Malware Analysis Report

2024-09-09 13:38

Sample ID 240603-2lvh5sbg2y
Target 92da3a04887ccbfda362ac8d18bd0304_JaffaCakes118
SHA256 70c243d9612119b841004a7a5b66f17a8c57953bd9df712ef62127a0c620c52b
Tags
banker collection discovery evasion impact persistence stealth trojan credential_access
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

70c243d9612119b841004a7a5b66f17a8c57953bd9df712ef62127a0c620c52b

Threat Level: Likely malicious

The file 92da3a04887ccbfda362ac8d18bd0304_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

banker collection discovery evasion impact persistence stealth trojan credential_access

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Queries account information for other applications stored on the device

Obtains sensitive information copied to the device clipboard

Checks memory information

Loads dropped Dex/Jar

Queries the mobile country code (MCC)

Registers a broadcast receiver at runtime (usually for listening for system events)

Queries the unique device ID (IMEI, MEID, IMSI)

Checks if the internet connection is available

Reads information about phone network operator.

Requests dangerous framework permissions

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-03 22:40

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 22:40

Reported

2024-06-03 22:43

Platform

android-x86-arm-20240603-en

Max time kernel

15s

Max time network

131s

Command Line

com.master.fuhvpdz.buumaqlb

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar N/A N/A

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccountsAsUser N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.master.fuhvpdz.buumaqlb

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 api.adsnative123.com udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp

Files

/data/data/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar

MD5 454ef9f79671f57962f69108986d5ec3
SHA1 96086de711b1def503e49b9b90b9263ec8dabfab
SHA256 c3dab1b8b86257971e033958a667f6b256ab575494df1ed6a9921520a787789c
SHA512 097d3ebd8183227487b611a7468570fcd5146ff17f0ab0e2172c7a5d9b0ead03fba2414c729ebcddc9bdc6acc063a537c3f2208898da2fcd01f3d82b6876122f

/data/user/0/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar

MD5 11f663c8da263a6965f54de6d7bc993d
SHA1 49fb24cf75401e2dec37f42c4747ef9a854d7693
SHA256 f4749b55dc2bcc87d08beab051c154bfce0636669f2c8e129d5d9b06626a3948
SHA512 6ee13e0b42d5fb859d9e099637b42a194fe3d41f9b0c3a4f07a543a5cbabac7bbb058f2da151e8b12b8cbe4333d285c7f241b17919ddbbcd816a4b588248e513

/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-journal

MD5 ea79900d9d23ad01c2f74d8dc6f1fc4b
SHA1 2ffa36207b6da2d78653abf3d2dd87cb7acea7eb
SHA256 2cb93b566d50a904ad60b4c0ddb48f58e5e14feae3cff27a0c63f5571156b8aa
SHA512 874e8baa4bba8b9aa9289618956564c3fcde88d5801fa91e3006eee4ea64ab1aab22262fad8aa77e24738d7126a935df426f221338a82d62409f20f3f7e4eb01

/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-wal

MD5 b6c1e86171f050f5e4dc52b7527c1c56
SHA1 87e2f19d7096d3a5e5b8db373f134442d824bd42
SHA256 fcbac34aa055e106c5a152f00ec6b07107f75f5a95507fc68b03496d3bbfc932
SHA512 edd8e9ceda90481ce89ce6b04d204296a08ba3676f5935c28070994cf2c96097700172c15ca6f82cb00a5b20de6fbd95e829a71f9cb52ed7f93ae78c40274fe3

/storage/emulated/0/Download/sdsid

MD5 b8c37e33defde51cf91e1e03e51657da
SHA1 dd01903921ea24941c26a48f2cec24e0bb0e8cc7
SHA256 fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71
SHA512 e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 22:40

Reported

2024-06-03 22:43

Platform

android-x64-20240603-en

Max time kernel

15s

Max time network

186s

Command Line

com.master.fuhvpdz.buumaqlb

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccountsAsUser N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Processes

com.master.fuhvpdz.buumaqlb

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.8:443 ssl.google-analytics.com tcp
GB 172.217.169.14:443 tcp
GB 142.250.200.34:443 tcp
GB 142.250.178.4:443 tcp
US 1.1.1.1:53 www.google.com udp
GB 172.217.169.36:443 www.google.com tcp

Files

/data/data/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar

MD5 454ef9f79671f57962f69108986d5ec3
SHA1 96086de711b1def503e49b9b90b9263ec8dabfab
SHA256 c3dab1b8b86257971e033958a667f6b256ab575494df1ed6a9921520a787789c
SHA512 097d3ebd8183227487b611a7468570fcd5146ff17f0ab0e2172c7a5d9b0ead03fba2414c729ebcddc9bdc6acc063a537c3f2208898da2fcd01f3d82b6876122f

/data/user/0/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar

MD5 11f663c8da263a6965f54de6d7bc993d
SHA1 49fb24cf75401e2dec37f42c4747ef9a854d7693
SHA256 f4749b55dc2bcc87d08beab051c154bfce0636669f2c8e129d5d9b06626a3948
SHA512 6ee13e0b42d5fb859d9e099637b42a194fe3d41f9b0c3a4f07a543a5cbabac7bbb058f2da151e8b12b8cbe4333d285c7f241b17919ddbbcd816a4b588248e513

/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-journal

MD5 4e9b75e2c57ad4b474edd8ec97539b50
SHA1 14240bc2aa54c84aae437b491f3afafe38d7cf37
SHA256 8adf9d3745db17ae9559a91046d5b71828462aab8dc728317626b89aee1faa88
SHA512 7b405f5735672658476dce5b1955b86fa34a5a5ddcf4691d2c2c2b74c06eb094f5092f3b959b963d45b7efdab0f71fea332922bf43d5705c26460e7a3f4137c3

/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb

MD5 ae8aa93151da27ce1348c21d6ea98a45
SHA1 d187ce29f387717ea0c7d2919a77945a6f04a954
SHA256 b5023c1c2354845e52c945166be1111d7565a000e57ea18d8ce2943c73580e81
SHA512 7bc212292c6dd5192e2d714d1e06c3109f133bf0f5bddb4dd4113a4b9ab3a8db3ba7e1cab4a7da44724361b8d7d53cdde3d50506cf7264fb00d7b4521014c85a

/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-journal

MD5 190bc5b825f61bc39d4a32c2d8bb4595
SHA1 1b67a769ca954fda41622532468e3900d5b31c2c
SHA256 034d1152151cc245b2590f88b77db36db673c51451f281ab2d2fd24028de5589
SHA512 15c64d98cc274ec2c90112496485889cf0c60558202a8ad7afbf6327c2acf034d62590dbbbda65675f5293642537d0b02ca9e18e875c3cd0ab6d3a14a54ce680

/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-journal

MD5 57112bddfa2c9d7b85dce8a89a7f5d89
SHA1 c33fe51c8d989fae6557a8d5e69066a3288ce194
SHA256 69be5a3f8c7255cc00ac74ebb4fa9657721b4226c4ff02c9492d5d5156986a9b
SHA512 218317c79da6af3b23923bed8f93ba66e4ccc901c9c35263c9c4b5ed4f00ca8b873a23771688158428cc635ad37d475ac285bb847565a4d7ac941385400b663a

/storage/emulated/0/Download/sdsid

MD5 b8c37e33defde51cf91e1e03e51657da
SHA1 dd01903921ea24941c26a48f2cec24e0bb0e8cc7
SHA256 fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71
SHA512 e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-03 22:40

Reported

2024-06-03 22:43

Platform

android-x64-arm64-20240603-en

Max time kernel

179s

Max time network

141s

Command Line

com.master.fuhvpdz.buumaqlb

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries account information for other applications stored on the device

collection
Description Indicator Process Target
Framework service call android.accounts.IAccountManager.getAccountsAsUser N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Reads information about phone network operator.

discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.master.fuhvpdz.buumaqlb

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 172.217.16.238:443 tcp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 api.adsnative123.com udp
US 1.1.1.1:53 api.adsnative123.com udp
GB 172.217.169.68:443 tcp
GB 172.217.169.68:443 tcp
GB 216.58.212.202:443 tcp

Files

/data/user/0/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar

MD5 454ef9f79671f57962f69108986d5ec3
SHA1 96086de711b1def503e49b9b90b9263ec8dabfab
SHA256 c3dab1b8b86257971e033958a667f6b256ab575494df1ed6a9921520a787789c
SHA512 097d3ebd8183227487b611a7468570fcd5146ff17f0ab0e2172c7a5d9b0ead03fba2414c729ebcddc9bdc6acc063a537c3f2208898da2fcd01f3d82b6876122f

/data/user/0/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar

MD5 11f663c8da263a6965f54de6d7bc993d
SHA1 49fb24cf75401e2dec37f42c4747ef9a854d7693
SHA256 f4749b55dc2bcc87d08beab051c154bfce0636669f2c8e129d5d9b06626a3948
SHA512 6ee13e0b42d5fb859d9e099637b42a194fe3d41f9b0c3a4f07a543a5cbabac7bbb058f2da151e8b12b8cbe4333d285c7f241b17919ddbbcd816a4b588248e513

/data/user/0/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-journal

MD5 e0b9a47b30cc577875eeab48a5c037cd
SHA1 691b3a25dde7f3ff19db229a455436c83464cc52
SHA256 a9cd040c95cad8d4dc3aa210c3dfc602984b934dd125f357a2369f7b0549a47d
SHA512 21ac94e77868334adc6de05817ce10bc8033df55b5c2f2f7718257d8fbdc8b987df596928fea7f4861de26a5a08b4030f3fa6a45cbe4f6a5c2a8780f3f99c524

/data/user/0/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb

MD5 ebfd4869bb86abd638bc48b891f3e1c8
SHA1 a27f262fe7a41ec9976d457416447f8b78c80e03
SHA256 5f49bca53de766023101cc1ac8dda79a83c485fce8d9138452b39d1853d2fe0f
SHA512 062fd15e0a34619071834f2d81889e6a100c3a707e53621b16d584182a57c690f6a24a73e19fb77678d857fde477935811a963998a73d7ffe971d6ebd9cafb07

/data/user/0/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-journal

MD5 5ddfe50cd88f2d6c561589cc5943e4be
SHA1 9c39332db6779403583f145aab489721be7165dd
SHA256 715568459e9be25c3cdc042a53db9639ae24c43926c35651f726631c8d42327d
SHA512 14e6e22925c4193cbd606ac646def21e0c32c8c3060cad6257300e05913267172c052ab0f61c66ace94ad2a5857ed1b8ba88aa7285c5dc7b8f93abb3ed9a8396

/data/user/0/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-journal

MD5 8be0cb1260a73265ddd1ff0f99dec261
SHA1 36b2cb6fa0ef165c7a20a3dd7b330edfef52d9e6
SHA256 49252040233ff9033cf5b605a5400797d5ed499156f264b080cdd6be0e1fbf7d
SHA512 9325db290582b068b4aa90f8075628b846690a528bfd2254d9d72ecc1194e5e74f461788d3fe7e63fa4c4ea63985a5ddf763874faeb37850bd55d062307785f9

/storage/emulated/0/Download/sdsid

MD5 b8c37e33defde51cf91e1e03e51657da
SHA1 dd01903921ea24941c26a48f2cec24e0bb0e8cc7
SHA256 fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71
SHA512 e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7