cbca32ac232c16f7a5444efa2b6b454fc28a94c3b1c192107d728cd1899b9433

Analysis

max time kernel
149s
max time network
152s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
20/10/2024, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5fcacb1d9232518d79f307f9be8af12f_JaffaCakes118.apk
Size 1.3MB
Sample241020-b969qssamd
SHA256 cbca32ac232c16f7a5444efa2b6b454fc28a94c3b1c192107d728cd1899b9433
MD5 5fcacb1d9232518d79f307f9be8af12f
SHA1 b9f22db39dad50a0625cf1d48db172a952fac413
SHA512 e9e0353b23d8dc6abc29aec93643dad0a9058ef1693e72a6c41da9c1401c4ca956f04fd8fddebb33351a3d280304e60744707eff72c6149adc1aa82519b03a6c
SSDEEP 24576:WAfhVXSHybdlCAh12kf61qxzo+egjShGq/13tdHbZKm51Ob83q:dhBbmAb2kuqxfTjShGq/1XHNKmjba
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4262	com.rgyi.phng.eadr

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.rgyi.phng.eadr/app_mjf/dz.jar	4295	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rgyi.phng.eadr/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.rgyi.phng.eadr/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.rgyi.phng.eadr/app_mjf/dz.jar	4262	com.rgyi.phng.eadr
/data/user/0/com.rgyi.phng.eadr/app_mjf/dz.jar	4330	com.rgyi.phng.eadr:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.rgyi.phng.eadr

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.rgyi.phng.eadr

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
20	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rgyi.phng.eadr

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.rgyi.phng.eadr

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.rgyi.phng.eadr

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.rgyi.phng.eadr

com.rgyi.phng.eadr
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4262
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rgyi.phng.eadr/app_mjf/dz.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.rgyi.phng.eadr/app_mjf/oat/x86/dz.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4295

com.rgyi.phng.eadr:daemon
1⤵
- Loads dropped Dex/Jar
PID:4330

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.rgyi.phng.eadr/app_mjf/ddz.jar
Size 104KB
SHA256 9b0a7ac6b3eae5984f76f9096d2037d7228008c77d63e85f4a0fcc6ad766874d
MD5 74516f682123a65190e15ca51fea94e2
SHA1 4625bc1052913470b74a0d2eedcb5d1b597cfcab
SHA512 9a9045e8a3ecfeb50632b4f205ccecb3b9104da04d110623b59b73d62d5da2e345f3259ba706ffdc341cec2f16a734b3dfd856a20333b3434dec0ea577ddaaae
SSDEEP 3072:2Fp+qaHCTyOhEkZfnEzyvV3PxRzXajkZK:2qqRTsinuQ9zajv
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdz.jar

Path /data/data/com.rgyi.phng.eadr/app_mjf/tdz.jar
Size 104KB
SHA256 2bb381984f485a4803c2ed4c80ebf1ab3f327fc918ce36ddd67326a249ba77c6
MD5 c34a960ee8657fb632c516c1616ca810
SHA1 9aa3a6cf76f595769a52b40a4189c5371a84674c
SHA512 2bfeb1a74504f9c5c978e19041a3c6ccbab2eb77f7fd35c38e45207d2d50af0fe3ae28aaa7373cb4eb69b8f3d9c118d0813c2d7336f2f3f26e8c6a8e34e3504a
SSDEEP 3072:TTcLWre9hzVeuzXvNLWIFsZZ3/QAdCbNCUMk:TTcLr9hzVeCXtfF2PTdCsNk
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.rgyi.phng.eadr/databases/lezzd
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.rgyi.phng.eadr/databases/lezzd-journal
Size 512B
SHA256 c87ef6a7218eab4167d110406517cac8aa58582b892dfa6919e72a66cb320c02
MD5 143f7c9e0cb5f70dc9f444159bd98c8e
SHA1 c8a0a36649e75213e5165e36337d0d9bfd2527ba
SHA512 aa002563b770f5bb3f0a89f2e321ad54fe83609ee363ea03b7d3c5c932db121c64b2cb5d807931ea6bbef8d5e0ef08ace0831380c166a829b4a91147e099ba15
MD5 SHA1 SHA512

Submit Download

lezzd-shm

Path /data/data/com.rgyi.phng.eadr/databases/lezzd-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-wal

Path /data/data/com.rgyi.phng.eadr/databases/lezzd-wal
Size 60KB
SHA256 b9fa39e428d4731d73d73d74ed10c36289836a3b0bae88a6b502a3fd09e2f117
MD5 c85086d986206a3eb1fdeb65e7736724
SHA1 1483d5dd18f1cb3870006cf61be1c78de8e776ec
SHA512 a05fe966283e61ab830af97e3cacb4494c57a9920057fd6ba43f2319f41c7b9cd0f00aa266805a1d6da8aa43186718f13e0b3c655e5bf8b9d2174ff5fb2352d5
SSDEEP 48:UzNSP/31nz6SP/0dUkthaTwnSP/AWnBtFXtUkthaTwnSP/cukS0FXtUkthaTwnSi:80P/1z/P1pPIWBupPjkcpPq
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1729389221282.env

Path /data/data/com.rgyi.phng.eadr/files/.um/um_cache_1729389221282.env
Size 680B
SHA256 c3359c4fb45aa6a657f6db4febed82a36e21b148bc5ec4fc8b77dcc1577fafe1
MD5 45a3896492c60604df6a366d6c14a6a3
SHA1 fb1e1bca67214554e6c8954be7be24c4644fb84b
SHA512 6cbdcb9d56e4e5271b1bfc370d87af8ecdc0aeb94530c82f74993360bb8b8cf578e77f534a4a0710acb9944c8ea14547b61aa2b730b36f9f747a647ac7f73ff5
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.rgyi.phng.eadr/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 310969d84aa4f80db547842f6e1377893fc3ec3e00a02ec573d0487141b35345
MD5 8002e6c955bc1f7ba1513fb8fee390ca
SHA1 48a3a67cc71d446ffef6c52117fac329372cfead
SHA512 481c078b87552f79f0274be2da292d67fb219a68c1e768a162b931318ef47f84638cc6d51342de27111d4c1cef1853491066f19c78564f6247cf2a4ebca7c381
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.rgyi.phng.eadr/files/umeng_it.cache
Size 415B
SHA256 ad18daf5fbee6b086159912586b5fd1c9bdda7d43959bed72771f4d7917f22ef
MD5 6eae076e30ef4c87b9a7ac8d1f5069c7
SHA1 1dd038601790b6ae6f2d986a515f75994f3e7efb
SHA512 6574f1f17edf9f632fd71541016747ebbf2596f8230d285611732483ad56bf06ebe5b2451a938b5ea89a25e9af4dd5ab06c05cc57a50b08fb1945d4740d6ddd6
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.rgyi.phng.eadr/app_mjf/dz.jar
Size 247KB
SHA256 a6cdc6d2747ca2979c9959fae17a4c00dd66bd336315ce2e69348bff551976f4
MD5 40235bd85137ac67997ebd98c3ee5336
SHA1 c0ab0d0d39c13fc76c22f11642920003a34a6a8e
SHA512 80193d98b9db86270ebdb3217ad5000dc93f36fec15c06925df1938bd7bc89e9a1a056fcfc0a3a3108daa7dfc5b9856b22832bcc7654ac5e0197bdc45a08cdab
SSDEEP 3072:vQt313gG3qJEISe/S/iZi2ys6fJPLc1hbjhfYgosFT4Xy+N9Z5E4T9sn4tefHZo0:vQtG2ZeXZivZYhYgosqT5EXH26zt
MD5 SHA1 SHA512 SSDEEP

Download

dz.jar

Path /data/user/0/com.rgyi.phng.eadr/app_mjf/dz.jar
Size 247KB
SHA256 89c661a75becb3a99788c1deecf430f54c045e044f30c5fa7dd7f11e93e2a5cc
MD5 f94e137d7aa3ec510782c58f1089ef39
SHA1 f1b5f4b422d4fb5071e41a3fe9b7cf99ec13c217
SHA512 743beef1e59c24cb6662c19dab6e6629a30d6bf6e2e014f2f68258a58acacb868f6a7a2a527123170f92b03ba517d8b48cb2a290a963d2b86130444820b0be6a
SSDEEP 3072:vQt313gG3qJEISe/S/iZi2ysjjbadQhyCBAfGbmhgMvo+FT4Xy+N9Z5E4T9sn4tE:vQtG2ZeXZivyHaKgiMvo+qT5EXH26zt
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads