Malware Analysis Report

2025-01-19 08:08

Sample ID 240605-z4haesae48
Target 994516361c74fa2fe8fbd288389f8515_JaffaCakes118
SHA256 08f03aab941318373206e93abc4e15b877a5c92a098aebc2109d4d7dd5580eff
Tags
banker discovery evasion impact persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

08f03aab941318373206e93abc4e15b877a5c92a098aebc2109d4d7dd5580eff

Threat Level: Likely malicious

The file 994516361c74fa2fe8fbd288389f8515_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

banker discovery evasion impact persistence

Checks if the Android device is rooted.

Checks Android system properties for emulator presence.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Requests dangerous framework permissions

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Reads information about phone network operator.

Queries information about active data network

Listens for changes in the sensor environment (might be used to detect emulation)

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

Checks memory information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-05 21:16

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-05 21:16

Reported

2024-06-05 21:25

Platform

android-x86-arm-20240603-en

Max time kernel

174s

Max time network

170s

Command Line

com.baiwang.PhotoFeeling

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A
N/A /sbin/su N/A N/A
N/A /system/bin/su N/A N/A
N/A /system/xbin/su N/A N/A

Checks Android system properties for emulator presence.

evasion
Description Indicator Process Target
Accessed system property key: ro.product.name N/A N/A
Accessed system property key: ro.product.model N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Listens for changes in the sensor environment (might be used to detect emulation)

evasion
Description Indicator Process Target
Framework API call android.hardware.SensorManager.registerListener N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.baiwang.PhotoFeeling

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 setting.rayjump.com udp
DE 18.194.210.1:80 setting.rayjump.com tcp
DE 18.194.210.1:80 setting.rayjump.com tcp
US 1.1.1.1:53 s5.picsjoin.com udp
HK 47.242.105.154:80 s5.picsjoin.com tcp
US 1.1.1.1:53 api.tinyhoneybee.com udp
US 74.206.228.78:80 api.tinyhoneybee.com tcp
US 1.1.1.1:53 api.mobula.sdk.duapps.com udp
US 52.13.197.49:80 api.mobula.sdk.duapps.com tcp
US 1.1.1.1:53 smart.tinyhoneybee.com udp
US 1.1.1.1:53 sdk.api.altamob.com udp
US 173.239.5.6:80 smart.tinyhoneybee.com tcp
US 74.206.228.78:80 smart.tinyhoneybee.com tcp
US 74.206.228.78:80 smart.tinyhoneybee.com tcp
US 1.1.1.1:53 api.altamob.com udp
US 1.1.1.1:53 analytics.rayjump.com udp
US 1.1.1.1:53 net.rayjump.com udp
US 34.117.255.242:80 analytics.rayjump.com tcp
US 34.102.167.98:80 net.rayjump.com tcp
US 1.1.1.1:53 feedback.umeng.com udp
US 52.13.197.49:80 api.mobula.sdk.duapps.com tcp
US 1.1.1.1:53 graph.facebook.com udp
US 34.117.255.242:80 analytics.rayjump.com tcp
GB 157.240.214.1:443 graph.facebook.com tcp
US 34.102.167.98:80 net.rayjump.com tcp
US 34.102.167.98:80 net.rayjump.com tcp
US 34.102.167.98:80 net.rayjump.com tcp
US 1.1.1.1:53 api2.batmobi.net udp
HK 209.177.84.159:80 api2.batmobi.net tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 ggimg.ssl3.doglobal.net udp
GB 174.35.118.62:443 ggimg.ssl3.doglobal.net tcp
GB 174.35.118.62:443 ggimg.ssl3.doglobal.net tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
US 1.1.1.1:53 usdk.batmobi.net udp
US 1.1.1.1:53 sts.batmobi.net udp
HK 209.177.84.186:80 sts.batmobi.net tcp
CN 223.109.148.130:80 alog.umeng.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umengcloud.com udp
CN 223.109.148.177:80 alog.umengcloud.com tcp
GB 216.58.201.110:443 tcp
GB 142.250.187.194:443 tcp
CN 223.109.148.130:80 alog.umengcloud.com tcp
CN 223.109.148.178:80 alog.umengcloud.com tcp
CN 223.109.148.141:80 alog.umengcloud.com tcp
CN 223.109.148.179:80 alog.umengcloud.com tcp
CN 223.109.148.176:80 alog.umengcloud.com tcp

Files

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_ts.db-journal

MD5 7e97dc67cee51a180762444e8ebb236d
SHA1 b2b45778650c52a2e1f5f98e141bb3205e62cc17
SHA256 18ee840ea5975bb44dac5ddfe536d20212aecd652bb69f2dd3caadfe2eacd4ba
SHA512 71b507df30c577f2c3cc6a7a065bd9f4edc7afde89a693530bb02529b9607d7ba6c9121d0daa7ce4f442986e69ec256a9c57ceb5f28c38d516d990ad53166508

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_ts.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_ts.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_ts.db-wal

MD5 7e01bc6985c43264fc8e2a63c6fed348
SHA1 25ee5ebe12e3a6d784b3dd300af15e9d3d1d16f4
SHA256 dac310165ec2afa9eb651fdb49f76bc1ed60c80f5a02965deaf1aabc1d95b60f
SHA512 88caf3a01452e47cb3e0d302ea3cffe5c58280501cfb9777a7edf8bb9111706b48a3649e84feeb8374bf7f4cef96a1fef4ceeae79b9c8f30a9f0550c5d76f289

/data/data/com.baiwang.PhotoFeeling/databases/mobvista.msdk.db-journal

MD5 51c8ff5cf85e6d1dda8e0de9b37a8782
SHA1 18282356590ec2fda703f072c56fbbfe518e52ba
SHA256 ab26d8e1902e652864f8a8530d3fd9cc2ca20ceef37cf85b798a31c2c53314c4
SHA512 0fd740b34594d4b50721769bb930f383d27bfee4017f8c53b36b7b43cea652a11cc19efb91757edff191adf881ad0afd27c03892375f83287a54213d9c4ca016

/data/data/com.baiwang.PhotoFeeling/databases/mobvista.msdk.db-wal

MD5 7540cfac222f4b93962739b79dfce2d6
SHA1 108675c6376c404bb8670ce91dfcdee593c27c0f
SHA256 60affbb33b1a2d57a720d335db6b742e76b37c558ce4c22f9b7448646a728f05
SHA512 cc1a433d05399d42fe838275ebba5c09636ecbfcc355080bc3058b30d6cd0b9826fa538df398651400edccd0f5d371c77146c1ca5de7cb8f44ba00875bb46f79

/data/data/com.baiwang.PhotoFeeling/databases/altamob_ads-journal

MD5 754d84ffcb4dce24be82f62983542f5f
SHA1 12e5682af2bf91fe504425d250939e0d8bbefe49
SHA256 214f59bbbabda361860f9770270c82ba398ff3be7ec46779d1d7f6ed7864b7f3
SHA512 e49df15924b9f518586593711ebaba94aec120f2c378e16040c20dc885fa6126c8d08d95efb052b2e1bb570fac1c15741a117de483867198c836384c00ab2ffe

/data/data/com.baiwang.PhotoFeeling/databases/altamob_ads-wal

MD5 3ddd110a3480f236b1f6e48fa7899026
SHA1 6d04604c7a2755d4dbbd18b3172eb323cd65a365
SHA256 9630c2fd2ba1828a464f49c35eb2da2529f53eb06a73732949c282d7168985db
SHA512 aade5091ab8363f4cf2c4e638362c9ec032b8194c7b527f05ea914e5b42929ac5b326a34c47c2d9f575bfc864721aa53d657618494424f5405c61c100845dca0

/data/data/com.baiwang.PhotoFeeling/files/altamob_device

MD5 baf377eed8d7de379d2b145906cde00e
SHA1 64afad541e07c4b75dfaa55b4f5726d33bd3ccb7
SHA256 c85d222f06123c3a634d659f51740192de664acff2901e2852d9f557ba4232d3
SHA512 40633eaf5a6639192d3fbb8fbc6710f7842eb59ca6e57d887273ea388b346142a5bb5e05e35a52374480986d20aa716d861e4b449004495392b57737d0749800

/data/data/com.baiwang.PhotoFeeling/files/altamob_log_new_cache

MD5 c800e934e68782dad9f8c9236647c782
SHA1 050910c9531526a4764eecaabccee32dc50d7123
SHA256 86ee831bd82679beb78b29bc0c46c31603eeb683bb56691a3342c8cced14f1aa
SHA512 99060c98e3e1fc69c48c3b23c207318094ae97d22795f196a232c670f87973acbd3fd985174ab06d14ca078a0af440ef6bfa9d17f20ea96f85fbc405a8bc4dd0

/data/data/com.baiwang.PhotoFeeling/databases/cc/cc.db-journal

MD5 8e2c91ca29c2687c20fcd8d824fc9713
SHA1 89a42aa8ecf04cab63d0b6fff34b011f51c005f9
SHA256 fe4ce3f34139d5e7d5947060e4fee27f875288b9a5983ff578777e3f7ba63a7e
SHA512 444ab9edbb53521f73309bbbd3528fa11e69262259fbea73661c7b42e1deae84c66743be4ccc0fa3fe47d70770e830f7c190f62cd24b61540fe98a9f72af9aae

/data/data/com.baiwang.PhotoFeeling/databases/cc/cc.db

MD5 5d7ea1a23af19b4340cc8d90f28297d5
SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

/data/data/com.baiwang.PhotoFeeling/databases/cc/cc.db-wal

MD5 29d4674639c5bfbb410d93c03af24600
SHA1 afcaa399eba7163e371160120db8d983486cce4f
SHA256 959cc4ef56738c160350d60de873758d833e89fb9ba35afbb21139c182d05c0f
SHA512 302edcffdb99b52f3499e60ed231194df019f461acf97c883451aa01e373979767a24a44cf691d1c9aca2f8d11055c2fa29bd7ff40ce7e6ae173297862e7c2e1

/storage/emulated/0/Android/data/com.baiwang.PhotoFeeling/cache/uil-images/journal.tmp

MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_cache.db-journal

MD5 333292b5f5f505d2ec3d556580dead72
SHA1 c5c06e72f97a6499a3727b52aacf0097889342c5
SHA256 bfe091df70813e9ff500565303908666439da70f3f44dcdd67611ff2dc2ca8c8
SHA512 af1f0eb295ff83045259b21557a9087952e965c24e022412a60b1627b24f0f5bb876542f24393f893ad9e1d134b0c6ad59f1a84d6d51fc32b96ddd42abc21b9a

/data/data/com.baiwang.PhotoFeeling/databases/du_ad_cache.db-wal

MD5 587c8452d9ecc95f7d026b2641d3c6f4
SHA1 578eda4ee966dc240e9aef2f4a4e53df5488035e
SHA256 187dd0c9209be9ee21614ce25f11a7af75c590075f0f2f8ee79c4da955a71105
SHA512 a939dcade1bee4b957269456a732490fbc09345013e6bef138cca1720fb424563d1a57edde6ca4eee83134c4d651b95877eba6a6b9eea4310005d0fe30c77f9e

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 c45e583bc5a415bb2a19515fca5b3cdd
SHA1 9eece002bd3f94841b39013c42f36b3f0aac62d5
SHA256 2a29b2e492da8ebd8af2047f2fe1e2a02eb9effba64be1a178a3b4dd72fbb66b
SHA512 bf6a86352d748b1a53dadf0a554bf5b099b61e2bfbf9116950687922741f0eec04241728c9696152c48348454d5623d10cba92c80799c2f9c137a481819fe84f

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 d824cb3c10b8c9a75d4308efbda53587
SHA1 3609efc82283473ac714c2c6db3e2f85b98cd27a
SHA256 eb067bafd36c08037514f71a2f71de1853d13b3b5015fcc810e7a0d21d2ab0d1
SHA512 17b4ee1a75c7cdbdb7075533330332d5edbdece301cd680197847d4658be9aa96f4cf959d036e6496daf21f788624490d5fc6902253ded7726dd3feb3faca574

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 4b16e65a39232dbfd488eb005eb5210f
SHA1 9f4063afba9f2362e3b6aab52aa369a7c89c45ff
SHA256 d92c8b57ccb6854a69e2a7fcbd4ada1c1c57308eaceedc189e27060e253f5221
SHA512 023e449c46e33edec66188c05e3a3db0c2af75b9d8dc88f2ec91243b8366918fadea4170a74b1c4d6f16355f3e34585b04430b574268b06ae6d778c6ca6a1d0e

/data/data/com.baiwang.PhotoFeeling/files/umeng_it.cache

MD5 2085f9c3193994aaad10e4373e696eeb
SHA1 41861cb272fddf01952c1850f0e96d40ac3ab3b9
SHA256 4fff8abcc4e7c874276db20a0665ba0a2d01ec03c03ac128174cc00ae80899ad
SHA512 3e7750b3744246dba8fddb259db7ffdd4ed8cda5821dc5fd98c976af7d1034d1d0e5b4e28e2750db07d3466cf5477cee2d2211b98815439bf05b292b3acedcd1

/data/data/com.baiwang.PhotoFeeling/files/.umeng/exchangeIdentity.json

MD5 ce84d7d274e483394afe324974664311
SHA1 6ec7e9a1d956f62701aca60a2bde2fcc93c09248
SHA256 acbc3259ac08b96add041f356db40527373c2ccd8dfaa64a2347eca7865f497d
SHA512 5b607185cb9ec884139d409a9050e9e5e44277a9e10edff54ddf16e1b3bbcf325df32e134978f86b47f4e71b8dcebed7766084dd42360085f2969a0587518bf3

/data/data/com.baiwang.PhotoFeeling/files/exid.dat

MD5 558a0d38fb752d35a21374d66cd32acf
SHA1 533e3bf0733e9e18c213383e34954468b4faa70e
SHA256 2a388ef817ae711dd033bfc475fd7ac0dea470a71fdb9fa129e7311261072f3e
SHA512 8f2c84166eb3fd7825193e7acb78b6d7c21be20257fdaf7e9e39926f6a5fcb4809f736dfcd57f20000551adcd8a2cd27fbe49abb10c3dd4035d444f9d35170af

/data/data/com.baiwang.PhotoFeeling/databases/cc/cc.db-wal

MD5 8836667eab4fa2bb819b99e064668ee1
SHA1 33f73a07e8eca37dd49640cb4b323f33d24f402c
SHA256 93fd6083d338ddbe818d027fcac73d39dd2427f258091386b27e5dca2504bdcc
SHA512 a5c1421d4f7117ae33cbb2583244dffdba58eabc402525fa9478bf61ed10a809a81ea6ecae0893f25850bf5e4b74859285f0a6088126c4204e818317fe7190d9

/data/data/com.baiwang.PhotoFeeling/databases/cc/cc.db

MD5 ce6135aa1b1fe4f2c2db2a546d2a5558
SHA1 79b59582154017aadab783dc266fcb158c252940
SHA256 7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
SHA512 2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

/data/data/com.baiwang.PhotoFeeling/databases/bat_statistics.db-journal

MD5 c33a93ed92c85bf084d4cd228f09ac19
SHA1 f0ec3be9a6473efadf12758e2b290c74bb91dd1b
SHA256 966a69a2b64c3b61c7340d40190c9754d46df37d34ace7523d8fac6c704f8c57
SHA512 d7ce3cfa771f01639f4d9eed94a6dae07a9586e5b35d91d21bec3320ca8f3a333d92a8aa72f2135e9baf2b559535accfc8128a581970d516850e9f7367241744

/data/data/com.baiwang.PhotoFeeling/databases/bat_statistics.db-wal

MD5 8f062e963e30c9a1ce5850114cc55358
SHA1 5c8ec6c774a75e524b43e02d218eecc9f1c08322
SHA256 bc201ff68e5c96ca6d0c90b7107570a7b5d17a21e340a7ae02c3cfba44ccd322
SHA512 4960c54c41fe43270275f86a759318dcc96a294a88658add45bd7ebd120af861baa41f87462ec24a1d7ea818458e9abaadd3ed0866b96b3a83038204af6cde7b

/data/data/com.baiwang.PhotoFeeling/files/.um/um_cache_1717622692696.env

MD5 34b332241a8e07a4cfe5b3e8f4d87f49
SHA1 ddc972d0d84c858d3ece993852b838c0518f1f76
SHA256 9864acc5deeb0e7dd236bfd60af81248760ae875ff7afec5859c703bb3036c79
SHA512 c8599cf6a641275408b8029a858a9a148838b1ae3145926466fcad343bc51bad89bf0f74641db00bb3b178df21170554c2b535350daa283bb0ed0597b2ee3f4c