Malware Analysis Report

2024-09-09 16:31

Sample ID 240611-f55mkawdjg
Target 9d1f570c3d8ce184fc5179aa22cac668_JaffaCakes118
SHA256 8bda2cf8936d402b8714d3008dfc88e1000e9656e82f2c08bdd81ace118bfffd
Tags
discovery impact persistence collection credential_access evasion
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

8bda2cf8936d402b8714d3008dfc88e1000e9656e82f2c08bdd81ace118bfffd

Threat Level: Likely malicious

The file 9d1f570c3d8ce184fc5179aa22cac668_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery impact persistence collection credential_access evasion

Checks if the Android device is rooted.

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

Queries information about running processes on the device

Queries the mobile country code (MCC)

Requests dangerous framework permissions

Acquires the wake lock

Queries information about active data network

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 05:28

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 05:28

Reported

2024-06-11 05:31

Platform

android-x86-arm-20240603-en

Max time kernel

177s

Max time network

157s

Command Line

com.digitalborder.webappessentials

Signatures

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.digitalborder.webappessentials

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.179.234:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 googleads.g.doubleclick.net udp
GB 216.58.213.2:443 googleads.g.doubleclick.net tcp
GB 216.58.213.2:443 googleads.g.doubleclick.net tcp
GB 216.58.213.2:443 googleads.g.doubleclick.net tcp
GB 216.58.213.2:443 googleads.g.doubleclick.net tcp

Files

/data/data/com.digitalborder.webappessentials/no_backup/com.google.InstanceId.properties

MD5 a92a438c8db287df11a6e17e8e593e7e
SHA1 9403504898285f37371d92c8f8daf352fb7ad4df
SHA256 1a5ba72dfd590f864e5f8cabc20e023eed5677013e4a30bbab9bf210591626fc
SHA512 6ae33891f43f6ba8e7bae231c6bb10acc9937a0796cf00fb578110dab2de9d29ba7292ee584586c61b7698e4d1f75a55ec15fd4665594db809555fb83ce2d6fe

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 28ba6e9e17f32669cc054989b46b6c0d
SHA1 73a46de6ddb43050a323d0fc09f47a8fc0ac89fd
SHA256 f6a41c5b520c988987ad4eaa08659db5f116f30d2175351ed080e5d2f3be2609
SHA512 2f50db629c566ad16f84f5c7c2c8f2bc268444080d1a5de5f681ea7a38faf91a48ec029d9a6d957feb066fad788e09f0aa474b42c7a03896da69fac0813b6acc

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 619ab49438791acca3b4b7cd40966423
SHA1 0c943fdb2944f07cabc471b70cd1882be09fca29
SHA256 07a7cc43d4dbcec9fe8dc15b6e7fdb827cc128bd397f187df228325252bd6da8
SHA512 6ef8505a105f99c1ced52f21dedfdea6a4dff6584b53a753ae6b1d31bf78d1391f1017f43a791d04a192c21988352e17ec21c8fefc57b2a7fb135240266820f0

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-wal

MD5 5917e58b95f2c2ab9f9a6e54606ef975
SHA1 17b0d1126f4bcdff5fe7d587ceece3f2cdf50725
SHA256 5db62d6eed9b134924e372dc727297b4a0bd0ccb6687cfa17f36f8d0a9ed3c6d
SHA512 788d1b5851ac56fcdc250badbcb769169d86050fc9eaca340fe02e0f49fa046be54e12bf21f7c8aec8b41406f9f405e7f6f6a6a90d7e387fa68b8fbcff94149c

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-wal

MD5 7d41323fbe58734026510d107d95c743
SHA1 97255e2edc65a643a7133b5efb44b5983dd31a2a
SHA256 89126fdeedad23728d5fa5f476c9a397b7787c2290a39ee98b0998c7187640bc
SHA512 bc2284e17efa74ec87db4ec05a2c4e3e73f8cc0548ac103a216f29835e51f63fc8ff33bf4f66c4c27d608dae04ad0a4b9b76ab4cd617a6ed4ac056282b240733

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 41172d46ff8888be4cfc7da9dc7d75bd
SHA1 83758a810bc86c52f60c838acebb9bd0c541be19
SHA256 7c27b82cb8af372763b0699274222450a8311bcf96cd8e876b717d4ead2a4c9c
SHA512 6d2556fbd104bc18366276346a8fa3d36992b5a7e98b2dc43683912ab4322dfda0ddf76c43b20710f8b5a8018655e731e5a52b2e573fd62f0ba0767b868c3972

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-wal

MD5 f65ac1759314cffa6793fc2b4877b063
SHA1 2d65ff2b0839a1df3f517bc336c026251aa580b7
SHA256 fc2b461d04b65e1445a7ab5fef50f6cc9ab5d0837628640fe1920753bc8a042b
SHA512 3f810d2277660bd9a78b3e9822f37c118c7ca01a2b4120856f7dace58b957c64e382f9d0aa4e8f5ef4afefba44f817139e5de2bf862f5fee6b4c5752ca200beb

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 69ce7fc6143996fd4236b940aefab21b
SHA1 0bdf998367b1f0bc589a7f83b6d2ab008677797a
SHA256 66083268abeff876163ba52c2e88132ac10cf12c2bb8ddf989d07300fb6ac333
SHA512 1fb0a2f76dabd3f00c482beb8999e52f67d6c7b81b5670d1cf986cedce03c948b6102d33f483d48ad281a493690a162206686afcc07881cdd58f3504e65b0f28

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-wal

MD5 1f45503577d0283937cd3353dbd98443
SHA1 959c8a41a4373bd73da97f46707c57f4439ab1b5
SHA256 2b0bfc0e9bdfad892ad562b790e8b4be9c7faa6c91509d85e7a5ab5d8ea95efb
SHA512 dba83e49544868f231de8c35092c6c0bbc5cf7676c06441d19afbc33ac260f5121e249c7a4612a2b13978649f4c22a2a8f503d2a9ad42925932ed6a23122b43b

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 c56a43118a35531fd0832429275d63d2
SHA1 16cac1fc65245bd3663384a4c8feeb804be8c1c4
SHA256 24b1d4b3d42d0b37ef94abaa072af30ba6d44b5760d6808b16ff0ec0a14d5c4b
SHA512 9d4371d35b9d556178eb1c84f8fd9d8ed8a97c5c745c93dbda7b21e6bbef0cac5051e49ef9e8e5da509aff49fc661c9604a2552d518325245d8bb481c3470c8a

/data/data/com.digitalborder.webappessentials/cache/1582435991586.jar

MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-wal

MD5 30105c97dbf8d90e3d06facb5f2141d9
SHA1 c8f151efe33f128cc582ca5763d310a1d422aae5
SHA256 ea7177e01c1a905af72013fe25d67932bbb61a5a954cc8a291a2c53d76e7c2c9
SHA512 ed5bcb731acd6d1b123a7406bc2eaf711c30268abf07e9211330300cd36cc1761c6749581650165ff7a78a263c53b1c6213a024d79bba9470d226af5cf243390

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 2659588b07247e9ec682466799dbb3ee
SHA1 0066f8bf328910665bba9b585812e6539d9bd236
SHA256 5fc2172581abeed0b0049cf2049cddac86e26a4e2956a2ad2439f9052b886407
SHA512 03833612b83f9ffba155d9da2ff8937c2f5d2638841c40896b8f6214c5d27255b1341ba72e9e8800112459e7db22cd6b0b31b0388934ee9101882752f8ec5c7a

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-wal

MD5 1fab2773321e9bd133d62ffc9489b2b6
SHA1 56bcbbf0764e801b66e891e189bdc8003e9b3642
SHA256 93766d402408141617e1b7fac3dab6690336b7e45bc09419bcf47f7dabb0b539
SHA512 1f148a70872bb8461ac78b0fb2e6c3483f12ce4f247c99788c004ba23cb87f71b6cc04c48b4f0a995237368d693f52cc2e54fd56cf663ad515ebdda073a7685d

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 0eceaadaa2da71c8b529c334f6b399ab
SHA1 96ea08caa0e62ed41a92b361120b9382709404e2
SHA256 3703fce0073c1a3d4762cfa18f5da0c4f27da7a1d464041e40446e910930b728
SHA512 67d1b38d5a5043572b304654f9630f0fb44ea914a5c6bde617a2be0460507000c631d516113e03c018d12b31f34d20d30c95baebd05ab354a3852fe4875f679c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 05:28

Reported

2024-06-11 05:31

Platform

android-x64-20240603-en

Max time kernel

179s

Max time network

183s

Command Line

com.digitalborder.webappessentials

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.digitalborder.webappessentials/cache/1582435991586.jar N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.digitalborder.webappessentials

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.201.106:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.204.72:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 googleads.g.doubleclick.net udp
GB 216.58.213.2:443 googleads.g.doubleclick.net tcp
GB 216.58.213.2:443 googleads.g.doubleclick.net tcp
GB 216.58.213.2:443 googleads.g.doubleclick.net tcp
GB 216.58.213.2:443 googleads.g.doubleclick.net tcp
GB 172.217.169.42:443 tcp
GB 172.217.169.42:443 tcp
GB 142.250.187.194:443 tcp
GB 142.250.178.14:443 tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
GB 216.58.213.14:443 tcp

Files

/data/data/com.digitalborder.webappessentials/no_backup/com.google.InstanceId.properties

MD5 41f72a6550a8d7d7ce9c55efad97449b
SHA1 7d4488586a1b34fb26b281783c3c593f695fc186
SHA256 d1232a6c208ed05d7e0696a38288f93f415f3184d2340f7af62aa4895a4af8f2
SHA512 5f897a89a2df75c1bce4b14d2fcd7768dea756f374587bd2498b4882001387ed6cd906f7949fc8ef888ad907fb8471286fe0eca2b1bb020c7d37ab285f9fd787

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 541192b8e698a21890f8b99eedcbaef8
SHA1 7406370c0e2887a78cb6d64e3fddd4d86b490c62
SHA256 5e6b18fb9c178e6bfe78da5841ea4fba8c07adc3aab09e94aea6421860caf23d
SHA512 94e9fbc6d837fc7e435b5fabd2249f4948526650692e6f56765e5a09dbc18bedc0e232a58113ee918ffe110d576f19da918d756696e218cad4421978fb334325

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 a733d8355668e786a6a74b42ea002faf
SHA1 8c73b7dcf461d2dd44e942e072a61fe431de5b82
SHA256 180049de6ca3cf32a86efde2fb8ceb641645b5d4d9d595fdca56c9a541e0d227
SHA512 e2fc6024df3be03f5e2b058a930493dceec729413e5780192788f05e0ffb255081ea0d4570f8b08fc408543ac80c1e461df8955007b51a0ad53df9896a7fab70

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 481629a9663cfe72519f7256b1698dad
SHA1 8eada6733fd66e418b2a8c591f14063598a00371
SHA256 69e8f75023515fa7723c85870908617e7c2b3894169f21beb709d1c7ff283a6b
SHA512 36114eb8e7bcf33296bd03fc140bb0c87c1c6eb6c85ada13dc4b801bcb343c8eff2303f3244a90007a3667269d16eb7926e3bbb0060e00f5a03d7a07b2da99a7

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 01ae2ce3cd7b09607e89a8a77835c7b4
SHA1 a87b3cfe972b812ba2bb151198f6f6f4bcc73beb
SHA256 48f0cbd828cc76eb990cf3687f57abc134b4538e6b876ffcc109389e92f1021c
SHA512 36fc39b3c33fc9f07293253b6e58aacfb44e7b02592c428419d1a31de17dad0121fc718c5c00352568b495813317480560b15aaf90674bb6b3d8377d7321b243

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 519cd10c1c3faee5b51ab58449b42bf5
SHA1 37256e3dac379a18e6a82b554c8a1081e0be42cf
SHA256 1b340ca1d2e18cecc482f97de3cf36c980ce0e42c06fc1146610384eb6986df6
SHA512 9ad2736b5cd105c571cb42a4dec6edd5a133d540a97933a5ded867b165e0699d4b9dc041bf2a0056670977704029a79067f96ea073c98d07e4f51484a9825cbe

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 f1077491217cec61f54ec0a062dde812
SHA1 d5396c124bb1d8f955d408bd2d94ee862354f7e2
SHA256 099c012d01653435090d5055f187424aa7f1da050d88c495e2b845ac6ffe55b5
SHA512 cf12016ec863667478d4d38a41fbd369b7adeef538b2561725da34bc3d41671e4d8909542caecfac3c4b80ae2d16fa10caf9680ea93f0e61bb737888952fb4bb

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 d74a07a6e32aa1ee90f1e342ce1394cf
SHA1 95e8ae2035afa920314b14a89823defd6f7c6fa8
SHA256 b789fed71ffa43410474f97aa9cad045672f71ac431316506bc062df037d7a89
SHA512 f56d38ed00a5f47294cd54d071d90e2619c2d883b283a495b02ce19b1a7a968ef0f4bc82f534fda80f0343e034fc5110e376e8bb2b090bba1306ef278b05217a

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 7637fa900d29d6e7df8beb3551adab1b
SHA1 06317a0ff889e0f60e499fd27d4f2d3d5b1580e3
SHA256 a7f53e525d896c4820b925abd89f674fd5dd09de5b32c77a69aaf19dd6efaa38
SHA512 8bb374aeb0ff99d53fe4ab8a346daf6e9d92f9385f34e7dd7a63dc446a199f43dd317f9b25d8b2217408678fd7eef5babac51b5adbe06c234e3ca75019b72f78

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 9c7c98d56592807ef8bc3f7e91307121
SHA1 73680e26bd75d13db1990f44b8f1b78e388e21f4
SHA256 5a69e8f1827231d0a0de139715d4d8383e243d131e949911abcdbccd6e8b5487
SHA512 5e3890dd8ef33e9a544e0361168fae7b3dc7f7df17c441f46fbe118ea4ef019cb9ba315b8aba84e6740a5b1ef206b42e21d2623b9d8cb6baeef5c1cfc403570c

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 a0ff4dd177f83551ec655d8102d0c639
SHA1 66414ea5a163790f5d2cbfa5bf03739d672d9ede
SHA256 437abdf60557593e5da3f1b59b95b35f44fdd86aa31c49d8e7802a9210d8d61f
SHA512 d09f260fbe59504052d911ac907efc5e9ea023c361e38007bef5bfbcbce8cde562f579f74348d6922354f4fc4b56e700db65866f006411ebe3467f799b7832cd

/data/data/com.digitalborder.webappessentials/cache/1582435991586.jar

MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

/data/user/0/com.digitalborder.webappessentials/cache/1582435991586.jar

MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 d9fc99156af6a07139eca5a4d17d1465
SHA1 38f3b7a639d80d66a235f578a19b23e69d63a2da
SHA256 6bca7bdd172705598b6033a6e1a6199410f1a06fecfddce0c7ac154d59a0bb1b
SHA512 ecdf6f788426b85c719bd76fc0ae2d1a8fa4dfb921e2625fa705d27aec3d26a41aceca06ff361718d855dce1fcfe269e86aeb427d05252064851f1b775214ee8

/data/data/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 f09d4d7027f65ed8b3a3adc2d188e467
SHA1 95dd42e6fbcdda70e91d45530c925cc125b555ca
SHA256 11e19dbdbaf439702e4ff310e3780cbd54bf99cdb92e2b18c8b2e4712fcaa100
SHA512 2efa489b8e41c55be2928e474ab44bb8d26f09d537f9926d8789688d901767ba73372820017797650a422c7f6a284dd5036ffd112f93d3b186d35d93476f8a28

/data/data/com.digitalborder.webappessentials/cache/oat/1582435991586.jar.cur.prof

MD5 3b916c48baf9e10b03320cb4ed75654c
SHA1 3b950676c3952c8a21c7f4b900c277695440a4bb
SHA256 78b3d8163fa00e6656c09fbc867303fea21dec316ef9377e396b758f4bb3bfc4
SHA512 8546b7219d8aad54569c150f7155f161cc6d7fbfeaebc725c1a6207f0f0e9ffb59b7b3acd96ed7327d918ae6b66d2be37789bbd73553eac663d1b2f44b95b379

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-11 05:28

Reported

2024-06-11 05:31

Platform

android-x64-arm64-20240603-en

Max time kernel

123s

Max time network

132s

Command Line

com.digitalborder.webappessentials

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.digitalborder.webappessentials/cache/1582435991586.jar N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.digitalborder.webappessentials

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.212.200:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 googleads.g.doubleclick.net udp
GB 172.217.16.226:443 googleads.g.doubleclick.net tcp
GB 172.217.16.226:443 googleads.g.doubleclick.net tcp
GB 172.217.16.226:443 googleads.g.doubleclick.net tcp
GB 172.217.16.226:443 googleads.g.doubleclick.net tcp
GB 216.58.212.196:443 tcp
GB 216.58.212.196:443 tcp

Files

/data/user/0/com.digitalborder.webappessentials/no_backup/com.google.InstanceId.properties

MD5 d480386180475f6193f1aaaad627813f
SHA1 9234ec8098e9cdbb58991fa54a2aa1aa088bbfd0
SHA256 aa0f24b17cb2da4b9e84fc3086372a703259630389e7d644affbce53fefd4a91
SHA512 1d7ec2bd88e20658334b030c5e5ccde0180f43e5c855a0ae2c86ea68ea3376f7766e96ab8571e83043f94f640f6730333204c48a681a73491bd1f83e87d91bac

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 48f8ce15544f42904c08d2ebec38a3fa
SHA1 2644ca367fc73340108403a08038d130fe699058
SHA256 3ed39929b1b1224ea0d892b657bb2d4d559292e95aeda722ce75b588d4d70fbc
SHA512 ef552de282d254e8828c1a32dc950098f78c90bbc7311c9dc1e4a83c58dfecf4dbd2d3a4781fdc660c8df2f2569ff6b0526351c91ccfbe901ce1f30689ee122c

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 47aec4b1787fb90caa20d3f9506149b8
SHA1 75229450266cd6bce09f1158f4aa9f5cef829c64
SHA256 f3305cd91364ed11c46d76ad18bf55f78a55a94c95d3588784f4a1c44c232b48
SHA512 d1ac376a86885aa8ec6088da8fc1b96024f313e8012bef70327f99c9129298b4b4d92cbfbab4041c985b593ce33658e606cfc08087b432692d6780464e9fe971

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 8ed77aa821c5a26e44097023b634ed07
SHA1 83da1fa7cd30272c8a9001bb4125b61f4129f2b9
SHA256 34a263bcac57c53f7aca167ae0d9a2aa8b17c120aab1eb96c49d08e4f7c7523f
SHA512 72a2199c2718a4b797d3d16c3c4839679e410eeaf68674a7bf16a2907b386cadbc3e54f551acc1ed37f70d1206760ba9a72bd327a61e944b4a934ef797d6b241

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 164263334c51e99a13a64bd8973beefe
SHA1 a7c384811c9ffe246fe779df1338150094e8e961
SHA256 45fb07cb5c3d8dc8137393d2f42b12caaa88e3bc95fd7334262d4586de5f3a98
SHA512 8aead0d7461f2ffa16d88745dce77043801f23cca13b6c51dbca86454a8f9e711acc361bdb799901f6d248e5680ca81c42ca915468ee0797a8b13baad4d04cef

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 047e4ee83bbf011f41c6463ecca5e064
SHA1 9c0f96bda1e3ec4ca1f9b0b128f60762714ed2f2
SHA256 8ad4543962cd8cee971497ddf78402350b86781b2a4947e1a8f3235854140250
SHA512 f7da76e8504aa798d5a6b125c23eaad2b54e8cc2e5ee306e3f4d5790c7bdef5b02b61a2a88ee365494b2397ef1d6f7ab9cd684b4b5ef7ee117667cad9c0d0d58

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 965117fdce7af122a7ce5e338a0b29ff
SHA1 8c53f0818c8a6b4e4ff4b774ea38fb2f29398e13
SHA256 74f0453097b4d7dd68c568b92b61d369460c21fcccc9e4a5810dec033408b589
SHA512 050061d0a42894ab4062349ebd81320db1a7ec015123f2b7a2561c8e28588043440a81b42445a06e84864ef1e38277892e513c57de275dba1b6cef0d57479d8a

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db-journal

MD5 a6b148a5344631608d5c430e1293ad68
SHA1 d2390ea512492922a4b64bb94ac80373921a3152
SHA256 f0fdd403808b7b81be60842b455e8d623a8bd13002e03c0b34c80510322e0dc8
SHA512 7e2026382f7b39c5e9faa3ecbfe6986e6f43424e6ad9a2a78443effaa52eb3e9f6f47312d117146441c605492ffe2c6d2d47ccb382654473708c9f3a403d0537

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 d58a21dd780cee548cbdef81d20d793b
SHA1 fb37e340ad370858604de5cafb0d7885aa9d691f
SHA256 9ddd6448554e05f109bcab74eb63c20ebd9612a1b88f701563419c914cee2298
SHA512 8fcdbca20211f084c65214eea093bd8e5ffa24577193c030468f27064df1b035312fb79b36e344b3592ff845ab3f343b080e5fbec27e46f553fc368ba4091baa

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 9708924dda56833637f5e6d57d59d70b
SHA1 bf673ecc36ea7e886f1ece8f901bc2480f3ad024
SHA256 7c48ff89fe7c81aa14cb4b4146cbec1afafd9b50aa346f918e156a9dc5cd9311
SHA512 c085ffd6ddd926fb741a2443703d67496f417090bda2dd19650a9e4654099333011652bfcf53e40388fe6b34678f93a71cbf4c2cd6d235a591eccd8c824e912a

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 f481668c493326f04c986c1cfab248ff
SHA1 f5c9c802971bb1b900e3319b2a329448ae4722dd
SHA256 8219abc6866a8b5e0718c308a91c6629ca5d534b5daba02ee5eda393b3594ee2
SHA512 7cea8dfd923f4b0d993d859e4e525001e7b3364f3d1d4aed32228c7aa6ed8436066fc6ea3f350dcc2cc0ab4311d89ed0d81e1275d7f36f00d6c0c6456ee2207d

/data/user/0/com.digitalborder.webappessentials/cache/1582435991586.jar

MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

/data/user/0/com.digitalborder.webappessentials/cache/1582435991586.jar

MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 5fd9b4e3db93fa444139c7ceedab2da1
SHA1 98b307c5f46f0bdc97928305393a94d8350e7838
SHA256 ae23e5834a6783a0bc49a5eb9b7a124fdff041528da915c3d0418c4a95e47443
SHA512 4570ee8d0666e1cf84fc8583c58ab62edfc909f49acee6c9c2163d3be52ba6410b972dcf4585c93c2b3a6b4fbe3b01dffb5a910610760b8bfb6d9d39888824e4

/data/user/0/com.digitalborder.webappessentials/databases/google_app_measurement_local.db

MD5 af74950a24a0e28654f06aadd3f54333
SHA1 672156af086efe9a7620a24ba44cd89aef36b374
SHA256 809333a877126c80ef048b8af25e499719954c9859eeb461d37cd845513ebdee
SHA512 612b5d5c486f2cb0c5fc9bd6a2f226cebe33d1901806adc0b06f549e971cc5833bba69dd6fde152ce30f5863152f95ab393a281efbe7b22e23e9af339b1cb180

/data/user/0/com.digitalborder.webappessentials/cache/oat/1582435991586.jar.cur.prof

MD5 57216efd9bed40e4888a3ec86b8a1a53
SHA1 4a43aca78e0523d2cc49fd0bd855f51c1ddfbffb
SHA256 5278f76d77d7c6583e9998bca58f1216bd1edd85cfe40a1783b8982d595bf39f
SHA512 e5d241798c8a570498e1b9b737d78ea9933d6f6e53e8b2076dd69e5742501952aa1d65f20c977cc7992fc455deb64f82c13809be742fae519792dc9153a64614