8f174da946771382956abc96371fb3ee2cca7e7b65d53d3e15250afadf79bf6b

Analysis

max time kernel
148s
max time network
155s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
20/10/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f997942f8aa4e964f23fc75fc9683f9_JaffaCakes118.apk
Size 550KB
Sample241020-bcpnes1fpj
SHA256 8f174da946771382956abc96371fb3ee2cca7e7b65d53d3e15250afadf79bf6b
MD5 5f997942f8aa4e964f23fc75fc9683f9
SHA1 e595187d7b61fef287559b9e7d6a1de0ef6e5540
SHA512 0f12be0bec92646f20a7f17034a6c8983e92ab7e7fe35ac89805665227cd8980b59e31a80451d58a45b96752e25947900f4a49dce5cdbaedaaedd00e1bf41a6e
SSDEEP 12288:Qb4LINCjgcNUJNlRMWU3ca27KT/jhaGOenVtI8eFxMMpk9:QTNftUMacKDO7mMC
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5068	com.nsrt.veos.aiuv

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.nsrt.veos.aiuv/app_mjf/dz.jar	5068	com.nsrt.veos.aiuv
/data/user/0/com.nsrt.veos.aiuv/app_mjf/dz.jar	5130	com.nsrt.veos.aiuv:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.nsrt.veos.aiuv

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nsrt.veos.aiuv

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
6	alog.umeng.com
42	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nsrt.veos.aiuv

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.nsrt.veos.aiuv

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nsrt.veos.aiuv

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.nsrt.veos.aiuv

com.nsrt.veos.aiuv
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5068

com.nsrt.veos.aiuv:daemon
1⤵
- Loads dropped Dex/Jar
PID:5130

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.nsrt.veos.aiuv/app_mjf/ddz.jar
Size 104KB
SHA256 0817449409b55007ece8d2d25f6d4b075ebea09c7feabee79636176bb0794792
MD5 656eec0445b1ac574b87e1bd3a98d969
SHA1 fe3e1ee6bac338416e47e90ed249cb82aeaf6bd4
SHA512 9a2737d22a9e647eadf4752513df79fe960cb69ec9563a2d7f504b3e91a95a6081876ab068355b8db49c44ea8627a33ca94c0244c2909668bec2620dc71a27fd
SSDEEP 3072:qFpSlDHr1Dxo8f2kqW1/xEwnYvV3PxRziLJU2:qGx1xJ3qW1n+9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdz.jar

Path /data/data/com.nsrt.veos.aiuv/app_mjf/tdz.jar
Size 104KB
SHA256 157b006e48d74dc023d671b5a7e9e61f96853be434db43efa8754aecba50e12b
MD5 30617d6621bcd972fcea53d04f3b2a55
SHA1 a0a51f60773e3a1eea2f929c8f1df896b6d71e7e
SHA512 d7735599a3186ba6ca0c6151299fc9353495e4cb4cf1b3a8aebfe6e0901e839f1027013aebb2d168c8fe2ace65fac6bbc89b56b8316e546bda879825febd1ad0
SSDEEP 1536:hnTcLepJZWlk7oQYyTjF1IsZEXfBq9u7H/sLu10eT/2GpTqMa4/WcNt2+ibrCsfF:hTcL7s/F1Isqs9XStT/VT//dCbNbLPF
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.nsrt.veos.aiuv/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 8KB
SHA256 8c03a0b098b2cbb91cddeb56def45bcda724f88196b41808a344fe29defd3542
MD5 756e685e67e7dcea8b75d9268c75e28a
SHA1 71ce256bb33cf3253c7aaf2e65e77ab9792f7e50
SHA512 fa79a17a6314bc587d8c6c68a88dc97465ffd90bab54643b25e9b9a799a41144d2e340357744a1c81c77073023550d10091de628a292f813063177780565a9f8
SSDEEP 6:7+/l9y/SFPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKBkl//O:7+tNBqLmqCRmBEyPbJXO
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 8KB
SHA256 719c666997b24d963d0baca7d5f2779e974927aadcf92d8a40e2bf8569554c44
MD5 226f36946e6de38ad6e97ec98a9cb431
SHA1 4549271aa39ae4b44e7ac6e0df2ba7b804f6b11d
SHA512 b6a4b73a1e6cbd053e6cdde4a393d3ab28b78a658c32509aa50dc9c7391d18dc3b4fac619c16bbc3673d74adb5f49e7ce67a988e18d6f333cc0586adc3d4d24a
SSDEEP 12:7+tkl6nqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbMoGn:7+tkl+qLy9yUku+haaL6nwyLGSKn
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 8KB
SHA256 d054ed6b9dc96011540cff66b376927c6191f68a0ffd5d8e0d2cbe5e4af4f902
MD5 d6b77cc510632ba6eb1031c4f6c11ece
SHA1 3628f01471705503629303dcb5e7f2365e2dab28
SHA512 2814790451ca624b2bd15cf06ee1a20425858c732dd7cfc592d27f83d16c4b5a5f055f8282d357d367113a2a2a07dbdbd271a67bf26f41a20cbf7760ba3055ec
SSDEEP 12:7+t7qLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbv0d:7+t7qLGqteszXtUku+haaL6nwyLGSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 512B
SHA256 bffd244429d78701734350d7ff4d7ccebdd79c62c76a1571e056dd7f06b745b4
MD5 236c8475f3a644023883e8fc64ab8e16
SHA1 5e645e8cdc3aa7245dc4aa5e9eee3a40d36e3873
SHA512 a53d5a373a72f3e28e6f73f1bf0983e998b3c2b2a3038a184e7b8a20d85391368725c4737b7317a34a3567d478b3cadce3c210b51b9a7b38947a5916373fd023
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 8KB
SHA256 b69c6f9557b7a584bcedca4b853c1505ba3ff82b87b25eabb3fbd344a0d5f021
MD5 08b9cbc9283a7e57ed7e508bf7660ee9
SHA1 ab8eeb64d703f172aa59af944e5b10fd60a434b6
SHA512 3781ff07b3c44ef361249e4b81f47c49fbab829c606d9bd98b164511e7652c154034b0b5ce16c025db59c214b9f03af961faaab5345ee7565bd8a5f1625df3a8
SSDEEP 6:7+/l9vU8Hn1X1Wg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKF:7+tJrWqLiuWdwRmBEyPbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 4KB
SHA256 b350b6c3ccad6b4d4b4cc608e02f8cb5567550f6ec2fe4cb2bd15bf3ffd4d811
MD5 6d67707d649c2d92ae8d496262923254
SHA1 c7e3ee12691693005b04fb1b637e80cfb865bc69
SHA512 bb6195d67aa0fc2e9b7d4f03681d113045646509936f80291248d1726164a7a28731128de14bb6bacb4d23c190214336094446466fb8a3b616f246aa4e3ca9f4
SSDEEP 6:7+/lP4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKN7n:7+t4qLJdTRmBEyPbs7
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1729386079939.env

Path /data/data/com.nsrt.veos.aiuv/files/.um/um_cache_1729386079939.env
Size 655B
SHA256 b2c07651d0668a43ecf91d0417396568b73e6f491fdc8579e33877e1d303b833
MD5 719e26c4dae405ecf8b26209618545d1
SHA1 f8428e98fc485b5077ecb1a0f2d7dfbf5c96600b
SHA512 ee522cf07e857fbc9ed736e4ceabeb1dc3841cffc7780f0ed3eae0128b89a0bf2db743bc34e625afdea0bfec40e62587fe7f7cc8ae25b92428a1d212d4d80a2d
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.nsrt.veos.aiuv/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 20c569f02917767608a11be015397ba75a11f5f93a03363dfa07c4dcc79bff93
MD5 8e48509558a4dfbfc63b52738b845824
SHA1 fad6d7a68dfcd2c10a37a5c74768c9a6f3d17fa7
SHA512 bd528f43f012d4d778995cc9d518513c8949054910ed6f7e1d051e650d0d903ecf68c95c84ee1d737e628009b8780ad110090a818584ab9bc097e46131209549
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.nsrt.veos.aiuv1

Path /data/data/com.nsrt.veos.aiuv/files/mobclick_agent_cached_com.nsrt.veos.aiuv1
Size 803B
SHA256 01b75846cf9665c3df3bb843827fde3edfe7772f279eca7aa906dd8c7707f481
MD5 1f9d0f72801b1eff0e50157b91073cd8
SHA1 2a335d25b62a5ba8ad56fdcdb76ec059fcf11d33
SHA512 d6edc5d31620889592a45f581b3c5c32d8ecea4d3f2fdd6678e34d4f6740d75511d61ea4e605fba4d30c2991daa623a6eb477e4c46dec813871d3e58af2be464
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.nsrt.veos.aiuv/files/umeng_it.cache
Size 350B
SHA256 22a990c49eee9c2c4e1f4392ee0d8893473abf4d85924e80352745ba08e4a80c
MD5 a6911cf3735befbe2f4e4844dacdf760
SHA1 5cffd4d079fa4baf41fdbb8a0a9bcdc71abb51a7
SHA512 7509ee14a0b12bd1ff3f6971568b53c2eb1df00dd49108fd9e514c7439abe8252e4b7daf617ddcb8fbf772cbe7077f0ba4d2f2550c3f4ab810b790421267c755
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.nsrt.veos.aiuv/app_mjf/dz.jar
Size 247KB
SHA256 676ca8a391c823e9a3fdd7df70a1fc30f8ebd4680db0daff3e057cc401c9ad83
MD5 18cfdb00841ddceacea677d69a13ba5a
SHA1 df15b27afa69a8f4e0e74c250e56df55e5701172
SHA512 83886e59ac0462888e9b82475ebaeca79dcbabc8a2a01a6217c0ca122e41c1d373fb878bf6e5e885b8459f259e834df91f2c8bf30a2a52824e298a65d6dda86a
SSDEEP 3072:aJ13gG3qJEISe/S/iZi6jbadQhyCBAfGbmhgMvo+FT4Xy+N9Z5E4T9sd4tefHZo8:aJG2ZeXZi6HaKgiMvo+qT5EdH26z1
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads