Malware Analysis Report

2025-08-10 23:55

Sample ID 240517-s3pjsaee24
Target 5039d7038eb55d127685f3bc28601d44_JaffaCakes118
SHA256 60fa38ba267e5cbebe9c10ca95dd93fa01f27aa982ca759fde1f7296b80bf1c0
Tags
upx collection discovery evasion impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

60fa38ba267e5cbebe9c10ca95dd93fa01f27aa982ca759fde1f7296b80bf1c0

Threat Level: Likely malicious

The file 5039d7038eb55d127685f3bc28601d44_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

upx collection discovery evasion impact persistence

Patched UPX-packed file

Requests cell location

UPX packed file

Checks CPU information

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests dangerous framework permissions

Checks if the internet connection is available

Listens for changes in the sensor environment (might be used to detect emulation)

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-17 15:39

Signatures

Patched UPX-packed file

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-17 15:39

Reported

2024-05-17 15:39

Platform

android-x64-20240514-en

Max time network

6s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-17 15:39

Reported

2024-05-17 15:39

Platform

android-x64-arm64-20240514-en

Max time network

7s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-17 15:39

Reported

2024-05-17 15:42

Platform

android-x86-arm-20240514-en

Max time kernel

5s

Max time network

149s

Command Line

com.vigo.tongchengservice

Signatures

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Listens for changes in the sensor environment (might be used to detect emulation)

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.vigo.tongchengservice

Network

Country Destination Domain Proto
GB 142.250.200.42:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 www.google.com udp
GB 142.250.187.228:443 www.google.com tcp
GB 142.250.200.42:443 tcp
GB 142.250.200.42:443 tcp
CN 203.107.1.97:443 tcp
US 1.1.1.1:53 adash.man.aliyuncs.com udp
CN 59.82.40.77:80 adash.man.aliyuncs.com tcp
US 1.1.1.1:53 msg.umengcloud.com udp
CN 111.63.206.4:443 msg.umengcloud.com tcp
US 1.1.1.1:53 umengacs.m.taobao.com udp
US 1.1.1.1:53 amdcopen.m.taobao.com udp
CN 203.119.217.116:80 amdcopen.m.taobao.com tcp
CN 123.183.232.17:443 umengacs.m.taobao.com tcp
CN 203.119.217.116:80 amdcopen.m.taobao.com tcp
US 1.1.1.1:53 plbslog.umeng.com udp
CN 36.156.202.73:443 plbslog.umeng.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
GB 172.217.169.66:443 tcp
GB 142.250.179.238:443 tcp

Files

/data/data/com.vigo.tongchengservice/databases/MessageStore.db-journal

MD5 a5711b8f1228e29d2a40ee2cd8e8f10c
SHA1 64a1096f3506f7469ce381183b7edeb79742c69e
SHA256 601ee99130dbdce765f8fd319215a638590ff82214d86469f52cb19acd67ad8b
SHA512 5d7f2402085d7f7b505c16358600cc11e19fcb76bf1d65ae82364a31d48ea5603d1864c4590da596f6c8354a9e82a7874e64be721da00d1dac54d04da2b8e3b1

/data/data/com.vigo.tongchengservice/databases/MessageStore.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.vigo.tongchengservice/databases/MessageStore.db-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/com.vigo.tongchengservice/databases/MessageStore.db-wal

MD5 3d2f6e16ea2b9983a72e040f54d226b5
SHA1 1c75dec310728d33108f793fd755bb5ea35e33f4
SHA256 d1718dd9b2469e56407b6339da710bfd8f5b3efbfa189070c4b9a42b3e68edf3
SHA512 ed1ec5121b9b8571a20a17d70715b5d82c670d044e8143e94c08eee51978dff3e5426279d71c9f48be0ef9475944045cf61c47ec495f514659dc24099c280770

/data/data/com.vigo.tongchengservice/databases/MsgLogStore.db-journal

MD5 a8a5c3f89ef3c1eb2a6e1f03376125c5
SHA1 d55330bdc5409caba120c8d01ad37c0621829c9c
SHA256 22833a632fdb46d68d54d8fb84f0c29f1614cc3df52ece4d62c86bfc44c8ca87
SHA512 086569bc807f1bb2d9486dd86e58b21ac6b4d3013925033710434c4d712a46c1aa3fc19b68b5f29a23c722c6faaf55814bbd0750a382fea72f50a19dc7b4cb14

/data/data/com.vigo.tongchengservice/databases/MsgLogStore.db-wal

MD5 7eeba7ca5d265c99b3b5b039d4d5cc6e
SHA1 9f400f64aa2d413d6ab824993a182c2ed9ce8006
SHA256 c6233f29bda8d81e375b7bb63ae087e3c2c82701cc50e2f79ffb032f7e850e36
SHA512 b12f1ae252f2c7cf077c9b6594dda5be3323177afd00320df9bec56c609c8914baaa5e2b0a6457f66c13aa1e695cfaee856faa7f275082925b096c22b4d6bf57

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 57daa271140e90119ad0549ad3c442b2
SHA1 d9c886bf79ac737ef8d04de7a260e903ef6f7d1c
SHA256 f87aed113e29932d16e7b850e18c197db3769496b8793a87c6c631da6bc53500
SHA512 7f95f3f269ae32336d663f1fc5f1dc6be63b68b61cb4c9269981a45b4a77b1307e65c3fa065fb1737b53c071afc6b6f23858648e425fd433208cd609f1d0d6f5

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 b1588176dab11c3be63f3b8fc48e35f4
SHA1 eabf3ea0876bd4f0ca707f09d952e2956b8ca781
SHA256 cbe02d1a376c8ee66f9ab400f4cbc8ca27b8c28ea3d29db64e5336f99f21240a
SHA512 59f748173c6352b611d051460e90b6b019bda3db46fed195fdaadfbebd9bd63b7f0b043a43e69db5220043240e0c1f742e013c290fd8a4aef47a53f5f11f7b79

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 7191c2f53b68ebf91ae15081b2428e40
SHA1 05c5713a54b42f1b7c9f2d8fc1fe7e1ba3466e10
SHA256 8c94d958f1ab07f5481778ba1316d7b5461a7cf5f797cb93f087fa61a17b4daa
SHA512 3b9203e43c1d1e8e557ed9c8c21b91d5d53e14d409e06a18be89d3ff3c0ab661cb20b5232fcf13d8d4488f65b24958df1f620bacd221f336096dbc1cdaa2b86c

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 16a536e18a452414c674b058cf58e17b
SHA1 ecd3c44e3e4528e4740e4c1b21433d6a628f0ac7
SHA256 b0c8d6adda7bda88c413b1661835df32b0ce4dcaaf838ce98b27e423cfb904d1
SHA512 d0a5ad1adbe1fc331e4ad83bb2ab84bc5a3129cb463a45effc1183f35db98957c2d4edf82aa16428e45e5d16e2e527164f5f1a33d1d2fa3282af415695d72433

/data/data/com.vigo.tongchengservice/databases/accs.db-journal

MD5 ef1423cde77f5a88466ec24917ac2cd2
SHA1 822f9dc99eac24e7a79545f8825d4129bfa7e9d0
SHA256 5f2fe427e2e553916db430c5f49b8ff82924b2a06259b88637af1420136a2f17
SHA512 3a249dafbdc03a13907f49adac64f99ec0159c0037877df45949df652c958e60262bc98b95bcea053f74056e69e89554e97f4a1b914cb6728a526c051aba5de7

/storage/emulated/0/Android/data/com.vigo.tongchengservice/files/tbslog/tbslog.txt

MD5 c145025027d77000fa015009616f6fe2
SHA1 15ea9e0825be045d8ecc22cc0edda070f2c5d400
SHA256 ebbca6da8023502cab6c3b6730f75bf988b437d5bda1460d930e24518053c8d1
SHA512 9b8bf4ef173965e56527c3a726df8e8fdcdd496e35dd8a23d598bad2b9457a5f75875b0a34487356dea7774a34178679b202433c4da0df4bd0a112ce3c1ef4aa

/data/data/com.vigo.tongchengservice/databases/accs.db-wal

MD5 a67baee6ee1f353da95f0de30b72fd74
SHA1 dc17d4ab07801b1135041c1b9b98bc5a2bb48220
SHA256 a5893846ef8306c8cce58c5ab10ead5ba5a40a3cae7e663b3b559066aa367c2d
SHA512 f04c2394dbaca7de70ca68cc21dfddcfea47b071a4f5b08e481771c20d78a226265ae2a6fca390338e669ffed0f2c5a7e008cf486fd77a23fbe5dfee11511dc7

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-17 15:39

Reported

2024-05-17 15:39

Platform

android-x86-arm-20240514-en

Max time network

6s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
GB 142.250.200.14:443 tcp
N/A 224.0.0.251:5353 udp

Files

N/A