Analysis Overview

score

7^/10

SHA256

eb4c7fc0878b786a53e0123c3dacb485610fa4dbf64fac4a5faf14d542dfa625

Threat Level: Shows suspicious behavior

The file a3eba782bd45b94b8a40d5c388ed1310_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

collection discovery persistence

Reads the content of the call log.

Queries information about active data network

Queries the mobile country code (MCC)

Declares services with permission to bind to the system

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 05:07

Signatures

Declares services with permission to bind to the system

Description	Indicator	Process	Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE	N/A	N/A

Requests dangerous framework permissions

Description	Indicator	Process	Target
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG	N/A	N/A
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS	N/A	N/A
Allows an application to read SMS messages.	android.permission.READ_SMS	N/A	N/A
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE	N/A	N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE	N/A	N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW	N/A	N/A
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE	N/A	N/A
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 05:07

Reported

2024-06-13 05:11

Platform

android-x86-arm-20240611.1-en

Max time kernel

Max time network

138s

Command Line

info.tikusoft.l8

Signatures

Reads the content of the call log.

collection

Description	Indicator	Process	Target
URI accessed for read	content://call_log/calls	N/A	N/A

Queries information about active data network

discovery

Description	Indicator	Process	Target
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	N/A	N/A

Queries the mobile country code (MCC)

discovery

Description	Indicator	Process	Target
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	N/A	N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.registerReceiver	N/A	N/A

Checks memory information

Description	Indicator	Process	Target
File opened for read	/proc/meminfo	N/A	N/A

Processes

info.tikusoft.l8

Network

Country	Destination	Domain	Proto
N/A	224.0.0.251:5353		udp
US	1.1.1.1:53	cp.g365.cn	udp
HK	154.211.12.106:80	cp.g365.cn	tcp
HK	154.211.12.106:80	cp.g365.cn	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
GB	172.217.16.238:80	android.clients.google.com	tcp
US	1.1.1.1:53	android.apis.google.com	udp
GB	216.58.212.238:443	android.apis.google.com	tcp