05b76758c91317a3760aceac85102cba2c53876f4f1f420f46d6b62df180d2f6

Analysis

max time kernel
148s
max time network
154s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
16/10/2024, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4eebb969a2d98a15de9dd33f30cc8ae0_JaffaCakes118.apk
Size 1.3MB
Sample241016-zhdecavgpm
SHA256 05b76758c91317a3760aceac85102cba2c53876f4f1f420f46d6b62df180d2f6
MD5 4eebb969a2d98a15de9dd33f30cc8ae0
SHA1 f4c87c392a9474479f91f91c444f7da5b8b3011c
SHA512 06715f51cbcebd2acf36887fc84d7fd8de02a5b372212006d9c38cb0a4335631dbe98e8da29d84c27bf94a482f62400c906e616629a945b1f11754e68606dc67
SSDEEP 24576:rl+6LROYGYnCFh0Qu4+ltlrlEhNSeVz80sNpKjQT9jOFiq/13tdHbZKm51Ob838:tOoIh0u+xrWS9a8RjOFiq/1XHNKmjbM
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4480	com.ilhb.busg.xppx

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ilhb.busg.xppx/app_mjf/dz.jar	4480	com.ilhb.busg.xppx
/data/user/0/com.ilhb.busg.xppx/app_mjf/dz.jar	4543	com.ilhb.busg.xppx:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.ilhb.busg.xppx

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ilhb.busg.xppx

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
43	alog.umeng.com
58	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ilhb.busg.xppx

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ilhb.busg.xppx

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ilhb.busg.xppx

com.ilhb.busg.xppx
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4480

com.ilhb.busg.xppx:daemon
1⤵
- Loads dropped Dex/Jar
PID:4543

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/user/0/com.ilhb.busg.xppx/app_mjf/ddz.jar
Size 105KB
SHA256 4225d0ce3922e9bfd5828c3507b26226b8f08f3b03d8fcf594dbf36835a9519e
MD5 7f1e0fe2e6a0618b6c84d48ea0586b6d
SHA1 dea54fa91f9f431b85e8c4048244a1c3c4b16665
SHA512 7a9e77b9ee66c7cc5d406389c8dd4f344b02c8449cfcd581586d16ce895ed0fa77f6fc8c767c32b92e75863d8133422b4ed3057f54999c3fef031146602e5df6
SSDEEP 1536:NFp64lYvFUa2sQ8bKC55ZRh6jBfq7LRSqG3uZtd59DQe4AQ9aJP:NFp6OYny7CSiF9QZr9ax
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar

Path /data/user/0/com.ilhb.busg.xppx/app_mjf/dz.jar
Size 249KB
SHA256 830643d652f95c85fa7665c202f93822b08f106cfeae9202a8a7d894292a36c0
MD5 789a4162427149dd5e519f917ead0e29
SHA1 d2bd738c28ec21c0441c6daaefc206a6a76f8e1c
SHA512 b6a8d5c20792cea1035a7f7684bc03b3f184a0bbba3f5c322b26cc75fd50002e749882d6ac6177a93115ce93b1b3d4721f4449d2007ad700e0633a11579f7e37
SSDEEP 3072:Ssa5O8+ZfL6xb7QHNH/5ktKuniJDvbEaXqgXoL1E9h+N9w5E4y9sn4tefH6Tvcd3:pgOR6xbyRkYOaXqEoL1y5EgH88
MD5 SHA1 SHA512 SSDEEP

Download

tdz.jar

Path /data/user/0/com.ilhb.busg.xppx/app_mjf/tdz.jar
Size 105KB
SHA256 7f4e38a3ac4fae5a400648d200d8b9897dc28606722dba44c43e5582182e5fe9
MD5 fc1eb8c18ddc0f8727b5fb5eba8ca870
SHA1 af6d64fe2432bece4c523066a57f35be8f175a48
SHA512 25e5c0eafb925a6b3c6d9f8622b95d07fd8e63be2689859733b10ed65fa7f7e56e5453da64d9bd7bd7c3345f6c1a90a5dd34de9b0788f4ba080689758d5d4e66
SSDEEP 3072:DTcLeODiZGh1DKga3AYo5he+lxIuZRnAUIgwYt:DTcLCZa+AYoLLb7Irw
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/user/0/com.ilhb.busg.xppx/databases/lezzd
Size 28KB
SHA256 194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
MD5 fdb8a92e5060ce104e8f0faca55a47ce
SHA1 270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA512 ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122
SSDEEP 24:TLj0kSBieszXtUku+haaL6nwyLGSiGQQ:TskS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.ilhb.busg.xppx/databases/lezzd-journal
Size 8KB
SHA256 aa26f366d4c63b12b4233a4b1673ddf922ae20a32148872ab608941afc90e441
MD5 d5e93b3039f5ac1fc43a8e68eeee134f
SHA1 cfeec61bb63f10776a7a0351c6deb0779e7fc241
SHA512 fee91e48cf3d89d1b395bcb0286ced1682756118fc200faf7ad21f76f30ec075d439740c6c1fa84135c470035b2d8f4e2509563521476bcbfe942e8f2b2f8b9c
SSDEEP 12:7+tZqLWem6QADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbi7n:7+tZqLu6teszXtUku+haaL6nwyLGS+n
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.ilhb.busg.xppx/databases/lezzd-journal
Size 512B
SHA256 e0d7440300f89aaf18d911606f67a34348b23e50843037c1af8fed96c799dfd6
MD5 29961610c6ec674330ee37897df5de94
SHA1 4ae424d4943004b82030ea794ba3e6b0c0190bde
SHA512 48126cb742b38d65ac2bb8e7edc2a1e7e3db27e4b844df4aa027a8a91e94097810948a2d155c02490a1b6ad08a4869f983beb9f210ef745954dfe0abfbe7b42e
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/user/0/com.ilhb.busg.xppx/databases/lezzd-journal
Size 8KB
SHA256 b90113df8b84686ca138361c6ba45f519b463f099410e8e9d3a238d7aa0d4ae7
MD5 a0ab939a64a8aacd6ff765fc5c10d5e5
SHA1 1f961f95a4e0f978f1589afa75eaafeba4209d93
SHA512 eb6f20d5a4e9c75ef953458b88c9ab76ec6db065ef53cc3a37c6ad3ce0df909874b5102e86d69fcc5c2bfd4597fd82ebfc9b4a7df457693b7193cd4064a327f5
SSDEEP 6:7+/l9j2Gn1yJvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKqm:7+tF2vJvqLiuWdYRmBEyPblm
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.ilhb.busg.xppx/databases/lezzd-journal
Size 4KB
SHA256 0723879bfc5721de8a9ec22cddb146521ab007df9e36c5848f3a72bca7630ed6
MD5 50eabbae3d5648440938959b8fe031f3
SHA1 e2b0c085ea17efabcb920a88998b80a706d26e0a
SHA512 68243d2c9e1c7c9bc2d5209d18c37f1af392726b6f0d99e8b43a7aff10fc995d38c40b1332bebd192ff42709a2f425cebb119967b726291c0227922ad542986a
SSDEEP 6:7+/l/elgPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKmvR:7+tS4qLJdeWRmBEyPbXJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.ilhb.busg.xppx/databases/lezzd-journal
Size 8KB
SHA256 ec1cd6374dcad6320aac2f0dfe19562f37f76a21f1657abd296f307bfa03e4b6
MD5 16955063d025ca2b50d3f67ed2c463d4
SHA1 efbecf99dcbc574c8d6c2ac8d484de30549f8edf
SHA512 464ede23bd09605b7d24e351fa22cee0cb6baafdaed025db019c13c2c310e77ee27a5374ab185bf8f9266c49e7519407b75e84e5f53a03372935073759699c06
SSDEEP 6:7+/l94/gPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKyis//w:7+tG/4qLmqKRmBEyPbDisw
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.ilhb.busg.xppx/databases/lezzd-journal
Size 8KB
SHA256 61568666ab07968f9306dbbfd2871d03f7ef75d20193c770d12ef27eb296f541
MD5 6c716c1cd94a1fd941d780bdf3f908c2
SHA1 bf9e95e17945181f8796b7dfa9830b86a4a0a77f
SHA512 dd20731f4dd61b911961a8c7aaa2e227997d08a1ff1aad744265d4652df87433a94de6be9a6d70c025ed5d919908714b484212aab69f630d1592343ea6749296
SSDEEP 12:7+tO6vnqLyKPjSyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPb9kkXo:7+tOkqLy2TUku+haaL6nwyLGS9kkY
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1729111484401.env

Path /data/user/0/com.ilhb.busg.xppx/files/.um/um_cache_1729111484401.env
Size 652B
SHA256 89ca8de8a9dcfffb5ee901864060fc60b8e7e52c51ef112c899bf607a3d7e4c3
MD5 b7e5a767470417a6accbf01fe81149a0
SHA1 eb957e3a215b73d7fec906809db05f2c4ca09f72
SHA512 e5def82410282a2af32459efa66c9b4714d07251e04bd609924a571b906674e2c9f56d6c3697b88b91ec23652a71e5ea17c9f6bc107b309502a66cad226b301c
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.ilhb.busg.xppx/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 e15481b3684c856242e8830d097a32612ac4229038771fec3c3061761238a1db
MD5 2836b7923af6ed5542f7e8efc1a33a51
SHA1 c616c1e4399b6573ea46b9a006b126a3523ba121
SHA512 7617e18262c75718fd3f46e20e429197061ae5acd01c22b8e37e54e77567fb7cb88a9f6ac4edc351418ad1af2d4e0ca58492124c3c856311631fd31ba06e245e
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.ilhb.busg.xppx/files/umeng_it.cache
Size 344B
SHA256 e9014350e3920625f81ae3a10cc85176e4f4638b66d0cb33861520cecb58da3e
MD5 c8e011c8b8704dbf98152c8c745c82b2
SHA1 9218c9e9a2d7bb68fab38d55a32893959e9733ef
SHA512 5ae9b27603aa96187b767617d38cf74f7c17819aeb9a8d395bd083bb187bdca7dd651d51b8f30fea57e4559ef0bf03ec7ca36454ed2844381ff823f13f69d2d6
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads