Analysis Overview
SHA256
e4ce591fa45f6336e86cb8637347ebf6957dc35f717ac29494b3e999ae4ca328
Threat Level: Shows suspicious behavior
The file a4729f1de595216adc7331fc887f9c1b_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Queries information about the current Wi-Fi connection
Requests dangerous framework permissions
Queries information about active data network
Registers a broadcast receiver at runtime (usually for listening for system events)
Uses Crypto APIs (Might try to encrypt user data)
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-13 07:34
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 07:34
Reported
2024-06-13 07:37
Platform
android-x86-arm-20240611.1-en
Max time kernel
7s
Max time network
130s
Command Line
Signatures
Queries information about active data network
| Description | Indicator | Process | Target |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
Queries information about the current Wi-Fi connection
| Description | Indicator | Process | Target |
| Framework service call | android.net.wifi.IWifiManager.getConnectionInfo | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Processes
com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy
Network
| Country | Destination | Domain | Proto |
| GB | 172.217.169.74:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | sapi.map.baidu.com | udp |
| HK | 103.235.46.245:443 | sapi.map.baidu.com | tcp |
| GB | 142.250.187.238:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.238:443 | android.apis.google.com | tcp |
| GB | 172.217.169.74:443 | tcp | |
| GB | 172.217.169.74:443 | tcp |
Files
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/imei.dat
| MD5 | 748d9beeaa1899252a7365b780b95fb0 |
| SHA1 | 2158cbe9044f2b138df0094615afe6616e526c9d |
| SHA256 | 59290d2d5a77605f8140feb82e44e8438115fb2f93dc56ed4c225b88c21baaa8 |
| SHA512 | cdeb0c4cebf1cc96ebda6940763a940df76120ee991bc7f003480caf055a970f16e4a19ef2ba2c56fa056d539b981e16542ec7239a7b91dd3828585bc2d1e440 |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/imei.dat
| MD5 | 48f5e05377c99f83dd0772288907c601 |
| SHA1 | 73784160a73f77a48925f41f464c4154be7d6110 |
| SHA256 | 9f56c93ab6f4405ba8ed9ffadbc8408493f2104a6f97f7f11c1da3cd80d8bceb |
| SHA512 | ec89bb549b069e81711ed8a02b727da88a3311fba03c7ace0de1823ceb9d1b2f620f99e7753adc43bc2615351ef1ede3361d62e65f083786751ae74dea7d0ab2 |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/ver.dat
| MD5 | e6c00d63ce4b1646cc13780822fcef1d |
| SHA1 | e4ef326f9d88ce998e8b1aceb96722dadc1eef6d |
| SHA256 | 77fc85210c7fee84ced145217beb7fced2eacd4f82aa7578090bbd4a738e0a55 |
| SHA512 | f2674db222d9c85e32d89f7102260f6fc0efcae41e9a79baf61eb44fc87c879acb9060c8ec8410a626b1aa4d9b5d3345d7a2627b4a77c9be7bce8a94e3d86d95 |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/CMRequire.dat
| MD5 | 25e57636aee83606d202f04f26c2913b |
| SHA1 | 1ef0ade456ba38aa31584d0fbce647d0ba74b399 |
| SHA256 | 89c56da41f0046c9e733fed330d2636d623510c217f72c2d025df3343dc66783 |
| SHA512 | 3a8d294b8be98abe4d18116cbf7c16d44a541d1d20dd4dfbbbf3bbd8cb7997abcbaf51790bbc1978135d888c4e89868a9a2575d9cfed65a331969de77ba07326 |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/VerDatset.dat
| MD5 | caaa975d7bf4952bd5dd695ade33f1da |
| SHA1 | 119373fbb2db036712df72ec9b26c0c2840dfbb1 |
| SHA256 | d0f94264a6b5c355dbf5c0516202c732bcae471a2401542b2ca43307727a0d02 |
| SHA512 | db2acdecd236eab67cb67151032f53e51c9c04e754f3c21d74e05cacb1ea5edecbbccbd66ee760624b9cac97b8dd77f568324e8abc2b9c16aa73131db81c8b06 |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/cfg/a/ResPack.rs
| MD5 | 37c7d7a469620c696b8812831a527d62 |
| SHA1 | 2e54375cde7ad35666184f5c7aeb65d5887f746c |
| SHA256 | f3f542caf19e546f5cc1d265d5e6e35fa5ff32bb24e9282a60ef21d4c8588d9e |
| SHA512 | 8726878886379a8174b1ea11bb0c21dc6ef9bfe0ff2eafdfc4260a8c8666be82e3fd95309915aa0b40ad1a34b2f8f62f7c33860247562e84cac7e156dbf995bb |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/cfg/h/DVHotcity.cfg
| MD5 | 6c495e47c754a9b25437ff9a88c7a51e |
| SHA1 | 8c4e36fda1e1f80918a3a8f1812c4e68b2326a4f |
| SHA256 | e68e66e643d690d203a5153156e9cd6383ae1b3c481afa4b19e903d4a82289a3 |
| SHA512 | f3c030504cf50fdbd284acbdd893c948fb7ddb7544ce01d11c94fb00fb554f878949b1867fd5ab6c25e76c4be717aa819a917d4f25c8eba904df1a2819becf1c |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/cfg/l/DVHotcity.cfg
| MD5 | 1c6abcbbd253448057930ad1cc59ac75 |
| SHA1 | a5845d1c4bc87b8b4785b456d76edcb8309eda4e |
| SHA256 | a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136 |
| SHA512 | 71aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631 |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/cfg/l/DVDirectory.cfg
| MD5 | 65685a117c72fe8fbf5a92b07073c99e |
| SHA1 | b115b527f74e4c291edcaab19b316a446aca8f5b |
| SHA256 | 19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8 |
| SHA512 | e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253 |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/cfg/l/DVVersion.cfg
| MD5 | 1fb3fa59245606c238e4b595b1b2dde7 |
| SHA1 | d5b6c5fbeeefefc30f076b8c1a74836d9ddefaf8 |
| SHA256 | 0cbe2ba9e6eb687cba7161d6fc291c293cfb9300becbea13359174650e5b5bf0 |
| SHA512 | 4af3c2fe380cb41519087699d03ddb6a6ad98cde54ab5bde965551df6a60820975e2ca42300d668c8ea37a46b3a8ef61c4718d59527004a933d4ed480122fc8c |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/cfg/h/DVDirectory.cfg
| MD5 | 4baa4ede52eacda76bd26d5838cc2de3 |
| SHA1 | 38b65c75440581f43ddb32ef17480e5c87f0153f |
| SHA256 | c0f2b002adafe50265789ca04bc8dab8c176e6a7eaae164fdb98ebcb9ff98eb2 |
| SHA512 | 58fef595b1db5f8fa7dbfcaa3b6b676bdbec8931ffa833858e2452c2f35a1b192746d2315acd27551594377ac121ec80574deee632d4bfa94b6315b8a0d33feb |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/cfg/a/mapstyle.sty
| MD5 | db362e36518c847ae80caca571e3c8c8 |
| SHA1 | 610911bf7869016fb7c9a2026b3024eacf0b4593 |
| SHA256 | 95549560fbb3d96dc791c2d16fdd5f098784eee75ac293556fe9688fb2f0ec9d |
| SHA512 | 41fa2b9b61c131b0926d0f47f86eea56859ca0d4e44ac23647a73ff4b98214183cb0a523336dcae4e2ddb4be932e994e1950365fd3590eb2f7c3b96bd4bb8a41 |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/cfg/a/satellitestyle.sty
| MD5 | 6034f2a3f8bc9639ae820bd977bde4a0 |
| SHA1 | 599f7994853b61bc5ee09a75b6383a13a5a685f7 |
| SHA256 | 753705cb1ab2a676a9ef48881cfb036f212c4a7e7a5d34d9f8708075078e5818 |
| SHA512 | acaf0d146e4e3739eeaa40d46f7002776ebc4074bb89d12a5c25b12f53190a0e367ef0bd3225835e7e4b39a70b06e9f7328b1e342a9c5829af7610c14d41898f |
/data/data/com.hundsun.qy.hospitalcloud.bj.xhhosp.hsyy/files/cfg/a/trafficstyle.sty
| MD5 | 1e4b535871c4feb2010b614713def5c7 |
| SHA1 | 4c5dc67838d12b795b6882c6dbbcc6767e42184f |
| SHA256 | efa3ec85127a21a8c8a74640acc5fe1d992952964d4f257682f832f63c2ad3fc |
| SHA512 | 0c5443dbfdafab2e6cb7740587f48ca9a2c971b93afafcebccd17691edaa7c7fb75dfd1b6c939dd591a5aa65977f55e64b6c3690ab0a660432269fc43bf3133c |
/storage/emulated/0/baidu/.cuid
| MD5 | a7c13ec968230199c83b6c17ae3aec1c |
| SHA1 | e809896946dedb904151c26552693d02579e7534 |
| SHA256 | 32232e12a4ab6c671ed748a9510e7e522d620f895bcf037df9926204634e40a4 |
| SHA512 | dd96db0cfeb4cdd953b9749d7942eb277d5534c5ebb0e73e60b69270f24905058e997105cc77a31865046b63bab47bb669fce65823c3c74644f182001062f324 |