Analysis Overview
SHA256
65268e7dce5df91133f50f72303d37d4b40d453b54f995e3ee222e4c85df3855
Threat Level: Shows suspicious behavior
The file 9f1aa061cdfdd792b381d3afc979cc95_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Requests dangerous framework permissions
Registers a broadcast receiver at runtime (usually for listening for system events)
Checks memory information
MITRE ATT&CK
Mobile Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-11 18:14
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-11 18:13
Reported
2024-06-11 18:17
Platform
android-x86-arm-20240611-en
Max time kernel
14s
Max time network
130s
Command Line
Signatures
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
com.xxxxxbbs.spark
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.201.110:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.200.46:443 | android.apis.google.com | tcp |
Files
/data/data/com.xxxxxbbs.spark/databases/bugly_db_legu-journal
| MD5 | e5e6718e00cd5cf65834b0291a8ec353 |
| SHA1 | 7f6124aeddbbb3233220d99212cb06d1b9616cfc |
| SHA256 | d1e6935f2940becdd0795986f0be9459488b6335a79bc0437599e738d766ae7b |
| SHA512 | b983710d0627593567b2a0c3a642ba3b361cda27b920919c6e22f4ce84b953c24e6066e7c6438371e547bad4514c03bf0ad103d0cffcfc4a0274cb38f5b48c76 |
/data/data/com.xxxxxbbs.spark/databases/bugly_db_legu
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/com.xxxxxbbs.spark/databases/bugly_db_legu-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/com.xxxxxbbs.spark/databases/bugly_db_legu-wal
| MD5 | a7778065a110fc8752c3fc897d78efe3 |
| SHA1 | cf0dc81a656e75d07689258783edaf8ac2a081d6 |
| SHA256 | 7e83668ccb288194d89ee312ffabafe306407c0481e37273f8911ded027e0dce |
| SHA512 | 86c20eb2f33e45e1c15bb23f0abdf3277dcc0a3a29a7f3e9d59ff36e4674dfb6c4cd7a59f42be3a10ea45ee97e9f1296c18fa3a56ee79f6642efe327f23e5b8b |
/data/data/com.xxxxxbbs.spark/app_bugly/tomb_1718129658190.txt
| MD5 | 60080bebede3f015350289c0e375e936 |
| SHA1 | 2de0da409c03066623fe9a1f1d88c13c7672c6a9 |
| SHA256 | 509a807954acdf80d8938001415654fab4be7bae75023c94e85ed4766a991f0c |
| SHA512 | 8d8ba209a79d0dfd7a90ff57b55bd0713de6905c9aeaee34b914502656517e2f8ffcbfe815967117d4e67fdc889d17f99f4563e34d26099fdfbd9e63a4c07f29 |
/data/data/com.xxxxxbbs.spark/app_bugly/rqd_record.eup
| MD5 | 5b835d9071535ece394104ebd7a8d0dd |
| SHA1 | e76beb71a1a3f7147dda1083e144097e8876c576 |
| SHA256 | e0196bd250a5d46766d9701501c6037a991b2f1444cabbb1259af044b9ad9772 |
| SHA512 | 75fd20047271777bbcd2e90a75728ee8617533636216ca342bdee262c249af3c995aa0b8992f458d7bb1a3ea7c7c20e87197d4e0f8b838e7144a363e69b1308e |
/data/data/com.xxxxxbbs.spark/app_bugly/rqd_record.eup
| MD5 | a4a9d11f079c91b71aa4d5a9a5aa434d |
| SHA1 | 46e0ac18199f6504531344adb00527ed4d466ebe |
| SHA256 | 6ef9fec196130e4cbe99be4b2b60d1a044210f2b53900b32093a320a929bc230 |
| SHA512 | 5d43370f0d60aefe08aea47c32d892e71f4cf502ee5058787bfb07a0edb44baaa9211a6df339e3334e84bb375497d09e0d47e4a83b88b827e0124568e8f414cf |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-11 18:13
Reported
2024-06-11 18:17
Platform
android-x64-arm64-20240611-en
Max time kernel
4s
Max time network
162s
Command Line
Signatures
Processes
com.xxxxxbbs.spark
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.178.14:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 172.217.16.238:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 216.58.204.72:443 | ssl.google-analytics.com | tcp |
| GB | 216.58.201.100:443 | tcp | |
| GB | 216.58.201.100:443 | tcp | |
| GB | 142.250.180.3:443 | tcp |
Files
/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal
| MD5 | b969d18661d51c04f8b0508e7c98976a |
| SHA1 | a06c1cf9747248f81584fbe03c1fe67f1bf5b409 |
| SHA256 | 080395f69be12335773bf5250d0b881b58389a6c0a35601a1a204388931a6828 |
| SHA512 | e032da5e445a5c9a411a816bdc0dca24cc8a75d8687c70c57e6f4c9d17ab01fdb9597b6e1004aa92c8a00543a5a9d95cac3df53b992d12d4327f97777f999248 |
/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu
| MD5 | 4f687da43eef0567cb783f78a4955974 |
| SHA1 | ba4fa2fc5b1d9bdf0143fe268b3c7b6c391e1e8c |
| SHA256 | 09ab544ab9ac77b569bfbb318d5a677a1232e297fa8b4833fd2106288ca6d952 |
| SHA512 | 2ec79a3bc5077bfcb3423294fe642cfe2ef453b7f2357b53643b14f2468dcb2bbaea27bafb359764d5767d1ab5f9103d3a3e75585fbfca87082f1f1a5e92efe7 |
/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal
| MD5 | 3a4b24ea34a13c2ff3a4ac7d817ecc8d |
| SHA1 | 3442828b2931c50790ac2ee0e9f5f77ca33eb06f |
| SHA256 | 3e6d81a8697563c47bd0af62afbc624d4c6c8f6900b0e5de77b99cfb04ec4af3 |
| SHA512 | 42495993caa9e9acf6073735dd662eec5afa93ace16569251845fd27c41941de78ae62cb8f61d4df806c08547a056608e7fdff3fe894bc529e0cbe5074e25464 |
/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal
| MD5 | fe3a389e38a952fb5dca139acded98f4 |
| SHA1 | aa040ebd0f1d0840a7a92409158a8cb2de626db5 |
| SHA256 | 54dd93d28f42c5bd4ccf7f2bdd64a19808a0d6c7d47f76d0decb843e1f7c2430 |
| SHA512 | 42718e0d121c3a326209b6ee860de73ff5690e62419af3d5803fd8bc585fea6c0d26fd13ef2485e1565058824d3d630ed987e2b3189c0e7c3e67f81666f06b49 |
/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal
| MD5 | 10fcd89038abbb9f2129cd22a6af40fd |
| SHA1 | 912ab6bb3611d7afbc3fa5efa8ea7e21be2d25d2 |
| SHA256 | 95924c4cf58adaa57cbf59fefcd391fc3f9c1a2a559c49d5a491f8494e6267ee |
| SHA512 | fdc2cb372cff5e09fd21695acdb3583b0e5134174fcccc35d7395b915e46e0b2e2164f561890134e94f3613adf7d6b5f8e47b61607a564d267012dba0e0e1f32 |
/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal
| MD5 | 5121409c9704eb057d41c93484dd3f06 |
| SHA1 | 06a6af79bdadeb8417c032e0907b3a5f20f5350c |
| SHA256 | d7f9c4234b6cf4e454538dab0d10a0430ab580e676d8c6f8b21a1f935f860fee |
| SHA512 | 024c50ee16bad5097cc10575e7498303e6ad84b5ff46c9b7526fdff97c6799ad87d6918c8c92b4ed11ea0d62e21a7c638e0281bc87dfa7f035be054fa0f1d792 |
/data/user/0/com.xxxxxbbs.spark/databases/bugly_db_legu-journal
| MD5 | 47674929942567438010de8ea64d5022 |
| SHA1 | dd2f43ba2890dbca37092208f53016c1421b372c |
| SHA256 | 4bfcd64f85563ea1363313a86133bb0fca412d6d19bcae0241514539b7401b79 |
| SHA512 | cbce70f7bfe61297a08a36c65102d606f6c2f24d95c9752d4e2c651a685d9045064799378896d050cff05984ce9b1d3427dc2b0cd8820c5d340c4b73d0f176cb |