3205fcebcad7c613764200997dae99c6aa4a0511f4871647f8637c0d28f4fb22

Analysis

max time kernel
144s
max time network
145s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
17/10/2024, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52260466d78db475a7606db5d8c15220_JaffaCakes118.apk
Size 600KB
Sample241017-p8s8daybnd
SHA256 3205fcebcad7c613764200997dae99c6aa4a0511f4871647f8637c0d28f4fb22
MD5 52260466d78db475a7606db5d8c15220
SHA1 c1788ad011abd8581d21a52ad50b8f5f2efc59ba
SHA512 ae43762707d165170c3ef9b95109c822557ec9462d2ccb6a4698c6ebb64fc31bac52ebafb3819926905b4a439d40a2ff5e687cdfc282a8c2209982c2365b9e5b
SSDEEP 12288:nPe3yTE8kJ7RBRbLXa1biPo1cH6nHa3NguEhhBCm5aZeFN9yXDu5:Pe3IbARLA1Y6n63gwZKOXA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/togRjIM.ouzCz.TRdl/files/.ca/QYnIi.jar	4641	togRjIM.ouzCz.TRdl

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	togRjIM.ouzCz.TRdl

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
27	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	togRjIM.ouzCz.TRdl

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	togRjIM.ouzCz.TRdl

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	togRjIM.ouzCz.TRdl

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	togRjIM.ouzCz.TRdl

togRjIM.ouzCz.TRdl
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
- Checks memory information
PID:4641

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/togRjIM.ouzCz.TRdl/databases/cc/cc.db
Size 36KB
SHA256 50484dcdc6b9c2801773018386a8143a52a5153eb2eeeaf5be8bbe46a49ca90c
MD5 86752a4be6564d8370f2f0e403995003
SHA1 29f7d50675f6e59f3b808eb6dcc8619384412115
SHA512 79c9435c1e0d41a3f97784be3e5a3cd8c0bd2d32ecdf326808bacb00c76d876d0447617d6e72ef04cd4b996c92eda4eb7bb200987ae7928ce2e0e7c8e807a5ec
SSDEEP 12:TLg5P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TLF7sL7yot3BVrHotGGSP/WQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/togRjIM.ouzCz.TRdl/databases/cc/cc.db
Size 36KB
SHA256 c422190539b6414072fc3950da19a17985c0c4c2172740b2f74682b520af5231
MD5 4cfe777c9f6e7859f5efe2197401d8e5
SHA1 bb3774e8879ad5f6db0c37f151c3d6bc7b4b207a
SHA512 6be469864edaf8eaa110f618f8abd27962da92e20945dcd38073ade2b60b10f00552d54d5db9d9f75ca133213031030e71e2e30113ff033e5ef507a28fe0b1de
SSDEEP 12:TL/0P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQ:TLV7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/togRjIM.ouzCz.TRdl/databases/cc/cc.db-journal
Size 8KB
SHA256 ece6f4c1f5d0bfaa8cff27ac4450fe918adab0019e4458c8d87ec91529262a8c
MD5 c0544b3c45ba0d9f557a89a8f2f519fe
SHA1 6e1c37694b29e26ff1bd8bd80958992c5534f3ec
SHA512 4211ef0f831a6d34265d77d1f03c905c425bdadb212508dcb845d0a16a2079a5c27e55e3bdb546d1a5c7017508fbecd7aef5edd3e9fdffcfa5f726e612f3969a
SSDEEP 12:7+tQFqL/0P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbO:7+tQFqLV7sL7yot3BVrHotGGSO
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/togRjIM.ouzCz.TRdl/databases/cc/cc.db-journal
Size 8KB
SHA256 531c6918a7c1e01687c74f93107d15dee2d8638480507b1aad1d61437804c6fb
MD5 128fae0b152f4d55c419ea4f1cb9ff55
SHA1 73a1afe8d4217eacb2413e79ea0e533b68516d81
SHA512 a8bc18f5e6ac1ecb5a8b857656c3ffe73ece5e17249705092c2b9e585eba88fa91aaa7536b55b0ab1a35a089768fc3fb2c42ae6a9aa5d465e6c4d4add2d3d907
SSDEEP 12:7+ttjqL+/3P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPv:7+ttjqLl7sL7yot3BVrHotGGST
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/togRjIM.ouzCz.TRdl/databases/cc/cc.db-journal
Size 12KB
SHA256 a120baa97965e0b2228a8596531f8958518870b99e195c6612740e4a0231caa9
MD5 5a885489aad710684dcc50bfa2c50676
SHA1 f032d21eb681cce64207b2c3863667483bf7e194
SHA512 60ccfb0c7ea76ad112102cdaec7c753931ab89387d45ba2439ac8ac9592938eb8b061439ca8c2deffa1d3029c98027a8503c44605d32302df454d45e14b5e74f
SSDEEP 12:7+tQmR6qLWEmlP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBz:7+tQbqLsO7sL7yot3BVrHotGGSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/togRjIM.ouzCz.TRdl/databases/cc/cc.db-journal
Size 512B
SHA256 6e378542dbeb3145e45a0c0a743af31e71a98994a62b29c8c2a8ef616182831a
MD5 bd75938361a153e7e413389a74419fcd
SHA1 04c122fc0936a47cb2c7bc6b1dec3451e24bad51
SHA512 eb965c92195e1fd3a3fa7c223406d14aabeee3e3c09ad098010e3adde3e4af4124f062944ed8c29ffa78c04cd6588165ca0a892748d6bd8796ef23be927f005f
MD5 SHA1 SHA512

Submit Download

cc.db-journal

Path /data/data/togRjIM.ouzCz.TRdl/databases/cc/cc.db-journal
Size 8KB
SHA256 fe7a398fd0aa8e9bba70f5b7ef8982ab2e92c7e8f55cb6368bd7169afc1b6771
MD5 59b9e5094c4ac9467e39529a4945f56c
SHA1 f59d0cc22943ff5287c0780673a51ee0821098cb
SHA512 02d8439d72b607faa15746d1b9bbff1a455d11c2909ce515e5999be07a2731ba906aa5b947bbf2b5055ca0920e1a8b4c9917dacd2b3735a0033902553758da6f
SSDEEP 6:7+/l90THn1lsWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKW:7+tpWqLiuWdYRmBEyPbp
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/togRjIM.ouzCz.TRdl/databases/cc/cc.db-journal
Size 8KB
SHA256 ea7f88186acd69d22f9eb6be1a2ab8268635b47d2b7bb8fc6066ff2f8cc5d574
MD5 0f651af7814acf3331f41d6d3a006968
SHA1 c8e94ec37c4b2267727b44501131ea919588eafa
SHA512 b2cee3f7b6573986fd46d37cb3a047a4bf88cf0230d0e3c74ba3a238e44fa21f7b0a2bca47f885f1299dc2dd15eb904be2786d92bef4120b739876eab9305b04
SSDEEP 6:7+/l9Mu/gPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKX8M/B:7+ttwqLJdeWRmBEyPbCJB
MD5 SHA1 SHA512 SSDEEP

Submit Download

QYnIi.jar

Path /data/user/0/togRjIM.ouzCz.TRdl/files/.ca/QYnIi.jar
Size 136KB
SHA256 3b595a680f2cf8c08b10a09a734dd9b77ea34bc3f1d5125c2a1ead6c8b29bec6
MD5 f5cdfd183800aa4d83fc34d18cebae21
SHA1 e1e1cb51a78b417f63f902a8cac751e1533c0775
SHA512 3140950fa8165da82575562476cf2c131569e238da53891bfea5367007e17ab712296c8e2e6e825fa7f5d2bed77f9b108f2cd680f819228d37a5affb689cb6e4
SSDEEP 3072:rB6EFIfnuVX4dDxUZRzJZjHSFJHJ6OyQvgnJby:AJdDMrWnJ6Jd2
MD5 SHA1 SHA512 SSDEEP

Submit Download

QYnIi.jar

Path /data/user/0/togRjIM.ouzCz.TRdl/files/.ca/QYnIi.jar
Size 322KB
SHA256 696c178dbe2537796c3f7916e9ac0fdf3edd65ffe7f98242a440201100fed9bc
MD5 499e7164c51adfc5d828146a9f8f915e
SHA1 cf5a91b1a596442eff5ccf0f0ca8aaf3099b7350
SHA512 c90937103f2ad22c2ad7247128e508763a9122e5a0877cebb8e168e8dfc3715a96f235ff53cfb9b2bc18d661cf1a08cf440813aa1ff4212b07c0eb7d38895686
SSDEEP 3072:8lc9mYtchXz2sSqGe3M0gCiHcSwAFDbVZeo7xljZPPi/NZdDFwCKf5rsaVJ+E5Ca:8lIDYqsSyc0gZwAVVZF7h8HdDFwjNai
MD5 SHA1 SHA512 SSDEEP

Download

um_cache_1729170096150.env

Path /data/user/0/togRjIM.ouzCz.TRdl/files/.um/um_cache_1729170096150.env
Size 1KB
SHA256 9e290f1539ed9b75d62c26a18c1971bc9fd2891edac451b944cca99d5156b251
MD5 98cb6aec51a6dd31ae3a4a91ba1a7734
SHA1 22ce52ecc661f6e9c45a18787d5f147b450182ad
SHA512 1c33ac0877b3db27dad06942857c5ff0f9836e061360d126b4fc3dfb80d116bbf5d1bf9b818fec6dbaeec4984f6fc0038246baf7a7cd92ae2959ccee27c41dfc
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/togRjIM.ouzCz.TRdl/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 746e549ee1d4999ae0bb6b04508777da34b912ed7b8d4ff4576c4ab2faf3925c
MD5 f17ec1bee0b891b4ed485411972745eb
SHA1 6283694311b41c25eae8548898cee6166ed0153b
SHA512 36f2738debc10218af26aab24aef967bd32a4467d3a1a6256bc420c7a390f6359444b2352728ea222726f65198888c4b3a25b06205767c752a64037e676be090
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/togRjIM.ouzCz.TRdl/files/umeng_it.cache
Size 350B
SHA256 b6b2d6dfd1ecbc9eb7f18fc9159b76d7ec0d3e31b6cfea9a30376d328c4766d6
MD5 9700f4b7a0ce8cb67e7a40c7ac1a58ac
SHA1 4c9e42af8d784200f6cb89281caa10140ea6699b
SHA512 107071f2d379b933331172b6e0d4802f96c73ad314015ee6e751ae351fc571ae76f44642590adf701dafc8f9f8aadce75ef92921d902d3228f034240f234e177
MD5 SHA1 SHA512

Submit Download

channel_conf

Path /storage/emulated/0/Download/channel_conf
Size 5B
SHA256 b1fcf1129cfdb61ab38436ca9e6af409cdd87adaa3e234ad734c6770d7a6f12d
MD5 f248c1bc27d33bbbf7ac2907ba202121
SHA1 b3cb1495f32aaf3ecfdf51d0bcaf7f5d39c4e1c7
SHA512 34be71a2935ca56e0e3e4687f9368f5cdf6f95233ab854f655ea23c3cdde1768bf6817ba0f4065021484ba663165e2fb65708ae1f4686b86e1b235ba62df414e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads