Analysis Overview
score
6/10
SHA256
d03f5444649b0eaee5319cc10b9a3d4e5f880c9f8e0a25d0ca44d4f15a532bc0
Threat Level: Shows suspicious behavior
The file a48df9957f9a7389d592c8bc8b67e8cb_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Requests dangerous framework permissions
Acquires the wake lock
Uses Crypto APIs (Might try to encrypt user data)
Checks CPU information
MITRE ATT&CK Matrix
N/A
Analysis: static1
Detonation Overview
Reported
2024-06-13 08:07
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 08:07
Reported
2024-06-13 08:11
Platform
android-x86-arm-20240611.1-en
Max time kernel
47s
Max time network
138s
Command Line
pl.jujubee.flashout2
Signatures
Acquires the wake lock
| Description | Indicator | Process | Target |
| Framework service call | android.os.IPowerManager.acquireWakeLock | N/A | N/A |
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Processes
pl.jujubee.flashout2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | stats.unity3d.com | udp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| GB | 142.250.178.14:80 | android.clients.google.com | tcp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 216.58.212.238:443 | android.apis.google.com | tcp |
Files
/data/data/pl.jujubee.flashout2/databases/DownloadsDB-journal
| MD5 | 3a3421cbc1447ebcf4db47e9f0a0a452 |
| SHA1 | 36bc9c6d83d08a7bf301848068acc056073b8804 |
| SHA256 | bf895876b65a10f22a02f4576442a0b8fdb0904a0acd11c81014c2cd8d079d41 |
| SHA512 | b87ecdbb4706ab3f047f70c5eb5f9b3cd264345b87f141ced9d2904d73c7d15f2b331193643bb524639bd1a27167b7219c05d64dce89756b33416f7588e35b0c |
/data/data/pl.jujubee.flashout2/databases/DownloadsDB
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/pl.jujubee.flashout2/databases/DownloadsDB-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/pl.jujubee.flashout2/databases/DownloadsDB-wal
| MD5 | bb75d8dd59f813fdb45ae6802194a2f6 |
| SHA1 | d78ae000cd704f8222b617220f3a4b47036f5cc5 |
| SHA256 | ad1f7f296f75e52bb9c377cc9435d80cef518c971ee53eb49b4c9ba48456967c |
| SHA512 | fd56a8c3b686ccce12a7b8bb21912e021698b54f996c84e01ba067e8290f150930b096d5c62a753a1e0b7d5a9554103b14ea4c4a5e80d2187dfa5418f0ed3357 |