cbca32ac232c16f7a5444efa2b6b454fc28a94c3b1c192107d728cd1899b9433

Analysis

max time kernel
148s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
20/10/2024, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5fcacb1d9232518d79f307f9be8af12f_JaffaCakes118.apk
Size 1.3MB
Sample241020-b969qssamd
SHA256 cbca32ac232c16f7a5444efa2b6b454fc28a94c3b1c192107d728cd1899b9433
MD5 5fcacb1d9232518d79f307f9be8af12f
SHA1 b9f22db39dad50a0625cf1d48db172a952fac413
SHA512 e9e0353b23d8dc6abc29aec93643dad0a9058ef1693e72a6c41da9c1401c4ca956f04fd8fddebb33351a3d280304e60744707eff72c6149adc1aa82519b03a6c
SSDEEP 24576:WAfhVXSHybdlCAh12kf61qxzo+egjShGq/13tdHbZKm51Ob83q:dhBbmAb2kuqxfTjShGq/1XHNKmjba
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5066	com.rgyi.phng.eadr

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.rgyi.phng.eadr/app_mjf/dz.jar	5066	com.rgyi.phng.eadr
/data/user/0/com.rgyi.phng.eadr/app_mjf/dz.jar	5122	com.rgyi.phng.eadr:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.rgyi.phng.eadr

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.rgyi.phng.eadr

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
23	alog.umeng.com
36	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rgyi.phng.eadr

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.rgyi.phng.eadr

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.rgyi.phng.eadr

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.rgyi.phng.eadr

com.rgyi.phng.eadr
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5066

com.rgyi.phng.eadr:daemon
1⤵
- Loads dropped Dex/Jar
PID:5122

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.rgyi.phng.eadr/app_mjf/ddz.jar
Size 104KB
SHA256 9b0a7ac6b3eae5984f76f9096d2037d7228008c77d63e85f4a0fcc6ad766874d
MD5 74516f682123a65190e15ca51fea94e2
SHA1 4625bc1052913470b74a0d2eedcb5d1b597cfcab
SHA512 9a9045e8a3ecfeb50632b4f205ccecb3b9104da04d110623b59b73d62d5da2e345f3259ba706ffdc341cec2f16a734b3dfd856a20333b3434dec0ea577ddaaae
SSDEEP 3072:2Fp+qaHCTyOhEkZfnEzyvV3PxRzXajkZK:2qqRTsinuQ9zajv
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdz.jar

Path /data/data/com.rgyi.phng.eadr/app_mjf/tdz.jar
Size 104KB
SHA256 2bb381984f485a4803c2ed4c80ebf1ab3f327fc918ce36ddd67326a249ba77c6
MD5 c34a960ee8657fb632c516c1616ca810
SHA1 9aa3a6cf76f595769a52b40a4189c5371a84674c
SHA512 2bfeb1a74504f9c5c978e19041a3c6ccbab2eb77f7fd35c38e45207d2d50af0fe3ae28aaa7373cb4eb69b8f3d9c118d0813c2d7336f2f3f26e8c6a8e34e3504a
SSDEEP 3072:TTcLWre9hzVeuzXvNLWIFsZZ3/QAdCbNCUMk:TTcLr9hzVeCXtfF2PTdCsNk
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.rgyi.phng.eadr/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.rgyi.phng.eadr/databases/lezzd-journal
Size 8KB
SHA256 6f635c74f1ea87aba8798e9ef05f3bafedf827c5ce2b0ced8e3f565737faa51d
MD5 0fd0996ed1da0e72351b95023a5fe72a
SHA1 8b192d398f1f67464ca4f6d0a3b71888b88408f6
SHA512 10b2205d35f0e43cf4ba9c4b7d5bdf30df01e80d836b7ec6b59bedaa04f1818bb9fb887989a1e80e1a9252caba0ae96e7c478ced5031506e5e6e8cf27bb80c2a
SSDEEP 12:7+t3DBqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPb7:7+tdqLGqteszXtUku+haaL6nwyLGS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.rgyi.phng.eadr/databases/lezzd-journal
Size 512B
SHA256 ec4802d6de690f18b18600531bc096c09a2bccf0f5225e55d62f9ec0ec89b4db
MD5 1bd3118b85080d1b59e96282c0b2efb2
SHA1 929f4b4dd8c59f23d9b36f9bbd73170a67d5a7fe
SHA512 1fcbaaaaac168ae4d7d8f9b64a966a4dd51670047300a75cc339d60b8a71197f1e330d674cd4417e1ced12672b3ea220962c4ca8ea8f901ed69dce922c326549
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.rgyi.phng.eadr/databases/lezzd-journal
Size 8KB
SHA256 f75b8829865082d24b2f92bd652200d780af6d9b8cbf90e485962b08e56109ff
MD5 77304f84be150a83072f8634f5f57378
SHA1 41b8c96b470e885f103ce8710d2524b0796dfe6c
SHA512 2412ebc1f824d46ddfe9b8974dd18ed71249109c86c5e26bf6dd8bfbdab8435ca41189491688c986810b2079872c16baefeda728b74cbb0aab3d33c64ff7d325
SSDEEP 6:7+/l95GFn1hg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKa:7+ti1qLiuWdwRmBEyPbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.rgyi.phng.eadr/databases/lezzd-journal
Size 4KB
SHA256 1c7215ecf7ef2969081b79a952700651065827f5855bf17bc0d228ce6ab6a257
MD5 6e35cc78b5363baab6c050d818b865e5
SHA1 5d7bfc9aff8700e659c85ae9e917b1a8048fd02d
SHA512 ae16431ddda11636783e371229e66d4a0a1b9b3215b5473a98f0b6279c6d8b396bfa1263515389b756b3e3415019c66f1a863a34897f4593fd7d7b0aa292f58a
SSDEEP 6:7+/lZvPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKS:7+tZXqLJdTRmBEyPbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.rgyi.phng.eadr/databases/lezzd-journal
Size 8KB
SHA256 80c0130159b5a178dba5ec9fbe57f9ca5f4d0deabd4ed640fbdbefdccdd51f5a
MD5 7458d5cdd760d936dfb26e802ef18d97
SHA1 c0c44ab30f332526ae80c2d5d3cb0befd324ec61
SHA512 52e624894778152af333b705114cad04eb18040492beca35deb51744884042d4d587373d343592a87102d00e8eab93d218a35eec7be7cdb2dfbb4616e8f7c03c
SSDEEP 6:7+/l9DPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKnM/A:7+tNqLmqCRmBEyPb4sA
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.rgyi.phng.eadr/databases/lezzd-journal
Size 8KB
SHA256 87a27941b6da1e119446a0196a078a1f6789e9a4fff1a3b8bf3b213a227849fb
MD5 3d93d429f363539e2e0d3cebb9b3bb3d
SHA1 95e811309403bc96ed86e189923ef0d4b0b04691
SHA512 ddadb3d21cd8facd07a4b7675e631a4fa2cc0c401857f58f330e371a1615c1f3951b1c5a8e45a095f4d91be5e52ccd15ba676b095e69f6bd606e7bdfcdcdad5e
SSDEEP 12:7+tfnqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbt8bn:7+tfqLy9yUku+haaL6nwyLGSCb
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1729389219703.env

Path /data/data/com.rgyi.phng.eadr/files/.um/um_cache_1729389219703.env
Size 650B
SHA256 36c250f26c433296467cd5015803d32c79581b8df5487544bb1f9d9ce1b6bced
MD5 0a6745fa4fa4d8a5bd23b851af49935b
SHA1 00f140d82e19e1a4376f9f1435c5f4de945070d6
SHA512 265f79ac0a0cac4dc61294b800abc4b73e80b87f2d96038ea3cc693310fe8ff554fd166f1b40ccd2892c421680cb93ef79b03c17969b90b954600c69130c4168
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.rgyi.phng.eadr/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 02b96dc4dc33b54e8c2c18e2c75cd2bfaf6dcb04cbb7f9bc2f864614c39f3be0
MD5 642a285c634c6b6465015c8b9a519ef7
SHA1 c61b352a2f3e9a990f406d228c1082e3d9887cea
SHA512 f78b164899313c9fd480cd390742df76b2c157ae20e43fc9ffd6b91a2438a9d6a484821e57181f2df3a1941f5025f730388187ae504aca4da176aa1b733600eb
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.rgyi.phng.eadr/files/umeng_it.cache
Size 350B
SHA256 52d32646148e5025c2ddb5d9da62e7c956c4ecb35a7215d6ec19dd7eed7ff7ee
MD5 ed4c17de2ff68f433ce90a2c4c79f9b7
SHA1 20ec0442f701ac05722ccc4d3cb05c334dfa4f8e
SHA512 7caf010d550094085eea97d07bb78d270528df48caae76a873a57b827be98b3cad08892a0ebf3d4e8fc4fc6f5acc89d4c3a0777e236cea05b8721dfdcbe86ac1
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.rgyi.phng.eadr/app_mjf/dz.jar
Size 247KB
SHA256 89c661a75becb3a99788c1deecf430f54c045e044f30c5fa7dd7f11e93e2a5cc
MD5 f94e137d7aa3ec510782c58f1089ef39
SHA1 f1b5f4b422d4fb5071e41a3fe9b7cf99ec13c217
SHA512 743beef1e59c24cb6662c19dab6e6629a30d6bf6e2e014f2f68258a58acacb868f6a7a2a527123170f92b03ba517d8b48cb2a290a963d2b86130444820b0be6a
SSDEEP 3072:vQt313gG3qJEISe/S/iZi2ysjjbadQhyCBAfGbmhgMvo+FT4Xy+N9Z5E4T9sn4tE:vQtG2ZeXZivyHaKgiMvo+qT5EXH26zt
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads