Malware Analysis Report

2025-08-10 23:58

Sample ID 240518-la5xqsdc8y
Target 54084a6b8f501134680e61e9eecc6663_JaffaCakes118
SHA256 9ad3906316b67d988a08c4048f137224e0a01baa7502d1b051a817ef42acb384
Tags
banker discovery evasion impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

9ad3906316b67d988a08c4048f137224e0a01baa7502d1b051a817ef42acb384

Threat Level: Likely malicious

The file 54084a6b8f501134680e61e9eecc6663_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

banker discovery evasion impact persistence

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about running processes on the device

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

Queries information about the current Wi-Fi connection

Checks if the internet connection is available

Reads information about phone network operator.

Requests dangerous framework permissions

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-18 09:20

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 09:20

Reported

2024-05-18 09:23

Platform

android-x86-arm-20240514-en

Max time kernel

116s

Max time network

155s

Command Line

com.kailashtech.ziyoke01

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.kailashtech.ziyoke01

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 www.easemob.com udp
US 1.1.1.1:53 sapi.map.baidu.com udp
US 163.181.154.240:80 www.easemob.com tcp
US 163.181.154.240:443 www.easemob.com tcp
HK 103.235.46.245:443 sapi.map.baidu.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.179:80 alog.umeng.com tcp
US 1.1.1.1:53 a1.easemob.com udp
US 1.1.1.1:53 api.share.mob.com udp
US 1.1.1.1:53 www.ziyoke.com udp
CN 180.188.25.42:80 api.share.mob.com tcp
CN 180.188.25.42:80 api.share.mob.com tcp
CN 123.57.22.44:8082 tcp
CN 47.95.246.247:80 a1.easemob.com tcp
GB 142.250.178.3:443 tcp
CN 223.109.148.130:80 alog.umeng.com tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 101.201.233.110:80 a1.easemob.com tcp
US 1.1.1.1:53 api.share.mob.com udp
CN 180.188.25.42:80 api.share.mob.com tcp
CN 223.109.148.177:80 alog.umeng.com tcp
US 1.1.1.1:53 api.share.mob.com udp
CN 180.188.25.42:80 api.share.mob.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umeng.co udp
US 1.1.1.1:53 api.share.mob.com udp
CN 180.188.25.42:80 api.share.mob.com tcp
US 1.1.1.1:53 api.share.mob.com udp
US 1.1.1.1:53 api.share.mob.com udp
CN 180.188.25.42:80 api.share.mob.com tcp
CN 180.188.25.42:80 api.share.mob.com tcp

Files

/data/data/com.kailashtech.ziyoke01/files/ver.dat

MD5 5f7335045aed321b93c6ebb7a4d7417a
SHA1 35fbd4bee538b385d7abfc56df4e701615f73784
SHA256 f9d1a10b6885f6c28d841e07df992a2f620dd69e65d0a318523c232982158ed9
SHA512 ae94d011816076c988605e82e75c18ca6cb1708a20f079ac6dadc4c874c16b653a9ade7ec1015deec39bf98b840be69eb6e0d3705321e0bc59c8460c4de6ec4f

/data/data/com.kailashtech.ziyoke01/files/CMRequire.dat

MD5 25e57636aee83606d202f04f26c2913b
SHA1 1ef0ade456ba38aa31584d0fbce647d0ba74b399
SHA256 89c56da41f0046c9e733fed330d2636d623510c217f72c2d025df3343dc66783
SHA512 3a8d294b8be98abe4d18116cbf7c16d44a541d1d20dd4dfbbbf3bbd8cb7997abcbaf51790bbc1978135d888c4e89868a9a2575d9cfed65a331969de77ba07326

/data/data/com.kailashtech.ziyoke01/files/VerDatset.dat

MD5 caaa975d7bf4952bd5dd695ade33f1da
SHA1 119373fbb2db036712df72ec9b26c0c2840dfbb1
SHA256 d0f94264a6b5c355dbf5c0516202c732bcae471a2401542b2ca43307727a0d02
SHA512 db2acdecd236eab67cb67151032f53e51c9c04e754f3c21d74e05cacb1ea5edecbbccbd66ee760624b9cac97b8dd77f568324e8abc2b9c16aa73131db81c8b06

/data/data/com.kailashtech.ziyoke01/files/cfg/a/ResPack.rs

MD5 37c7d7a469620c696b8812831a527d62
SHA1 2e54375cde7ad35666184f5c7aeb65d5887f746c
SHA256 f3f542caf19e546f5cc1d265d5e6e35fa5ff32bb24e9282a60ef21d4c8588d9e
SHA512 8726878886379a8174b1ea11bb0c21dc6ef9bfe0ff2eafdfc4260a8c8666be82e3fd95309915aa0b40ad1a34b2f8f62f7c33860247562e84cac7e156dbf995bb

/data/data/com.kailashtech.ziyoke01/files/cfg/h/DVHotcity.cfg

MD5 6c495e47c754a9b25437ff9a88c7a51e
SHA1 8c4e36fda1e1f80918a3a8f1812c4e68b2326a4f
SHA256 e68e66e643d690d203a5153156e9cd6383ae1b3c481afa4b19e903d4a82289a3
SHA512 f3c030504cf50fdbd284acbdd893c948fb7ddb7544ce01d11c94fb00fb554f878949b1867fd5ab6c25e76c4be717aa819a917d4f25c8eba904df1a2819becf1c

/storage/emulated/0/Android/data/com.kailashtech.ziyoke01/zyk-kailashtech#ziyoke01/log/20240518/000.html

MD5 78196c47739d1ceb2e2e88bf03c8717c
SHA1 28286b82496d3fd83865d158ad27eeef457f6986
SHA256 7b0f484995509b7a471238a63edad8e7638d070cbfaa7b4d41c6058a4d24daf9
SHA512 ae8c79decc15de0cf2308c66caecef50dd88202fb4e0f5985f87417e43e4649b0b9a7f32f91763775bac36fa31af32af7cfcecdcfc2d71b1467501c021fc48d8

/data/data/com.kailashtech.ziyoke01/files/cfg/l/DVHotcity.cfg

MD5 1c6abcbbd253448057930ad1cc59ac75
SHA1 a5845d1c4bc87b8b4785b456d76edcb8309eda4e
SHA256 a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136
SHA512 71aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631

/data/data/com.kailashtech.ziyoke01/files/cfg/h/DVHotMap.cfg

MD5 c16f5ca1517683c46e02a6b71aab3c00
SHA1 2d09a048d1b8d556d89d4d723947e9e234b5e59b
SHA256 13d4fbc0d1cb7c2761641a3632c440f6f1d919dce731b8c32cb35e652b0b39f9
SHA512 a692b79382747548fd8be8ed94c06198b143c167be1e96f60d8ea7ee9432a0eb1a0cd73d0704523e487d59443bf7ad13eb36e47b67864e227917d33225e3e62b

/data/data/com.kailashtech.ziyoke01/files/cfg/l/DVHotMap.cfg

MD5 cc3fad9057e0940ad4d4c7ad27922023
SHA1 403cbbcd7b819733b5caf49ed2a58d654441e99d
SHA256 f6d90bd8621889ab994374b4f51a1c3f9b028aab1a2129b8b3b0e1d7c5c37864
SHA512 ebaf2b8c56bc15826ef38b36e72ae41765fc723470c6dcc40bf9f31118f252777072ad39a535a79f53b6aa29811b4b21cebbc9810c47e34ef9400246d789ab21

/data/data/com.kailashtech.ziyoke01/files/cfg/l/DVDirectory.cfg

MD5 65685a117c72fe8fbf5a92b07073c99e
SHA1 b115b527f74e4c291edcaab19b316a446aca8f5b
SHA256 19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8
SHA512 e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253

/data/data/com.kailashtech.ziyoke01/files/cfg/l/DVVersion.cfg

MD5 e962c995c0664b5cd8d067db1561cad7
SHA1 263524863998525598f663ba7134ecec2ab592b2
SHA256 b83792f572112503fa2c542595047271d632318a775061ae3a964948738639f8
SHA512 7337967c5759f8a078eed90adc45054e5642b1e319800549c80395dcdc1956baa8d9741348e1dc0be931f24cdb899b95d4beec35e52995703dad8d0feb04ab26

/data/data/com.kailashtech.ziyoke01/files/cfg/h/DVDirectory.cfg

MD5 4baa4ede52eacda76bd26d5838cc2de3
SHA1 38b65c75440581f43ddb32ef17480e5c87f0153f
SHA256 c0f2b002adafe50265789ca04bc8dab8c176e6a7eaae164fdb98ebcb9ff98eb2
SHA512 58fef595b1db5f8fa7dbfcaa3b6b676bdbec8931ffa833858e2452c2f35a1b192746d2315acd27551594377ac121ec80574deee632d4bfa94b6315b8a0d33feb

/data/data/com.kailashtech.ziyoke01/files/cfg/a/mapstyle.sty

MD5 db362e36518c847ae80caca571e3c8c8
SHA1 610911bf7869016fb7c9a2026b3024eacf0b4593
SHA256 95549560fbb3d96dc791c2d16fdd5f098784eee75ac293556fe9688fb2f0ec9d
SHA512 41fa2b9b61c131b0926d0f47f86eea56859ca0d4e44ac23647a73ff4b98214183cb0a523336dcae4e2ddb4be932e994e1950365fd3590eb2f7c3b96bd4bb8a41

/data/data/com.kailashtech.ziyoke01/files/cfg/a/satellitestyle.sty

MD5 6034f2a3f8bc9639ae820bd977bde4a0
SHA1 599f7994853b61bc5ee09a75b6383a13a5a685f7
SHA256 753705cb1ab2a676a9ef48881cfb036f212c4a7e7a5d34d9f8708075078e5818
SHA512 acaf0d146e4e3739eeaa40d46f7002776ebc4074bb89d12a5c25b12f53190a0e367ef0bd3225835e7e4b39a70b06e9f7328b1e342a9c5829af7610c14d41898f

/data/data/com.kailashtech.ziyoke01/files/cfg/a/trafficstyle.sty

MD5 1e4b535871c4feb2010b614713def5c7
SHA1 4c5dc67838d12b795b6882c6dbbcc6767e42184f
SHA256 efa3ec85127a21a8c8a74640acc5fe1d992952964d4f257682f832f63c2ad3fc
SHA512 0c5443dbfdafab2e6cb7740587f48ca9a2c971b93afafcebccd17691edaa7c7fb75dfd1b6c939dd591a5aa65977f55e64b6c3690ab0a660432269fc43bf3133c

/storage/emulated/0/baidu/.cuid

MD5 ba1f787aa1a8a36dd0515cb89124c64f
SHA1 41aab14c5e0d184d3e317f6c837119d64bdc029d
SHA256 7b3ada1608e20ad449e9c63eb904afc4700931e4c9bb521b3c4cf63e90d48539
SHA512 e09304da628d0f7f055afb04b47712ec16e00a8f591a79d83d8d668f751cb6813afecb09f7838fccd2d1d646ada24a54df3281076e25e5b216e7d7451dc2f3d7

/storage/emulated/0/Android/data/com.kailashtech.ziyoke01/zyk-kailashtech#ziyoke01/log/20240518/000.html

MD5 348376f4f8af0021d946b4dfa9b5deb8
SHA1 76100366e54edf14c3c2cb2ec6d4dc5f7716551d
SHA256 284a94e2a7198dd4e0f146beb55f8f41f2be536316fb5b87efc014497898d5c1
SHA512 2e6391d1fe715bce48771b6477433a28b92620b7730ea4064ce91f6374c2818d427f28ffc558491ca0cd6b768faf72dc984490da3d803c37bbeb91689bcca365

/storage/emulated/0/Android/data/com.kailashtech.ziyoke01/zyk-kailashtech#ziyoke01/log/20240518/000.html

MD5 2b447044c957f5e1f718273cd2dc3dbf
SHA1 d2c20db715797aa4305aedc91ededee19c5a3d8c
SHA256 e6d9f805a430712566f081ad376533fb63e3be9802a2bb21e527e014aca03491
SHA512 8b9f15312a7b79e6d16f95537772ff130919d8be1a8ef4d3aa7e2e575562c5c54b5a2edd7180c9ad09b9d317c5ef954e7dcdd60d69c52acae5b76f468f94d743

/storage/emulated/0/Android/data/com.kailashtech.ziyoke01/zyk-kailashtech#ziyoke01/log/20240518/000.html

MD5 bc53437c9f62ec443f46aaef68d1b6a3
SHA1 2de7de79e96dc483075e4ab49b7722d53f252ea7
SHA256 948c8228b6594e559298fe8f63e21c0e38fef206bbc955ed864f69608bb1868c
SHA512 bd07770e3f04c61983a2da791e0c58c038214816d979b09064355605ebe7841fdcef33927d264e1e783aaa2c6f04bd8781407506bb1462edca249d3f26530cb8

/data/data/com.kailashtech.ziyoke01/files/jpush_stat_cache.json

MD5 d18655636aa7ca84e87beeadf9a85f6c
SHA1 51f2dec9b94219c66bc509175c12eceb1449e1ed
SHA256 a8860be79cb1487cf9135d00109df803b44598fc01ce6ff95502ec237f5d86c9
SHA512 281656f7cfde6afa6ff0eed053449658c4c32c215ff4b55386d2c13ad7a97ff81b1ba76869f0d8a58e45228d4d32469a7391e5b6c9412ce2725c6ff10daf6867

/data/data/com.kailashtech.ziyoke01/files/umeng_it.cache

MD5 4e1010a217361f2a3685f251037cc929
SHA1 09fe81ec17e659afaca81958f6efc714f0be9edc
SHA256 6d067476d0e4d6e3cc6cd3da79ca1b1710297a9c47c32d29073dd9c1b0b7672f
SHA512 0f2e2711e02aba993df6c01b63595c2339c081a79c73579afab39df29f04401b334536bbfa8e0d89fc0be4f048b9596387679d3157e577ceaa7b1160ab9d4aa8

/storage/emulated/0/ShareSDK/.dk

MD5 c9383021bd97affc44be4db7018c4d7b
SHA1 7e680409d1c86e35149bebc22f2cf8c484f0d23e
SHA256 b7b7e032170e3190a84359e5c37adede1d58b6bf4c455ef0c01f73335709bb65
SHA512 7303f068da97319891e2d25c1c737035f1cfdc365d75d954102b612000e54d7e2b5dfafe10bdf909563e2b46ec3ff9e546423bff6f0aa9496880eab1c1c36a81

/storage/emulated/0/Android/data/com.kailashtech.ziyoke01/zyk-kailashtech#ziyoke01/log/20240518/000.html

MD5 4c6bcb99b517a7665e510b551c91da88
SHA1 ed41be08a08b84fe00f56eaf431cab94d36786e8
SHA256 6e828e030f7ffdd5bf795465b08db4e27aa2810d03970a644ff3e9bc99060b26
SHA512 d49ef3b8b36d8fcbc5d27fcead97baa740d14a4db4c36bead6c2da7f15ccb63cd9fc94853f7c06c17ed070fe51a9156024b56f6542cadd6a2ee54d7ca3245f52

/data/data/com.kailashtech.ziyoke01/files/zykDownload/Version.txt

MD5 c51ce410c124a10e0db5e4b97fc2af39
SHA1 bd307a3ec329e10a2cff8fb87480823da114f8f4
SHA256 3fdba35f04dc8c462986c992bcf875546257113072a909c162f7e470e581e278
SHA512 413f2ba78c7ed4ccefbe0cc4f51d3eb5cb15f13fec999de4884be925076746663aa5d34476a3df4a8729fd8eea01defa4f3f66e99bf943f4d84382d64bbbfa9e

/data/data/com.kailashtech.ziyoke01/files/.um/um_cache_1716024118274.env

MD5 5930553ed87401914921e2df959040b4
SHA1 38de22b2f7db4afa13b378db84878b750ad1c415
SHA256 3872c1fcdc51cb443f0fbf5f23f15610605c006d9418b827efbb5c170daeb4f8
SHA512 ae2714e5fbdc417a94ff3d9e2a287e10768327aa609fe3a021b5f27f9caad77f12b87cb75b123cd48fe04fa2582fb47482837bdaee2a91109c33cbcc5cdd2915

/data/data/com.kailashtech.ziyoke01/databases/sharesdk.db-journal

MD5 d9e740a10c471bcf5543c0aa9d1b23d9
SHA1 f526c5b37efc62fb0e3acbcc48378ea8bb6cb5ca
SHA256 808ef037ee143d92a9000e75b6f770943287e74fde7e54af0270334c3964ecd6
SHA512 8f8ad9eca5604d44dafe53c866eb4e79395a5cbfed1a28ebaa9fcc8f3d2392a3307dd6da361f7b2188db2a5af36668662fc75078c9b1e88ebb86959d7ae990c6

/data/data/com.kailashtech.ziyoke01/databases/sharesdk.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.kailashtech.ziyoke01/databases/sharesdk.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.kailashtech.ziyoke01/databases/sharesdk.db-wal

MD5 54c9929b04583832304e32c044f1a925
SHA1 47e3610562884945b07ca4052b8319a87e781632
SHA256 89c8b7a462300db03d21988e56ade759980aac99f31f13d828995b0ef54f0dd7
SHA512 e19f92f92d3487570e205cda5bf7356eacf2abc263e36b9a1a403efddea3fedb8dffb99b7f3f329f8724c32349036bc0d247814cc1e84181b82389f220a2eb6e

/storage/emulated/0/ShareSDK/.ba

MD5 be1a2316033d7c80035f80672002c2a6
SHA1 30600508ea816bb40ff375c182e53e0a32a64d19
SHA256 9212f3d69166b9de791a0b5287316cb1d480959f58c9c87848a10c83e1a88b40
SHA512 7b3a288ad76da805ffcb720fa216f415f474a92987caee4f4e642973377c3d01f674431462fabf3d9ac39ea8746ae874a103bfa47cc4c3f3f4ba44874312157d

/storage/emulated/0/ShareSDK/.ba

MD5 b5c6b73e5428f4280d431172dc6ba800
SHA1 fb35e7dbe97badbcd0bab215b76ebc84eea4514a
SHA256 dfb0c235d71c287b2b07fe889c29b571ff6e07af8fa5914e070bf2cbe23bd4fe
SHA512 0e0c1550edabbbfdabbf9e2ebc69a5207a7ac9f7548524e8ba45198c5c7935e3d6bcfde619e0b6e62b28b02aee93ffe28a33c95d97437957624853d304128f0f