05b76758c91317a3760aceac85102cba2c53876f4f1f420f46d6b62df180d2f6

Analysis

max time kernel
149s
max time network
152s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
16/10/2024, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4eebb969a2d98a15de9dd33f30cc8ae0_JaffaCakes118.apk
Size 1.3MB
Sample241016-zhdecavgpm
SHA256 05b76758c91317a3760aceac85102cba2c53876f4f1f420f46d6b62df180d2f6
MD5 4eebb969a2d98a15de9dd33f30cc8ae0
SHA1 f4c87c392a9474479f91f91c444f7da5b8b3011c
SHA512 06715f51cbcebd2acf36887fc84d7fd8de02a5b372212006d9c38cb0a4335631dbe98e8da29d84c27bf94a482f62400c906e616629a945b1f11754e68606dc67
SSDEEP 24576:rl+6LROYGYnCFh0Qu4+ltlrlEhNSeVz80sNpKjQT9jOFiq/13tdHbZKm51Ob838:tOoIh0u+xrWS9a8RjOFiq/1XHNKmjbM
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4965	com.ilhb.busg.xppx

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ilhb.busg.xppx/app_mjf/dz.jar	4965	com.ilhb.busg.xppx
/data/user/0/com.ilhb.busg.xppx/app_mjf/dz.jar	5021	com.ilhb.busg.xppx:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.ilhb.busg.xppx

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ilhb.busg.xppx

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
23	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ilhb.busg.xppx

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ilhb.busg.xppx

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ilhb.busg.xppx

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ilhb.busg.xppx

com.ilhb.busg.xppx
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4965

com.ilhb.busg.xppx:daemon
1⤵
- Loads dropped Dex/Jar
PID:5021

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.ilhb.busg.xppx/app_mjf/ddz.jar
Size 105KB
SHA256 4225d0ce3922e9bfd5828c3507b26226b8f08f3b03d8fcf594dbf36835a9519e
MD5 7f1e0fe2e6a0618b6c84d48ea0586b6d
SHA1 dea54fa91f9f431b85e8c4048244a1c3c4b16665
SHA512 7a9e77b9ee66c7cc5d406389c8dd4f344b02c8449cfcd581586d16ce895ed0fa77f6fc8c767c32b92e75863d8133422b4ed3057f54999c3fef031146602e5df6
SSDEEP 1536:NFp64lYvFUa2sQ8bKC55ZRh6jBfq7LRSqG3uZtd59DQe4AQ9aJP:NFp6OYny7CSiF9QZr9ax
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar.cur.prof

Path /data/data/com.ilhb.busg.xppx/app_mjf/oat/dz.jar.cur.prof
Size 728B
SHA256 c71291003819b4d6d61a7adbf72acbb573146ff51fde70280a69e970ad01e296
MD5 29dc5ef5c672dbd524b5846502ce9e77
SHA1 1db696acff934175f2bc31feaf64b91f904268ab
SHA512 dc4f05b508f7b7e533be9bd0eb4c4f517aee6578cb1c8d8c9727d40319fff2e57d7f9848ac996cfa4282628976b689955254e74a4c1ecaa48b5c70bf9ed7d83e
MD5 SHA1 SHA512

Submit Download

tdz.jar

Path /data/data/com.ilhb.busg.xppx/app_mjf/tdz.jar
Size 105KB
SHA256 7f4e38a3ac4fae5a400648d200d8b9897dc28606722dba44c43e5582182e5fe9
MD5 fc1eb8c18ddc0f8727b5fb5eba8ca870
SHA1 af6d64fe2432bece4c523066a57f35be8f175a48
SHA512 25e5c0eafb925a6b3c6d9f8622b95d07fd8e63be2689859733b10ed65fa7f7e56e5453da64d9bd7bd7c3345f6c1a90a5dd34de9b0788f4ba080689758d5d4e66
SSDEEP 3072:DTcLeODiZGh1DKga3AYo5he+lxIuZRnAUIgwYt:DTcLCZa+AYoLLb7Irw
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.ilhb.busg.xppx/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.ilhb.busg.xppx/databases/lezzd-journal
Size 8KB
SHA256 8aec737ffb1c702c69da85b1516d48a52d5b415dd06120df2c2cd8c58ad4484a
MD5 73226a3efec7c91d59cb2d9f609aeba7
SHA1 faad73a3cc82ffa379eb0cf876f2aa68591f3600
SHA512 61d6d05868ca82db877a23638375444491a7538c1204620b2bb6781974ea1b56a5363b23425ce1facbaf45ede899b10a91e5e23573b8093307df02d5d60ba5f9
SSDEEP 12:7+tFTqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbfA:7+tFqLGqteszXtUku+haaL6nwyLGSf4B
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.ilhb.busg.xppx/databases/lezzd-journal
Size 512B
SHA256 866e674b40358f9d2a4650093560d5ccaae21480512d6efc61d7f079acfd5634
MD5 5b1c1ae729f6f6ffefc8ae073926ad2c
SHA1 b200f90e16dac9d36a240643c7147c3a70f43cbb
SHA512 39fb7e1df4379de38fe42f9a7a89f3950946ef5153ffdd46af02e6c9a8a952e8cb9aadea2093a254f929486bb03052f03cae828b6124afda1f5d355c32cc03c9
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.ilhb.busg.xppx/databases/lezzd-journal
Size 8KB
SHA256 6d57d5e35e081f2bf7e87eb7aaa85bd57d88d7aa53c0d3054af6552179bddc9e
MD5 5a36a4f6545b290ff4c9af4259490171
SHA1 ad7e4cfa45dc6d927b69d3fc4de17cb591c89583
SHA512 1e26975330539a72a89dcc80db3a3a99e088d4ac70f044961114643a0f020631306e15102501ab0b324fc85c8bc2cca584fb736e7d1fa3a6d49022d4a100d8a7
SSDEEP 6:7+/l97n1Ypg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKV:7+tspqLiuWdwRmBEyPbG
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.ilhb.busg.xppx/databases/lezzd-journal
Size 4KB
SHA256 a2f04c0c1a0bb1fc64740a3b6797b49d7cf181832f1d768b6a289a2d4cf574b2
MD5 166646fd79a248eb4cad87b8aae98376
SHA1 28be0d9538ac5f93a4df901112cdce4d572cab78
SHA512 f6bcc221be3469bc6a32867af4c749ae1bf7c513dbde9d3992c4a8214a88a040250df93b9632fd9e976e86671f545ca6424d543c3e00e894e3e071b502376f44
SSDEEP 6:7+/lDPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK9m:7+t7qLJdTRmBEyPb8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.ilhb.busg.xppx/databases/lezzd-journal
Size 8KB
SHA256 24c4105176a2fe81ef0e31784a8a7426f074834dcc93fcb91a0a5e4c1a578e61
MD5 6c2c9ae2f8d1304f98ac09a98fd0c023
SHA1 bc43f8cb10ed3babbc37ad565b8a56a0b6194fe9
SHA512 8a0b75d0de4d569e7cf645bad565baa99c6f974035aec3ea383c30c27d28a1af242c63e2385a68453efc69f578568bfcfc0a96a023f4bacdfcaac31bdda9b151
SSDEEP 6:7+/l9cPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKQK/B:7+teqLmqCRmBEyPb2B
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.ilhb.busg.xppx/databases/lezzd-journal
Size 8KB
SHA256 ca69e937df43c90a25f28c0ab196b99af51d123300cb64af8a24ab48e20b5b92
MD5 7d72bcaa6972a3f76e9ae800bc5d1edd
SHA1 c4a086d9930ed5d043b75bf7a0e24fe0d59a62fa
SHA512 e0c860de7a568e337f5acf2ad097549d6a9eb0679ce1a41735d97bb8689e85f098b8292e2cff2b4ff6e8c483e40d9cd5b553f5e7c6259ffb74bd5eeba93d81c5
SSDEEP 12:7+tb8nqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbXF21:7+tbkqLy9yUku+haaL6nwyLGSXFI
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1729111482886.env

Path /data/data/com.ilhb.busg.xppx/files/.um/um_cache_1729111482886.env
Size 654B
SHA256 d50e23c9fb934432eea391465eede29a151e51d522e5e758d136f221251b2c8c
MD5 193379ff31d431b9c7eda65e6445766c
SHA1 436769eb7f5a916c5d8b3c97a5d5180d30315241
SHA512 ce8f4e7a8a7cbfbebad94ff1849ed4ad49e22ca0821759bd9d0bd26065643ad4ccab5d24fff30079fe6b5e19ded43f7020f8efbd4390b651c19729b652dcb3bc
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.ilhb.busg.xppx/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 31a9112cc5c2c216ffe46255882abddfe893dc026bdcf48536a3b62e2e38c2ab
MD5 9b04d080392ee9e31d3fc5cf92046a83
SHA1 cf89d31ed7df6025d54c0409dc537056fe1d70bc
SHA512 bb3f002836b663ffc1277855b43251beac7577c6d0c036cf13fc6bbb6d4491d6e3e929f63a305a10c0bd79ab6f9e7aea6d915bc6c3855bd53729fc88885cb2f0
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.ilhb.busg.xppx/files/umeng_it.cache
Size 350B
SHA256 5472f44cf13e9ddbcdcb94277eb34c104a5ffbd4b9bf363ee02d3a68f09d304d
MD5 a31226f53b70c3145f7677de143bf854
SHA1 114a9f43cfcf1f1f739708bbb90002a93abfba6c
SHA512 b8d09ae5b013ebbc61755cd0d1b700dac71b73c7a25a15522471b074846f764c0b0ed8c41e473d28f6a41aa0dc21ccc4f5d050a43dd2b6f5cedaf22b3cbfc9e1
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.ilhb.busg.xppx/app_mjf/dz.jar
Size 249KB
SHA256 830643d652f95c85fa7665c202f93822b08f106cfeae9202a8a7d894292a36c0
MD5 789a4162427149dd5e519f917ead0e29
SHA1 d2bd738c28ec21c0441c6daaefc206a6a76f8e1c
SHA512 b6a8d5c20792cea1035a7f7684bc03b3f184a0bbba3f5c322b26cc75fd50002e749882d6ac6177a93115ce93b1b3d4721f4449d2007ad700e0633a11579f7e37
SSDEEP 3072:Ssa5O8+ZfL6xb7QHNH/5ktKuniJDvbEaXqgXoL1E9h+N9w5E4y9sn4tefH6Tvcd3:pgOR6xbyRkYOaXqEoL1y5EgH88
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads