Analysis Overview
SHA256
d0a073da9f6d2b87257a4117e9e741a12e0c52d32f04630e6af7991dd26af32f
Threat Level: Shows suspicious behavior
The file 51cc6911945573a8c16497de1becbe37_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Tries to add a device administrator.
Loads dropped Dex/Jar
Queries information about running processes on the device
Reads the content of SMS inbox messages.
Acquires the wake lock
Declares broadcast receivers with permission to handle system events
Requests dangerous framework permissions
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-05-17 22:27
Signatures
Declares broadcast receivers with permission to handle system events
| Description | Indicator | Process | Target |
| Required by device admin receivers to bind with the system. Allows apps to manage device administration features. | android.permission.BIND_DEVICE_ADMIN | N/A | N/A |
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows an application to write the user's contacts data. | android.permission.WRITE_CONTACTS | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS | N/A | N/A |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to write the user's contacts data. | android.permission.WRITE_CONTACTS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-17 22:27
Reported
2024-05-17 22:30
Platform
android-x64-20240514-en
Max time network
144s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.213.14:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.206:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.180.4:443 | tcp | |
| GB | 142.250.180.4:443 | tcp | |
| GB | 142.250.200.8:443 | ssl.google-analytics.com | tcp |
| GB | 216.58.212.194:443 | tcp |
Files
Analysis: behavioral3
Detonation Overview
Submitted
2024-05-17 22:27
Reported
2024-05-17 22:30
Platform
android-x64-arm64-20240514-en
Max time kernel
179s
Max time network
132s
Command Line
Signatures
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/user/0/com.htfmec.feimjvbvr/app_fglwlfoeui/vrgcl.jar | N/A | N/A |
Queries information about running processes on the device
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.getRunningAppProcesses | N/A | N/A |
Reads the content of SMS inbox messages.
| Description | Indicator | Process | Target |
| URI accessed for read | content://sms/inbox | N/A | N/A |
Tries to add a device administrator.
| Description | Indicator | Process | Target |
| Intent action | android.app.action.ADD_DEVICE_ADMIN | N/A | N/A |
Acquires the wake lock
| Description | Indicator | Process | Target |
| Framework service call | android.os.IPowerManager.acquireWakeLock | N/A | N/A |
Processes
com.htfmec.feimjvbvr
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.201.106:443 | tcp | |
| GB | 216.58.201.106:443 | tcp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.200.8:443 | ssl.google-analytics.com | tcp |
| US | 1.1.1.1:53 | med-elektrik.com | udp |
| GB | 142.250.178.14:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.238:443 | android.apis.google.com | tcp |
| GB | 142.250.178.4:443 | tcp | |
| GB | 142.250.178.4:443 | tcp |
Files
/data/user/0/com.htfmec.feimjvbvr/app_fglwlfoeui/vrgcl.jar
| MD5 | 6358192a8f7419b8c762c895947db9f2 |
| SHA1 | 851858b0a9e0ee9d48b6136fd5df73efcb2c8408 |
| SHA256 | 77d0a87feea78109a51a25ff6baf5fe6a64b8e4364f5eefb35361465057dc7a8 |
| SHA512 | b06ccbafd287a52c0dbb8cd5577e407e2002ba65430d1164139771fdee122076ed4272e5e4d0bbd7e064df994413bfa71bc2f05b30613c6277c1ee6df00cf76b |
/data/user/0/com.htfmec.feimjvbvr/app_fglwlfoeui/vrgcl.jar
| MD5 | e46b041e128dfbcf88224eb924a97680 |
| SHA1 | 4a06d1121a18bac5c8ad2d58bbc84f1715be356b |
| SHA256 | 4acd98b210ae8e393e884d0e428b2bc7754d3268e13f7271bca0ab24287fdd10 |
| SHA512 | e086db88bf1e081fb24e78ebdfa00861bc27de8af9d4e4f0983560dba8ee2fff63ccd4065b3f34d6db56ab38e4737724712ddea5a3da50a15c06fb6cf4e433d3 |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-17 22:27
Reported
2024-05-17 22:30
Platform
android-x86-arm-20240514-en
Max time kernel
179s
Max time network
131s
Command Line
Signatures
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/user/0/com.htfmec.feimjvbvr/app_fglwlfoeui/vrgcl.jar | N/A | N/A |
| N/A | /data/user/0/com.htfmec.feimjvbvr/app_fglwlfoeui/vrgcl.jar | N/A | N/A |
Queries information about running processes on the device
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.getRunningAppProcesses | N/A | N/A |
Reads the content of SMS inbox messages.
| Description | Indicator | Process | Target |
| URI accessed for read | content://sms/inbox | N/A | N/A |
Tries to add a device administrator.
| Description | Indicator | Process | Target |
| Intent action | android.app.action.ADD_DEVICE_ADMIN | N/A | N/A |
Acquires the wake lock
| Description | Indicator | Process | Target |
| Framework service call | android.os.IPowerManager.acquireWakeLock | N/A | N/A |
Processes
com.htfmec.feimjvbvr
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.htfmec.feimjvbvr/app_fglwlfoeui/vrgcl.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.htfmec.feimjvbvr/app_fglwlfoeui/oat/x86/vrgcl.odex --compiler-filter=quicken --class-loader-context=&
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 172.217.169.14:443 | tcp | |
| US | 1.1.1.1:53 | www.google.com | udp |
| GB | 142.250.180.4:443 | www.google.com | tcp |
| US | 1.1.1.1:53 | med-elektrik.com | udp |
| GB | 142.250.178.3:443 | tcp | |
| GB | 142.250.200.46:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.238:443 | android.apis.google.com | tcp |
Files
/data/data/com.htfmec.feimjvbvr/app_fglwlfoeui/vrgcl.jar
| MD5 | 6358192a8f7419b8c762c895947db9f2 |
| SHA1 | 851858b0a9e0ee9d48b6136fd5df73efcb2c8408 |
| SHA256 | 77d0a87feea78109a51a25ff6baf5fe6a64b8e4364f5eefb35361465057dc7a8 |
| SHA512 | b06ccbafd287a52c0dbb8cd5577e407e2002ba65430d1164139771fdee122076ed4272e5e4d0bbd7e064df994413bfa71bc2f05b30613c6277c1ee6df00cf76b |
/data/user/0/com.htfmec.feimjvbvr/app_fglwlfoeui/vrgcl.jar
| MD5 | e46b041e128dfbcf88224eb924a97680 |
| SHA1 | 4a06d1121a18bac5c8ad2d58bbc84f1715be356b |
| SHA256 | 4acd98b210ae8e393e884d0e428b2bc7754d3268e13f7271bca0ab24287fdd10 |
| SHA512 | e086db88bf1e081fb24e78ebdfa00861bc27de8af9d4e4f0983560dba8ee2fff63ccd4065b3f34d6db56ab38e4737724712ddea5a3da50a15c06fb6cf4e433d3 |
/data/user/0/com.htfmec.feimjvbvr/app_fglwlfoeui/vrgcl.jar
| MD5 | 5bde45185ce64c5ae31520156572c214 |
| SHA1 | f23db9504bda1aea007c40cba6b9654ace4b1164 |
| SHA256 | 347cf56bf5c23d728136f8ae0b0fddb5aea758ce133fb3f1271fa244e0bdac3c |
| SHA512 | a3091ffa3681ba4f4978101cbf7b539004697f8d80befc85afd40879befda5c62daf474f561cc11a77ec6f98dbfe488ba970208d5cdee6a179e23b7f8a5b3d1f |