Analysis Overview
SHA256
b5f9a2b92bccb21d7cdd0d81c3d5b4a63ad04775e288218f1a8e5a79ed54025d
Threat Level: Likely malicious
The file 27d205ef717562d9df6ef2768b40e20b_JaffaCakes118 was found to be: Likely malicious.
Malicious Activity Summary
Requests changing the default SMS application.
Removes its main activity from the application launcher
Queries the mobile country code (MCC)
Queries the phone number (MSISDN for GSM devices)
Tries to add a device administrator.
Requests dangerous framework permissions
Declares broadcast receivers with permission to handle system events
Reads information about phone network operator.
Queries the unique device ID (IMEI, MEID, IMSI)
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-05-09 02:19
Signatures
Declares broadcast receivers with permission to handle system events
| Description | Indicator | Process | Target |
| Required by device admin receivers to bind with the system. Allows apps to manage device administration features. | android.permission.BIND_DEVICE_ADMIN | N/A | N/A |
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-09 02:18
Reported
2024-05-09 02:21
Platform
android-x86-arm-20240506-en
Max time kernel
117s
Max time network
130s
Command Line
Signatures
Removes its main activity from the application launcher
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Requests changing the default SMS application.
| Description | Indicator | Process | Target |
| Intent action | android.provider.Telephony.ACTION_CHANGE_DEFAULT | N/A | N/A |
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Queries the phone number (MSISDN for GSM devices)
Tries to add a device administrator.
| Description | Indicator | Process | Target |
| Intent action | android.app.action.ADD_DEVICE_ADMIN | N/A | N/A |
Reads information about phone network operator.
Processes
zzzzzz.xxxxxx.cccccc
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | travimzukov.in | udp |
| US | 1.1.1.1:53 | semanticlocation-pa.googleapis.com | udp |
| GB | 142.250.187.234:443 | semanticlocation-pa.googleapis.com | tcp |
| GB | 142.250.178.14:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.179.238:443 | android.apis.google.com | tcp |
| GB | 142.250.187.202:443 | semanticlocation-pa.googleapis.com | tcp |
| GB | 142.250.187.202:443 | semanticlocation-pa.googleapis.com | tcp |
Files
/storage/emulated/0/help.txt
| MD5 | 73329564760013a7824ff9d5d1af91ff |
| SHA1 | 85841abddb12dc3591a5990c6527df65a5e63c87 |
| SHA256 | a51a6c19a1ffc7416827e89adf20749d23ad42452c396cf7e627409f2896922c |
| SHA512 | 344b1271efcc084b24e4e75223f1a900ec127c1e979aeab32bfed887712388a7ceeb8bd9e70d5c1721ac6dd1e64d640ec973f9ef16d6f0f85e6870e53edab00a |
/data/data/zzzzzz.xxxxxx.cccccc/files/INSTALLATION
| MD5 | 6016e4355476b1140c1fd2682894fa73 |
| SHA1 | 0d5c968f68c9a95cbcac94cbc3e8b630000266a2 |
| SHA256 | 0f2f2fdcf64cee88db9adddff299c8e21c5294aac7a00280b385dbfd2b38d5e1 |
| SHA512 | 786b5399f2f3fb79f94064434bb521fb18896c7902365b3768a21159b30a61c057407a7aa743d8976279c2f1bda72245c0e522f24f990972b198a0c3519d7319 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-09 02:18
Reported
2024-05-09 02:22
Platform
android-x64-20240506-en
Max time kernel
3s
Max time network
131s
Command Line
Signatures
Removes its main activity from the application launcher
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Queries the unique device ID (IMEI, MEID, IMSI)
Processes
zzzzzz.xxxxxx.cccccc
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 172.217.169.8:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.200.10:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 172.217.16.238:443 | android.apis.google.com | tcp |
| GB | 216.58.201.110:443 | tcp | |
| GB | 216.58.212.194:443 | tcp | |
| GB | 142.250.178.4:443 | tcp | |
| GB | 142.250.178.4:443 | tcp | |
| GB | 216.58.204.78:443 | tcp |
Files
/storage/emulated/0/help.txt
| MD5 | 73329564760013a7824ff9d5d1af91ff |
| SHA1 | 85841abddb12dc3591a5990c6527df65a5e63c87 |
| SHA256 | a51a6c19a1ffc7416827e89adf20749d23ad42452c396cf7e627409f2896922c |
| SHA512 | 344b1271efcc084b24e4e75223f1a900ec127c1e979aeab32bfed887712388a7ceeb8bd9e70d5c1721ac6dd1e64d640ec973f9ef16d6f0f85e6870e53edab00a |
Analysis: behavioral3
Detonation Overview
Submitted
2024-05-09 02:18
Reported
2024-05-09 02:22
Platform
android-x64-arm64-20240506-en
Max time kernel
2s
Max time network
132s
Command Line
Signatures
Removes its main activity from the application launcher
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Processes
zzzzzz.xxxxxx.cccccc
Network
| Country | Destination | Domain | Proto |
| GB | 142.250.179.238:443 | tcp | |
| GB | 142.250.179.238:443 | tcp | |
| GB | 142.250.179.238:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.187.200:443 | ssl.google-analytics.com | tcp |
| GB | 216.58.201.100:443 | tcp | |
| GB | 216.58.201.100:443 | tcp | |
| GB | 142.250.178.2:443 | tcp | |
| GB | 142.250.180.6:443 | tcp | |
| GB | 216.58.204.66:443 | tcp |
Files
/storage/emulated/0/help.txt
| MD5 | 73329564760013a7824ff9d5d1af91ff |
| SHA1 | 85841abddb12dc3591a5990c6527df65a5e63c87 |
| SHA256 | a51a6c19a1ffc7416827e89adf20749d23ad42452c396cf7e627409f2896922c |
| SHA512 | 344b1271efcc084b24e4e75223f1a900ec127c1e979aeab32bfed887712388a7ceeb8bd9e70d5c1721ac6dd1e64d640ec973f9ef16d6f0f85e6870e53edab00a |