8f174da946771382956abc96371fb3ee2cca7e7b65d53d3e15250afadf79bf6b

Analysis

max time kernel
148s
max time network
155s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
20/10/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f997942f8aa4e964f23fc75fc9683f9_JaffaCakes118.apk
Size 550KB
Sample241020-bcpnes1fpj
SHA256 8f174da946771382956abc96371fb3ee2cca7e7b65d53d3e15250afadf79bf6b
MD5 5f997942f8aa4e964f23fc75fc9683f9
SHA1 e595187d7b61fef287559b9e7d6a1de0ef6e5540
SHA512 0f12be0bec92646f20a7f17034a6c8983e92ab7e7fe35ac89805665227cd8980b59e31a80451d58a45b96752e25947900f4a49dce5cdbaedaaedd00e1bf41a6e
SSDEEP 12288:Qb4LINCjgcNUJNlRMWU3ca27KT/jhaGOenVtI8eFxMMpk9:QTNftUMacKDO7mMC
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4505	com.nsrt.veos.aiuv

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.nsrt.veos.aiuv/app_mjf/dz.jar	4505	com.nsrt.veos.aiuv
/data/user/0/com.nsrt.veos.aiuv/app_mjf/dz.jar	4579	com.nsrt.veos.aiuv:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.nsrt.veos.aiuv

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nsrt.veos.aiuv

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
25	alog.umeng.com
59	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nsrt.veos.aiuv

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.nsrt.veos.aiuv

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.nsrt.veos.aiuv

com.nsrt.veos.aiuv
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4505

com.nsrt.veos.aiuv:daemon
1⤵
- Loads dropped Dex/Jar
PID:4579

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/user/0/com.nsrt.veos.aiuv/app_mjf/ddz.jar
Size 104KB
SHA256 0817449409b55007ece8d2d25f6d4b075ebea09c7feabee79636176bb0794792
MD5 656eec0445b1ac574b87e1bd3a98d969
SHA1 fe3e1ee6bac338416e47e90ed249cb82aeaf6bd4
SHA512 9a2737d22a9e647eadf4752513df79fe960cb69ec9563a2d7f504b3e91a95a6081876ab068355b8db49c44ea8627a33ca94c0244c2909668bec2620dc71a27fd
SSDEEP 3072:qFpSlDHr1Dxo8f2kqW1/xEwnYvV3PxRziLJU2:qGx1xJ3qW1n+9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz.jar

Path /data/user/0/com.nsrt.veos.aiuv/app_mjf/dz.jar
Size 247KB
SHA256 676ca8a391c823e9a3fdd7df70a1fc30f8ebd4680db0daff3e057cc401c9ad83
MD5 18cfdb00841ddceacea677d69a13ba5a
SHA1 df15b27afa69a8f4e0e74c250e56df55e5701172
SHA512 83886e59ac0462888e9b82475ebaeca79dcbabc8a2a01a6217c0ca122e41c1d373fb878bf6e5e885b8459f259e834df91f2c8bf30a2a52824e298a65d6dda86a
SSDEEP 3072:aJ13gG3qJEISe/S/iZi6jbadQhyCBAfGbmhgMvo+FT4Xy+N9Z5E4T9sd4tefHZo8:aJG2ZeXZi6HaKgiMvo+qT5EdH26z1
MD5 SHA1 SHA512 SSDEEP

Download

tdz.jar

Path /data/user/0/com.nsrt.veos.aiuv/app_mjf/tdz.jar
Size 104KB
SHA256 157b006e48d74dc023d671b5a7e9e61f96853be434db43efa8754aecba50e12b
MD5 30617d6621bcd972fcea53d04f3b2a55
SHA1 a0a51f60773e3a1eea2f929c8f1df896b6d71e7e
SHA512 d7735599a3186ba6ca0c6151299fc9353495e4cb4cf1b3a8aebfe6e0901e839f1027013aebb2d168c8fe2ace65fac6bbc89b56b8316e546bda879825febd1ad0
SSDEEP 1536:hnTcLepJZWlk7oQYyTjF1IsZEXfBq9u7H/sLu10eT/2GpTqMa4/WcNt2+ibrCsfF:hTcL7s/F1Isqs9XStT/VT//dCbNbLPF
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/user/0/com.nsrt.veos.aiuv/databases/lezzd
Size 28KB
SHA256 194b40a3911f23ea75c8f4543a13c1236ae15b02c0228a080615a1012f60e05a
MD5 fdb8a92e5060ce104e8f0faca55a47ce
SHA1 270d7ca30673e18cec1d2b9add71cba96dc426fe
SHA512 ad962634ddd027403b5677a9ca979763071ef4a9b6f0127b0c1fd4b3a8bc51f5c4fa71245c301d0dbbf60e18953a94621715ce3ca4addef82b18030e3d718122
SSDEEP 24:TLj0kSBieszXtUku+haaL6nwyLGSiGQQ:TskS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 8KB
SHA256 020159b421a1316a54bb8e3ff564374f631410d8a835a0270fbeb1e55df2a6b2
MD5 1df5992cb642ca0e112cac8062248966
SHA1 44d8fcbf23cf4589350fe5e820ba5699cef21df3
SHA512 6cfaf74b8746dcb384c0dad35507f57d99e1583d9bdd24a1401e7ea7a06243c8b775d175cad43bb1c5b7ad17ac865bdfd5fb0eef8cfaa0595acd4a9a97452e39
SSDEEP 6:7+/l9fOPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKVd//Xn:7+t1iqLmqKRmBEyPbEXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 8KB
SHA256 c82321d5f6ebf2792549c716f3ec2fe3329d64e52673ed5e163d6b30be44946b
MD5 091bc966956f56a2ffb45e2483206fef
SHA1 d75637df4d57032f11e37df16dd9ce70293f6ad4
SHA512 f1aacfccd019ec042133cfe320bed0cfc3b022802fd23a4eb5e36197dc998353633f6a34b730db21bdacd619d08a74c4d7ac384ca1b522d1d287607d615f9539
SSDEEP 12:7+tz8nqLyKPjSyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbUJV:7+twqLy2TUku+haaL6nwyLGSY
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 8KB
SHA256 ec923ef7a5ce9b15dfb961c197da8dea671ba049458cf9c91dd3abc722ea522c
MD5 e5e479f27d8560fc1862db7ba6f37790
SHA1 3b5e5cb234c14f94bc4be3cd568ab68f7b789b92
SHA512 adeb2dc5049b614be46a3732fdf01f34b3c6a1631a84330fa6abeec77e39d8ce7327525299fd35cd2cddedc6f6776fdff89211708736876144b313967e2fcd59
SSDEEP 12:7+t+FqLWem6QADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPb++:7+t+qLu6teszXtUku+haaL6nwyLGSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 512B
SHA256 8b7708a72ea79681a5d677984ae4c2e3656d60fc565c573f1a15a239066271d6
MD5 344e6a2c8c1cd273bb0aaa07ac40febb
SHA1 64a7130853b66bddbf99cc6e48c0cf10f3429d5e
SHA512 e784a10ac4e62eebc85a350a682ed0c920067511e178aa536193eb227c004707b01b8b6d330718b385f26f12fcc0310c586835b1718fa6176c42cc080f7bb502
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/user/0/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 8KB
SHA256 50194dac315f1fa40a34062a7c41092d99de982d0fbdd7acfcb0c8a7e344ef11
MD5 83cbd5ce68a6e9569db8863cb8b199e2
SHA1 0cf949c7a9e18d98b42ec38ee6816960ddaf3421
SHA512 71fbb2a1ab2b18a9e05ab49701620d7e9802afe39ebfe8afdc63829ba72265062f3cf3392a6f56126d227c7763aead03da1b37a94ca75e2d76207229401d6ea4
SSDEEP 6:7+/l9Jln1cg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK08:7+tMqLiuWdYRmBEyPbJ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/user/0/com.nsrt.veos.aiuv/databases/lezzd-journal
Size 4KB
SHA256 dccdf4cde27d4265672d61a758ab95b03eadb13d8adfbdb7c3dc0ecf276d1e61
MD5 a87fae4fa4cc91d5eddfa2816150d559
SHA1 b0ae122c99fd1ade6fd4d6f99807ba318c54322b
SHA512 dcf194160c400200de3cdf8bfd864fb3f3a0150c0a2c6d8740a011c7cf055a0edf6ef2fd743bfb134e299d0db1494d895d8b9b4ed2ae96387a5a1c5721af1f0f
SSDEEP 6:7+/lKkGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKT:7+tKPqLJdeWRmBEyPbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1729386085269.env

Path /data/user/0/com.nsrt.veos.aiuv/files/.um/um_cache_1729386085269.env
Size 651B
SHA256 1067ea32bd811d806208652825e46def68c28695f618cfc3dfa62c7a315b5673
MD5 96944b8b97076279fea5c50553c7190a
SHA1 9ef954e98eda5e542fe93d40ae15168b8dd71173
SHA512 876036028b37fce8eb0aba3ca9e391f9da6875649c644afcd8005d61e7f93799bd5fcc4cbda4ff17d51ef55a002772a76c0fa66b3d3f3406e31e413237240181
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/user/0/com.nsrt.veos.aiuv/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 ac4ec26f46d6ecb370686dafd16758543abc17f770df6427d1998d939dbdc00e
MD5 5a9b29aa9787d20dac4ab8fec4016d4f
SHA1 136576680757285691a8f883206aef425553e846
SHA512 a67b3321d3f1d210572bd10dea444d618e7b9d805aaab8a275c7431b70930f17bda1db3f4648c380b59ca5372ad0326d487645cc280446ede4f93e5310ae88b4
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.nsrt.veos.aiuv1

Path /data/user/0/com.nsrt.veos.aiuv/files/mobclick_agent_cached_com.nsrt.veos.aiuv1
Size 797B
SHA256 c3a011e7d7f606d3ce6a066cc71761e08d9cebed6eac07a580ce3a091448ed77
MD5 a3603ee69ac9e789a6990821bd663289
SHA1 d0b25b634df99b104f5dbdeb1227b9aa20fed0dd
SHA512 48c3cedd39e75593964e31b6e29ebf466670067add9fa9cc562ed1548423fa97fd067ddcedaf41cc43a2cf947034ff8188eee5245de4a5cdb90afdb2fa8e4855
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.nsrt.veos.aiuv/files/umeng_it.cache
Size 346B
SHA256 16c67c9f4da2eb9ca7a6504df5d42647f72b1d4dc4b6baba14d1e06941cede7a
MD5 ff329ff94605dc7b4b6ea84ba3674e99
SHA1 48a1ad370e17af2aac64fa283a0f8f1b3290c2e0
SHA512 2b6a33bdbbe9534362e6e2be57f9cef153f98600e2a20281325da8d70a5aaa5f8b53cca231fdd2fdff1408b5f10c32c6c290344cd04e4a39cc97521c29337472
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads