Analysis Overview
SHA256
eed27b67213d85848905bf61a5a117253bc623686e78923aa4f87c5e5431724d
Threat Level: Likely malicious
The file 93180381acdc9d04a9dc73535ea6fbcc_JaffaCakes118 was found to be: Likely malicious.
Malicious Activity Summary
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Removes its main activity from the application launcher
Queries information about running processes on the device
Reads the content of SMS inbox messages.
Tries to add a device administrator.
Loads dropped Dex/Jar
Reads the contacts stored on the device.
Declares broadcast receivers with permission to handle system events
Acquires the wake lock
Requests dangerous framework permissions
Queries the unique device ID (IMEI, MEID, IMSI)
Reads information about phone network operator.
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-04 00:14
Signatures
Declares broadcast receivers with permission to handle system events
| Description | Indicator | Process | Target |
| Required by device admin receivers to bind with the system. Allows apps to manage device administration features. | android.permission.BIND_DEVICE_ADMIN | N/A | N/A |
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-04 00:14
Reported
2024-06-04 00:17
Platform
android-x64-arm64-20240603-en
Max time network
183s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.179.238:443 | tcp | |
| GB | 142.250.179.238:443 | tcp | |
| GB | 172.217.169.42:443 | tcp | |
| GB | 216.58.212.234:443 | tcp | |
| BE | 66.102.1.188:5228 | tcp | |
| GB | 216.58.212.234:443 | tcp | |
| GB | 216.58.212.206:443 | tcp | |
| GB | 142.250.179.226:443 | tcp | |
| GB | 142.250.178.10:443 | tcp | |
| GB | 216.58.212.206:443 | tcp | |
| GB | 216.58.212.234:443 | tcp | |
| GB | 142.250.179.228:443 | tcp | |
| US | 1.1.1.1:53 | www.google.com | udp |
| GB | 216.58.212.196:443 | www.google.com | tcp |
| US | 1.1.1.1:53 | www.youtube.com | udp |
| GB | 172.217.16.238:443 | www.youtube.com | udp |
| GB | 172.217.16.238:443 | www.youtube.com | tcp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.179.238:443 | android.apis.google.com | tcp |
| GB | 172.217.16.238:443 | www.youtube.com | udp |
| GB | 172.217.16.238:443 | www.youtube.com | tcp |
| US | 1.1.1.1:53 | www.google.com | udp |
| GB | 216.58.212.196:443 | www.google.com | udp |
| GB | 216.58.212.196:443 | www.google.com | tcp |
| GB | 216.58.212.196:443 | www.google.com | tcp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-04 00:14
Reported
2024-06-04 00:17
Platform
android-x86-arm-20240603-en
Max time kernel
179s
Max time network
170s
Command Line
Signatures
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Removes its main activity from the application launcher
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/user/0/com.hsdxlpwka.zshvfp/app_dwuaubfhob/tzxvzxenl.jar | N/A | N/A |
| N/A | /data/user/0/com.hsdxlpwka.zshvfp/app_dwuaubfhob/tzxvzxenl.jar | N/A | N/A |
Queries information about running processes on the device
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.getRunningAppProcesses | N/A | N/A |
Reads the contacts stored on the device.
| Description | Indicator | Process | Target |
| URI accessed for read | content://com.android.contacts/contacts | N/A | N/A |
Reads the content of SMS inbox messages.
| Description | Indicator | Process | Target |
| URI accessed for read | content://sms/inbox | N/A | N/A |
Tries to add a device administrator.
| Description | Indicator | Process | Target |
| Intent action | android.app.action.ADD_DEVICE_ADMIN | N/A | N/A |
Acquires the wake lock
| Description | Indicator | Process | Target |
| Framework service call | android.os.IPowerManager.acquireWakeLock | N/A | N/A |
Processes
com.hsdxlpwka.zshvfp
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hsdxlpwka.zshvfp/app_dwuaubfhob/tzxvzxenl.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.hsdxlpwka.zshvfp/app_dwuaubfhob/oat/x86/tzxvzxenl.odex --compiler-filter=quicken --class-loader-context=&
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| DE | 85.93.5.109:80 | tcp | |
| GB | 142.250.187.206:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.238:443 | android.apis.google.com | tcp |
| DE | 85.93.5.109:80 | tcp |
Files
/data/data/com.hsdxlpwka.zshvfp/app_dwuaubfhob/tzxvzxenl.jar
| MD5 | 6d1ec70684bd943b2891bb83d6c17aa6 |
| SHA1 | a13d8f9e7f0327f693f3026e45608aa014661c9a |
| SHA256 | 0559ae0fc3dafcf2d4f4744325b782682da597c7d3628bed112f0c7344e83cfc |
| SHA512 | 0c853bfd54fe4f94ffaa2dce41ac92b4b28944eec50118ec56f397eff2ab0da436000ed83daca73853b1629a09babbbd21b7aaf470ae8567156a9583ae2d8028 |
/data/user/0/com.hsdxlpwka.zshvfp/app_dwuaubfhob/tzxvzxenl.jar
| MD5 | aec2737ee9622bb4d6cfc0707dff4d14 |
| SHA1 | f92828999ca098e1e58d50da8d1309dae53e8f15 |
| SHA256 | f62e571f4f061eda53c50f7475a8da0e6b037a2e2c14796666e0cfeec1156c28 |
| SHA512 | b78d80167cce29c3919c94faff158aeee036a67401a54b64c8a1486779a5e6747c662ce6d535cbc900f710281fcdd67fcfe751b6afdd4856e5605e61d0de24a5 |
/data/user/0/com.hsdxlpwka.zshvfp/app_dwuaubfhob/tzxvzxenl.jar
| MD5 | 4c4db1f95bfe6c0467355b0f2a46329d |
| SHA1 | 9ed25d73e248802226a54066053156eeb65c64fd |
| SHA256 | 0ed45557600beca798f14fe340fe9569c1c89d451b264ec211c3667ea47f4222 |
| SHA512 | dccb6167829c3aa9231ff2b29e77163b2e183dfc45b11a29a711d02459e4665c4e7fa1c76d462685a104516b973d4268723868f3fb897b4813ae30dbc8d9ac17 |
/data/data/com.hsdxlpwka.zshvfp/app_dwuaubfhob/oat/tzxvzxenl.jar.cur.prof
| MD5 | a3c35f9b1a975d205b74a2572185dfe9 |
| SHA1 | 06899642016271a4d6b7d30389c42be4a4e396d4 |
| SHA256 | 55cf044740c9fb5e4f5537a2e35ae45e6d21fef754fe5113648aeac5a6c16aaa |
| SHA512 | 6c7702585ccf962c5d846c1a58ebb8c6e8f6c7c24c92496dc64cec0f58263c38c47440a519b7e214239b8b1ac91700bf747a5de3492d34eba85e21ef67ba9fb0 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-04 00:14
Reported
2024-06-04 00:17
Platform
android-x64-20240603-en
Max time kernel
179s
Max time network
179s
Command Line
Signatures
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Removes its main activity from the application launcher
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/user/0/com.hsdxlpwka.zshvfp/app_dwuaubfhob/tzxvzxenl.jar | N/A | N/A |
Queries information about running processes on the device
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.getRunningAppProcesses | N/A | N/A |
Reads the contacts stored on the device.
| Description | Indicator | Process | Target |
| URI accessed for read | content://com.android.contacts/contacts | N/A | N/A |
Reads the content of SMS inbox messages.
| Description | Indicator | Process | Target |
| URI accessed for read | content://sms/inbox | N/A | N/A |
Acquires the wake lock
| Description | Indicator | Process | Target |
| Framework service call | android.os.IPowerManager.acquireWakeLock | N/A | N/A |
Queries the unique device ID (IMEI, MEID, IMSI)
Reads information about phone network operator.
Processes
com.hsdxlpwka.zshvfp
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 172.217.16.238:443 | android.apis.google.com | tcp |
| GB | 142.250.200.46:443 | tcp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| DE | 85.93.5.109:80 | tcp | |
| GB | 142.250.178.8:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.200.46:443 | tcp | |
| GB | 172.217.169.66:443 | tcp | |
| GB | 142.250.187.228:443 | tcp | |
| GB | 142.250.187.228:443 | tcp | |
| DE | 85.93.5.109:80 | tcp |
Files
/data/data/com.hsdxlpwka.zshvfp/app_dwuaubfhob/tzxvzxenl.jar
| MD5 | 6d1ec70684bd943b2891bb83d6c17aa6 |
| SHA1 | a13d8f9e7f0327f693f3026e45608aa014661c9a |
| SHA256 | 0559ae0fc3dafcf2d4f4744325b782682da597c7d3628bed112f0c7344e83cfc |
| SHA512 | 0c853bfd54fe4f94ffaa2dce41ac92b4b28944eec50118ec56f397eff2ab0da436000ed83daca73853b1629a09babbbd21b7aaf470ae8567156a9583ae2d8028 |
/data/user/0/com.hsdxlpwka.zshvfp/app_dwuaubfhob/tzxvzxenl.jar
| MD5 | aec2737ee9622bb4d6cfc0707dff4d14 |
| SHA1 | f92828999ca098e1e58d50da8d1309dae53e8f15 |
| SHA256 | f62e571f4f061eda53c50f7475a8da0e6b037a2e2c14796666e0cfeec1156c28 |
| SHA512 | b78d80167cce29c3919c94faff158aeee036a67401a54b64c8a1486779a5e6747c662ce6d535cbc900f710281fcdd67fcfe751b6afdd4856e5605e61d0de24a5 |
/data/data/com.hsdxlpwka.zshvfp/app_dwuaubfhob/oat/tzxvzxenl.jar.cur.prof
| MD5 | e0bd93eb4255468d9a8ac671714760ff |
| SHA1 | 2e940334e1eb895271d60cb8627557dde55e1460 |
| SHA256 | 42c4de54b150b7da928c92b4f499dda066e9c1c69c67ebf5d366f6e09ed20db7 |
| SHA512 | 16aef5c4b1baa3da38b99abba9895a17a3c4f85d4b5b49713f1ee9a01cd5906fdb152a6641acf853e3ff54f51b1104e707533f3961ff72c351ea2514498eb743 |