14e4e6112ade7224ac5fcf612a536601db5b24ea87c97a753175c44e9b8e9560

Analysis

max time kernel
148s
max time network
155s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
20/10/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6057c23c1a28a8e0111bc472b542b042_JaffaCakes118.apk
Size 637KB
Sample241020-e1l4zsyflg
SHA256 14e4e6112ade7224ac5fcf612a536601db5b24ea87c97a753175c44e9b8e9560
MD5 6057c23c1a28a8e0111bc472b542b042
SHA1 a79b3d0ad77085cb45dd7684e820daa614acf9c0
SHA512 158f4e6b93487ee1fc6612f97d77758974d3f7bd73746c9728af6c25a40220677dbcfeef8413c5dcdb168ee69d2afd5aba7a65f87be621855d675c399c598940
SSDEEP 12288:TI4L4oQI8Y0FotaKIUtrbMDp3zE1aaTJE5+/u9cejETeFxNM2f94vvQe6ERylT4O:+oL0otaYtXMDp3o1aKJY+/ufEWrMwiyh
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5002	com.zpba.malp.slga

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar	5002	com.zpba.malp.slga
/data/user/0/com.zpba.malp.slga/app_mjf/dz.jar	5063	com.zpba.malp.slga:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.zpba.malp.slga

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.zpba.malp.slga

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
6	alog.umeng.com
34	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.zpba.malp.slga

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.zpba.malp.slga

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.zpba.malp.slga

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.zpba.malp.slga

com.zpba.malp.slga
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5002

com.zpba.malp.slga:daemon
1⤵
- Loads dropped Dex/Jar
PID:5063

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddz.jar

Path /data/data/com.zpba.malp.slga/app_mjf/ddz.jar
Size 105KB
SHA256 1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2
MD5 23ba0b249042b7ba33e92c0199b0ea4a
SHA1 99b13ee9f7307316c2337953fceed87e9942b794
SHA512 0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861
SSDEEP 3072:ZFp3P/dHnYTPgW7hvtnKo719YDQXgQeRY3dn:Z7/NZW75tnKtggXRYtn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdz.jar

Path /data/data/com.zpba.malp.slga/app_mjf/tdz.jar
Size 105KB
SHA256 8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b
MD5 293ea5f01e27975bed5179ba79d80eac
SHA1 c5b0806a537fd1cb753e11f1a9684933317716b8
SHA512 c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53
SSDEEP 3072:tTcL+dZox99byIJeYF3OFotaKIMBtaEjgebMwO:tTcL+dZoVyIJeY0FotaKIUtaEj7bMZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd

Path /data/data/com.zpba.malp.slga/databases/lezzd
Size 28KB
SHA256 56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286
MD5 dae68dcffc3d522a79f98ebbc3b6d457
SHA1 6df5dce9a50f12044a2d20b8d1742ae47b82ee03
SHA512 23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd
SSDEEP 24:TLL0kSBieszXtUku+haaL6nwyLGSiGQQ:TkkS0FXtUkthaTwnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.zpba.malp.slga/databases/lezzd-journal
Size 8KB
SHA256 f808032c943d657a13c44b96d6eb1b25199d1e4f1b606e35d99b25ebb4bdd063
MD5 4f44d9089a47490ebd485702687812b7
SHA1 eb10fd416cf3a606854a311241e92518e67503fa
SHA512 9c3a486f978762e296d2ed3fb4b83777b9b93f6cd1dfd4fbfadfadb20a459ad304f1e53a77aab9fb75489e4928ae6328f7e9194dd2cac56bbddd3fdaea4deb16
SSDEEP 6:7+/l9QFPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuK0kt/WC:7+tmBqLmqCRmBEyPbLsL
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.zpba.malp.slga/databases/lezzd-journal
Size 8KB
SHA256 70c2a716e6ed4ccbeff5b2800b8ac60d917f60095b7d1bdf785583a976f34066
MD5 d9be782e02b301fe65981a3b5f5d500d
SHA1 e3fdfbb7fff97da731cc20bb8f17e8f1659c0a8a
SHA512 d394a2160a28a37bde69bf920aa0e6358dcba77119eda198c5961fcf6f956b0fd46e32531f840eb1eb9387a7608f402113bd4efcd9a2ce8189d98a722a69c3e0
SSDEEP 12:7+tdlinqLyKE4SyNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbT4ar:7+tGqLy9yUku+haaL6nwyLGScK
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.zpba.malp.slga/databases/lezzd-journal
Size 8KB
SHA256 615b560b406c6bfa347884ccb7e5175b2253658e2e5919206700cdfbd71dcd11
MD5 e1d6c3d8ad480748e14e5ff536806e3e
SHA1 3839e3c1d09a8434714e04888646cb3086703479
SHA512 214680d9885e2ef2545b07e23af18678a0fc4974c265f6b08cdf242ad02bba1036b1100a98d7e3ba94fe669b9fc5aeb0ecaab917a4f40dae89d4ad8f70a001b7
SSDEEP 12:7+txoqLWeOqQADYf3F6Dx9XHNTSFbyiVyu+ALCy9aFbh6WMwvrWp1mFRmBEyPbRz:7+tWqLGqteszXtUku+haaL6nwyLGS1
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.zpba.malp.slga/databases/lezzd-journal
Size 512B
SHA256 3400d8d98ec05a97fbe4f1a5b8961d5da32fa7eabb4601a3c820209e39108e3c
MD5 20a3808b48a520b2d8255c71401582aa
SHA1 b81359a99b446fc7786a92c3261cca0a5efa1c29
SHA512 7bc70b3cda7940a7cf6c2a0ca75b7baed9928c7173c4f9640fc6e89244596b1afcef377883863ad9a558b74aa6b278da6d6e40c7fc4d06f6a96061b0ca35439d
MD5 SHA1 SHA512

Submit Download

lezzd-journal

Path /data/data/com.zpba.malp.slga/databases/lezzd-journal
Size 8KB
SHA256 6a54989d2790d9e8dace5b676073548c2b48ea28017f6eec6ca2124aa8a0c7f1
MD5 5a60f07bd910b7596d7e9deed461bd1a
SHA1 9805ef481162d2dec5f9981224ee3fd37a37a8dc
SHA512 cd76b54e3bf31c703eb99349a4a04362be1501fae8d56dd03bdee053cc0212da8ad6c4b7ead14770e901e7d07618b2b58a7ea1a937a897d277ea936188475feb
SSDEEP 6:7+/l9J88Hn1xdWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKwA:7+tHfMqLiuWdwRmBEyPbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

lezzd-journal

Path /data/data/com.zpba.malp.slga/databases/lezzd-journal
Size 4KB
SHA256 9dda5e80fd86c830df94decf978f14bafdece37367843e430426ab11736e6ecf
MD5 a55c6e427fae0a49f23dcc1ea7ed7d14
SHA1 a77baf8faff7706531d4edc491a0b8ebdbe11fcd
SHA512 6f6e834dc4a432ab8f73a3b26ef7d9bfc0c70108b25185d73f4b754b1db0b98b058e7584b90f02d9321c0533d3015a602b1cdbae715a32173c33d7853f441ef6
SSDEEP 6:7+/lmgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK+:7+ttqLJdTRmBEyPbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1729398339715.env

Path /data/data/com.zpba.malp.slga/files/.um/um_cache_1729398339715.env
Size 657B
SHA256 0e327f4234749f4ae0d3595b02ce1cc7ae0e867fd1b2f1319c956041b94c9730
MD5 77372e807eb960957d30413c56e4a025
SHA1 bf76500e11b240cab03e843dc6763b7af814539c
SHA512 0eea6aec67fce12ce2db00c229a10198206bd3a7444eeb7d5ded2c71b8aab7104f8225d785bb3a6307f46110eefe8e542aefaebd5b20862222cb7259b751a2b5
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.zpba.malp.slga/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 ac28745a525c647f9b790d9c947d26908c66da8d1e20ae51879853eb1d0344d3
MD5 cd49a48cdfe0a53e6d8bafc539590955
SHA1 78d4d18ca2fab002594f4c3373c7052855193cee
SHA512 7b481f99049f9f0b7843bb69ef9f97e4beb98dcc7c2a8c7d603e83bb61888cd536138b21ada52814175b22f509599fb29144d8c76e2ecbda8971e6a08e1da919
MD5 SHA1 SHA512

Submit Download

mobclick_agent_cached_com.zpba.malp.slga1

Path /data/data/com.zpba.malp.slga/files/mobclick_agent_cached_com.zpba.malp.slga1
Size 806B
SHA256 e7088bbd6b07ef6f291325c92f0ac284862f7c37314e8765e9d22268943717bf
MD5 caca575a9d231e9db3bac8a8718833f7
SHA1 0a36ff27cd17f47d7a735ef689498c449c7c10e5
SHA512 b7d750af086c25f10c8a9d319382852633b9c8e50347c6ae9af73253b509a284e1cc86a5c6668db91db4b6757d6f35dea99540355254e2aecd482b3dc4ebc44e
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.zpba.malp.slga/files/umeng_it.cache
Size 352B
SHA256 2c6cb3497e51c02fd1887e31273462ea9cf1a418ecfb526c64a28d4317469546
MD5 05ffa6a2296d410c475f473a06f73fbf
SHA1 6300c525bbd6e2fc70b3ced2d609e2fbe32afeca
SHA512 3f29f11a77e7d1435925bf8e2a1266e003a5784777d87611fa821b7001a32ce61b443886dfa450c46585cde7e608922b4475489e7b472b40f718ccfbda07f6d9
MD5 SHA1 SHA512

Submit Download

dz.jar

Path /data/user/0/com.zpba.malp.slga/app_mjf/dz.jar
Size 248KB
SHA256 3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3
MD5 a54a18b58c6720991c021f433dfb2a46
SHA1 d2ffa07919f92b6e04914e39843f08fdb2a75b68
SHA512 e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc
SSDEEP 3072:No4SBiL5O8+ZfL6xc/5ktKuniJDrbEaXqgXoL1E9h+N9w5E4y9sZ4tefH6Tvc2t:KmFOR6xcRkYqaXqEoL1y5EcH8ft
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads