.hody/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdz.jar

Path /data/data/com.sixz.ewxd.hody/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.sixz.ewxd.hody/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.sixz.ewxd.hody/databases/lezzd-journal
Size 8KB
SHA256 b2cafeb893f591b87d2f56fd4ed8bb71e7965a2ae1381e9e734221a9bb761bcb
MD5 86b51bb13907a4d10f484c909a3b013f
SHA1 a968def6a18ed2a8fb8a94820ded12dba816c3c9
SHA512 2af3afb05eccced3cdabe086cb75397d3f52612c602414e04c9faf180757f1bc73f495d6f884b7a4ed8dfd3bdfd7ebc633eb770737c95e132d23901289451c54
SSDEEP 12:7+tPFqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPba1:7+tPFqLGqteszXtUku+haaL6nwyLGS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.sixz.ewxd.hody/databases/lezzd-journal
Size 512B
SHA256 f9e12d4e6683d84216f76dcfa8578434c3ef21cb562b22a6948ae798d9b808ba
MD5 288ef4c606352d225878f88c8be29d62
SHA1 a44cf94cbd07073b49d6149eb8c6388a77fd4596
SHA512 44895b7840d7d0672e83bf8454c931864cc3bf8f29034b52321356ad5308c59280010ccea2b647dc2bc5a2236ce76987b315963c2d2236dacaadc558229a53bc
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.sixz.ewxd.hody/databases/lezzd-journal
Size 8KB
SHA256 47586904fe9d080083297e158898d2d5c9873ab043b3152bf52df4e816b5ce5c
MD5 015a2cba9c8068a37b6df0b41a48e904
SHA1 39578782c2a317673f98f6413a3330f983bf9195
SHA512 5aa6d0290adf562ebe73f004578760934cab5882842ab595c47a1f27f83ade184862f62de09ba08059dbc5379726c3edcf63fe95f82a51f4fe4e422a2fd750aa
SSDEEP 6:7+/l9P7n1gvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKMg:7+ttSvqLiuWdwRmBEyPbG
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.sixz.ewxd.hody/databases/lezzd-journal
Size 4KB
SHA256 7f118a5d27e5d602b84afc43f1abbf44904a1072207e931cbcb5a45c65200a23
MD5 8720ec0aa920c368374dbbf7b0428e86
SHA1 23405da8ef4fd5fbd5ddbf590afda8175df12f3a
SHA512 2a08b44133c2caf1386a52132f9abf0be3f692ebdaef85ec08d85c8f784993fa337d3be9450c5b1709ba6b0294470386aa3f06fc92d1b883a6d599a6f88fca58
SSDEEP 6:7+/leR/0FPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK4z:7+tO8BqLJdTRmBEyPbB
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.sixz.ewxd.hody/databases/lezzd-journal
Size 8KB
SHA256 89bda10b961aa214937615fe95fbe10ce3041745f010dacfeaf3a03be3e5d2e5
MD5 27e4498a8167c5b595f8fa1759675096
SHA1 13d751bb874eda866ac61578af84895e2930cd69
SHA512 54b60488c34d19d3ddcb80d7c8489a5348da6128ad5dfff84658e6d11431a549cb9abdf1e3a70f617e9a4aeea93acc12177852ae245fee444292a4efe92b1a8d
SSDEEP 6:7+/l98Pg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKw0/G4:7+tGqLmqCRmBEyPbuh
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.sixz.ewxd.hody/databases/lezzd-journal
Size 8KB
SHA256 b2ddd2b086bc359750811d19582626ffe489db123b0ae77ac9cf25acca210f6b
MD5 5133d8ac8c989e4668e983ea68b32649
SHA1 8ee2a8533c60dea9b4c6066581d347f7f9129ef7
SHA512 4408d72abf2926e33c29d5b22bdc8f9fce95e9f72392044b29d72909adc08d098d4ddeb417f16bf532994adb393d0eb0699f0878cae235b945df4f96710059b5
SSDEEP 12:7+ts8nqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbPe:7+tskqLy9yUku+haaL6nwyLGSG
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1729051726138.env

Path /data/data/com.sixz.ewxd.hody/files/.um/um_cache_1729051726138.env
Size 655B
SHA256 d2069d8595c55d2263fc4885329c5c19c769c2e93959dbc70841dbd5b1ae700d
MD5 b47f6db91830bf1f53a319a2090dead2
SHA1 41dc0b3b65cc2055f4c51f321639984c863e593a
SHA512 36a460471efb2a8e38ca2f8edab129fddc0c784f91aa355c280a6bbdc3a22b6fabf1bc5c22e51b4e49e8af8701b1f095bfc9b7a73b5468fc214b8d65fcf520f4
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.sixz.ewxd.hody/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 0f758542f872e31d1b166c0a4b8c77552093eb1f65856bffa64c015f0aabfa19
MD5 d7a0bb80feb3f96df919e3f3423715d4
SHA1 6b938b13a810ae158a5902626ae38ae5386d0320
SHA512 1fbf94cbadd1986d7a805407744a00cfbba66123f299e7ddf95a399a25a26c2531ae2765f2fd10c5b457d376d76dc60c0cedcf169969dd72034ec8df86c104a1
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.sixz.ewxd.hody/files/umeng_it.cache
Size 350B
SHA256 7527e191cacab7a2ffda0b80dcd07e716d6758bfeac954828a275373caa6f2f5
MD5 19c7bbfc400fcaa8edea9387e40c1e4d
SHA1 4ad1298dbff098445245a43e7785dd58e17c3104
SHA512 b16593479893c9967a24cd82495752e0d512ffcd6c5091bfcef88166c87fc13036c3ca705d574da308494ba4cc87d7f711ed7278be2f6e95c9052eaecb2ef67d
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.sixz.ewxd.hody/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads