Malware Analysis Report

2025-01-19 07:49

Sample ID 240611-wt8svawdlf
Target 9f1aa061cdfdd792b381d3afc979cc95_JaffaCakes118
SHA256 65268e7dce5df91133f50f72303d37d4b40d453b54f995e3ee222e4c85df3855
Tags
persistence
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

65268e7dce5df91133f50f72303d37d4b40d453b54f995e3ee222e4c85df3855

Threat Level: Shows suspicious behavior

The file 9f1aa061cdfdd792b381d3afc979cc95_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-11 18:14

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 18:13

Reported

2024-06-11 18:17

Platform

android-x86-arm-20240611-en

Max time kernel

14s

Max time network

130s

Command Line

com.xxxxxbbs.spark

Signatures

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.xxxxxbbs.spark

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp

Files

/data/data/com.xxxxxbbs.spark/databases/bugly_db_legu-journal

MD5 e5e6718e00cd5cf65834b0291a8ec353
SHA1 7f6124aeddbbb3233220d99212cb06d1b9616cfc
SHA256 d1e6935f2940becdd0795986f0be9459488b6335a79bc0437599e738d766ae7b
SHA512 b983710d0627593567b2a0c3a642ba3b361cda27b920919c6e22f4ce84b953c24e6066e7c6438371e547bad4514c03bf0ad103d0cffcfc4a0274cb38f5b48c76

/data/data/com.xxxxxbbs.spark/databases/bugly_db_legu

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.xxxxxbbs.spark/databases/bugly_db_legu-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.xxxxxbbs.spark/databases/bugly_db_legu-wal

MD5 a7778065a110fc8752c3fc897d78efe3
SHA1 cf0dc81a656e75d07689258783edaf8ac2a081d6
SHA256 7e83668ccb288194d89ee312ffabafe306407c0481e37273f8911ded027e0dce
SHA512 86c20eb2f33e45e1c15bb23f0abdf3277dcc0a3a29a7f3e9d59ff36e4674dfb6c4cd7a59f42be3a10ea45ee97e9f1296c18fa3a56ee79f6642efe327f23e5b8b

/data/data/com.xxxxxbbs.spark/app_bugly/tomb_1718129658190.txt

MD5 60080bebede3f015350289c0e375e936
SHA1 2de0da409c03066623fe9a1f1d88c13c7672c6a9
SHA256 509a807954acdf80d8938001415654fab4be7bae75023c94e85ed4766a991f0c
SHA512 8d8ba209a79d0dfd7a90ff57b55bd0713de6905c9aeaee34b914502656517e2f8ffcbfe815967117d4e67fdc889d17f99f4563e34d26099fdfbd9e63a4c07f29

/data/data/com.xxxxxbbs.spark/app_bugly/rqd_record.eup

MD5 5b835d9071535ece394104ebd7a8d0dd
SHA1 e76beb71a1a3f7147dda1083e144097e8876c576
SHA256 e0196bd250a5d46766d9701501c6037a991b2f1444cabbb1259af044b9ad9772
SHA512 75fd20047271777bbcd2e90a75728ee8617533636216ca342bdee262c249af3c995aa0b8992f458d7bb1a3ea7c7c20e87197d4e0f8b838e7144a363e69b1308e

/data/data/com.xxxxxbbs.spark/app_bugly/rqd_record.eup

MD5 a4a9d11f079c91b71aa4d5a9a5aa434d
SHA1 46e0ac18199f6504531344adb00527ed4d466ebe
SHA256 6ef9fec196130e4cbe99be4b2b60d1a044210f2b53900b32093a320a929bc230
SHA512 5d43370f0d60aefe08aea47c32d892e71f4cf502ee5058787bfb07a0edb44baaa9211a6df339e3334e84bb375497d09e0d47e4a83b88b827e0124568e8f414cf

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 18:13

Reported

2024-06-11 18:17

Platform

android-x64-arm64-20240611-en

Max time kernel

4s

Max time network

162s

Command Line

com.xxxxxbbs.spark

Signatures

N/A

Processes

com.xxxxxbbs.spark

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.204.72:443 ssl.google-analytics.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 142.250.180.3:443 tcp

Files

/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal

MD5 b969d18661d51c04f8b0508e7c98976a
SHA1 a06c1cf9747248f81584fbe03c1fe67f1bf5b409
SHA256 080395f69be12335773bf5250d0b881b58389a6c0a35601a1a204388931a6828
SHA512 e032da5e445a5c9a411a816bdc0dca24cc8a75d8687c70c57e6f4c9d17ab01fdb9597b6e1004aa92c8a00543a5a9d95cac3df53b992d12d4327f97777f999248

/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu

MD5 4f687da43eef0567cb783f78a4955974
SHA1 ba4fa2fc5b1d9bdf0143fe268b3c7b6c391e1e8c
SHA256 09ab544ab9ac77b569bfbb318d5a677a1232e297fa8b4833fd2106288ca6d952
SHA512 2ec79a3bc5077bfcb3423294fe642cfe2ef453b7f2357b53643b14f2468dcb2bbaea27bafb359764d5767d1ab5f9103d3a3e75585fbfca87082f1f1a5e92efe7

/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal

MD5 3a4b24ea34a13c2ff3a4ac7d817ecc8d
SHA1 3442828b2931c50790ac2ee0e9f5f77ca33eb06f
SHA256 3e6d81a8697563c47bd0af62afbc624d4c6c8f6900b0e5de77b99cfb04ec4af3
SHA512 42495993caa9e9acf6073735dd662eec5afa93ace16569251845fd27c41941de78ae62cb8f61d4df806c08547a056608e7fdff3fe894bc529e0cbe5074e25464

/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal

MD5 fe3a389e38a952fb5dca139acded98f4
SHA1 aa040ebd0f1d0840a7a92409158a8cb2de626db5
SHA256 54dd93d28f42c5bd4ccf7f2bdd64a19808a0d6c7d47f76d0decb843e1f7c2430
SHA512 42718e0d121c3a326209b6ee860de73ff5690e62419af3d5803fd8bc585fea6c0d26fd13ef2485e1565058824d3d630ed987e2b3189c0e7c3e67f81666f06b49

/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal

MD5 10fcd89038abbb9f2129cd22a6af40fd
SHA1 912ab6bb3611d7afbc3fa5efa8ea7e21be2d25d2
SHA256 95924c4cf58adaa57cbf59fefcd391fc3f9c1a2a559c49d5a491f8494e6267ee
SHA512 fdc2cb372cff5e09fd21695acdb3583b0e5134174fcccc35d7395b915e46e0b2e2164f561890134e94f3613adf7d6b5f8e47b61607a564d267012dba0e0e1f32

/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal

MD5 5121409c9704eb057d41c93484dd3f06
SHA1 06a6af79bdadeb8417c032e0907b3a5f20f5350c
SHA256 d7f9c4234b6cf4e454538dab0d10a0430ab580e676d8c6f8b21a1f935f860fee
SHA512 024c50ee16bad5097cc10575e7498303e6ad84b5ff46c9b7526fdff97c6799ad87d6918c8c92b4ed11ea0d62e21a7c638e0281bc87dfa7f035be054fa0f1d792

/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal

MD5 47674929942567438010de8ea64d5022
SHA1 dd2f43ba2890dbca37092208f53016c1421b372c
SHA256 4bfcd64f85563ea1363313a86133bb0fca412d6d19bcae0241514539b7401b79
SHA512 cbce70f7bfe61297a08a36c65102d606f6c2f24d95c9752d4e2c651a685d9045064799378896d050cff05984ce9b1d3427dc2b0cd8820c5d340c4b73d0f176cb