Malware Analysis Report

2024-09-09 17:11

Sample ID 240613-khevvavfkk
Target a4a8c139b27ce14814d14f896547e94e_JaffaCakes118
SHA256 6d84a0281c36309d62ea797b9d09d9b4fa9dcbe88120bb9a27706b2a2aa32a60
Tags
banker discovery persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

6d84a0281c36309d62ea797b9d09d9b4fa9dcbe88120bb9a27706b2a2aa32a60

Threat Level: Shows suspicious behavior

The file a4a8c139b27ce14814d14f896547e94e_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

banker discovery persistence

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about running processes on the device

Acquires the wake lock

Queries information about active data network

Reads information about phone network operator.

Queries information about the current Wi-Fi connection

Requests dangerous framework permissions

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 08:35

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 08:35

Reported

2024-06-13 08:39

Platform

android-x86-arm-20240611.1-en

Max time kernel

175s

Max time network

187s

Command Line

com.fangdd.mobile.agent

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

com.fangdd.mobile.agent

com.fangdd.mobile.agent:pushservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 oc.umeng.com udp
US 1.1.1.1:53 sapi.map.baidu.com udp
CN 59.82.23.79:80 oc.umeng.com tcp
HK 103.235.46.245:443 sapi.map.baidu.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.130:80 alog.umeng.com tcp
HK 103.235.46.245:443 sapi.map.baidu.com tcp
US 1.1.1.1:53 sdk.open.talk.igexin.com udp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
US 1.1.1.1:53 oc.umeng.co udp
CN 223.109.148.178:80 alog.umeng.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 223.109.148.177:80 alog.umeng.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umeng.co udp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp
CN 223.109.148.177:80 alog.umeng.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp
CN 183.134.98.102:5224 sdk.open.talk.igexin.com tcp

Files

/storage/emulated/0/Android/data/com.fangdd.mobile.agent/cache/uil-images/journal.tmp

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.fangdd.mobile.agent/files/ver.dat

MD5 42bd4a900ad42921bcfab32adb47b67e
SHA1 4f9841315441a46e50f225b4a29583fb8276a824
SHA256 27dfedee6183227b91e794d4c77239f6279acc3a733b792b2c9325f0cc177463
SHA512 2cb76ba2c2085fd9696360ba5f3d5433eed49cd1e5a874c6d1c07514978b81ebc087a270d9173325e6e7605ded7c444d944bb657b829ffdae966753d29561d05

/data/data/com.fangdd.mobile.agent/files/CMRequire.dat

MD5 25e57636aee83606d202f04f26c2913b
SHA1 1ef0ade456ba38aa31584d0fbce647d0ba74b399
SHA256 89c56da41f0046c9e733fed330d2636d623510c217f72c2d025df3343dc66783
SHA512 3a8d294b8be98abe4d18116cbf7c16d44a541d1d20dd4dfbbbf3bbd8cb7997abcbaf51790bbc1978135d888c4e89868a9a2575d9cfed65a331969de77ba07326

/data/data/com.fangdd.mobile.agent/files/VerDatset.dat

MD5 caaa975d7bf4952bd5dd695ade33f1da
SHA1 119373fbb2db036712df72ec9b26c0c2840dfbb1
SHA256 d0f94264a6b5c355dbf5c0516202c732bcae471a2401542b2ca43307727a0d02
SHA512 db2acdecd236eab67cb67151032f53e51c9c04e754f3c21d74e05cacb1ea5edecbbccbd66ee760624b9cac97b8dd77f568324e8abc2b9c16aa73131db81c8b06

/data/data/com.fangdd.mobile.agent/files/cfg/a/ResPack.rs

MD5 0357e8edde36315c0e0a4f5385de625f
SHA1 2e6c6f15010e88dac5078f34e31a8ddf5e032f2f
SHA256 44764ad74b21113fb17b21899bd0d4c81740544e868eaad680553b3bd0cb016d
SHA512 497385b4e3b512f6a4365486d40bf1ed298422087f23a352ed2cec96331b9b012814ffba9c3ba83af5f777df16b53bbe1bf3ab8313902db49011f01a3024cf93

/data/data/com.fangdd.mobile.agent/files/cfg/h/DVHotcity.cfg

MD5 883c30365d5d377966125dd0c079debd
SHA1 d296ec1e3f4badb6e3e6166c1473fb55d4265761
SHA256 50112e7ed210b33224fbe1cce568c8e95a14fb47f7d39ec905369e2feb9668aa
SHA512 00b1604e206a5d929071aa1cac99d83320eacdbb064d517973a5a36757a8a9eb8a103452c98f24e7c8d29adb4b2843e804bfdcb32902da7e364a0c30f8609b7f

/data/data/com.fangdd.mobile.agent/files/cfg/l/DVHotcity.cfg

MD5 1c6abcbbd253448057930ad1cc59ac75
SHA1 a5845d1c4bc87b8b4785b456d76edcb8309eda4e
SHA256 a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136
SHA512 71aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631

/data/data/com.fangdd.mobile.agent/files/cfg/h/DVHotMap.cfg

MD5 c16f5ca1517683c46e02a6b71aab3c00
SHA1 2d09a048d1b8d556d89d4d723947e9e234b5e59b
SHA256 13d4fbc0d1cb7c2761641a3632c440f6f1d919dce731b8c32cb35e652b0b39f9
SHA512 a692b79382747548fd8be8ed94c06198b143c167be1e96f60d8ea7ee9432a0eb1a0cd73d0704523e487d59443bf7ad13eb36e47b67864e227917d33225e3e62b

/data/data/com.fangdd.mobile.agent/files/cfg/l/DVHotMap.cfg

MD5 cc3fad9057e0940ad4d4c7ad27922023
SHA1 403cbbcd7b819733b5caf49ed2a58d654441e99d
SHA256 f6d90bd8621889ab994374b4f51a1c3f9b028aab1a2129b8b3b0e1d7c5c37864
SHA512 ebaf2b8c56bc15826ef38b36e72ae41765fc723470c6dcc40bf9f31118f252777072ad39a535a79f53b6aa29811b4b21cebbc9810c47e34ef9400246d789ab21

/data/data/com.fangdd.mobile.agent/files/cfg/l/DVDirectory.cfg

MD5 65685a117c72fe8fbf5a92b07073c99e
SHA1 b115b527f74e4c291edcaab19b316a446aca8f5b
SHA256 19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8
SHA512 e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253

/data/data/com.fangdd.mobile.agent/files/cfg/l/DVVersion.cfg

MD5 d54b7b380a5ff46c78283013a07d8e0f
SHA1 f697c5f7028ba2679a96d6bc5291c38ff96d7982
SHA256 c7ad837b097687d92e0d944815fc70adcb0e1cdc82db28f728d13e8a48d7532c
SHA512 ade792589c33179c51305f201bfb6db28c05b2ea098d12bfefc1a5cf9bd3014d53830ce2e71f027719ee1b83b2394c7654b5ddf4fdc7f678840869d2a2787ef4

/data/data/com.fangdd.mobile.agent/files/cfg/h/DVDirectory.cfg

MD5 4e9eab735928758b860e48b2f9befd7b
SHA1 7223dfdd00f8059d3b83c28c6f7d78d2dcaa0569
SHA256 1a5650bc57e525ff23c7f0cd058d4574142e772c51a89867a13f89e13b93d6b4
SHA512 c7465fab9518be687ee63cbe044f28a4d5c60f1c043fab0ec66a856b2b542c9d99d9ef5812c7eb2033f797805ba37b821572b83eeeebdaac4854a4bf53977599

/data/data/com.fangdd.mobile.agent/files/cfg/h/DVVersion.cfg

MD5 298924848d2517a508f43ff0cc51bd3b
SHA1 b9fcde7b86653ead6deb57280a6049cf87745710
SHA256 0b6eb1f518059d8c472bab90091bb26d9ab877f6c70fac375412ff1582b8ca3b
SHA512 63b88c5b9b971ec52a5f724485d9998bfedb073e84ed63bcf0337e726923510d97a8ddf87371b5620f89ba788af01db58300638fff5031856c77dec8e18b4342

/data/data/com.fangdd.mobile.agent/files/cfg/a/mapstyle.sty

MD5 46a9f9a5221dbe4ff71bfcd2ee045c5c
SHA1 915cb3bc2f0096dede38afc1cd7f09c8782360a9
SHA256 ad3067eb308a9420b727b4f24dc5134bc75b36bdda7a7a7c5651090698dd10a9
SHA512 185530752b639d743f99e28369f75626900420dccf598a639065ecb08c562ff98c4a1f6abbec9724d1684ed053774d60402cd2f20e3586a534c8715e7cec2ac2

/data/data/com.fangdd.mobile.agent/files/cfg/a/satellitestyle.sty

MD5 3f1348cd6165c9a66a9892565c917ca1
SHA1 96f0c939438c494cf3fd89246d458e92c0c7203b
SHA256 5fbe3817e4047e14c40b567be4955d7579c8bf7b7824bf8370f5e194ebf9767a
SHA512 405c3d1d5f4899cf723509f8e293f2ca1d95a79f7892e93401309372335a6a286f2eae9ee9312f69af10c5bcabd091cd90608898a129542b0abe0617c500d023

/data/data/com.fangdd.mobile.agent/files/cfg/a/trafficstyle.sty

MD5 6a86f30539dfc9332cd235fc48fcb62c
SHA1 5c202003f6346edb85175b8df7c460793f5512c6
SHA256 34bfd1e28c3625f50a23240c4b08ac50a90fd35c5e5f88aed1cf36fa8fe5e18f
SHA512 f63edb8270e6cd35e5c6896e2b9153144af0d29303e367a4fa81941b1b2bb0de57fa484badb7ec7f05ebdfa67d77b00c3651572c5f05e9314389887f5546d235

/data/data/com.fangdd.mobile.agent/files/umeng_it.cache

MD5 e4cff21abe94129195156c24ae3c0f7b
SHA1 95fe3520488917b2f90680068da136405d4953f9
SHA256 ddf2832b35fc3c3aeb251ab75d6c09b938fb50705c1404439b228163cf2a3b50
SHA512 bc237232a1ffc2e63010ac8706464fb2124f070c3698d311fd3a7f51785da7fc4b2dd09b2f5acbbfdfcf883dd9e0917bb809aac35712ca963a60c7657f5fe207

/data/data/com.fangdd.mobile.agent/databases/pushsdk.db-journal

MD5 e31c26ddd0619f514dc6b14e9f71222c
SHA1 1172fa8ae1e6fc458c0a1f3c48c4b4a668853c3b
SHA256 a19c73ada7dbbe4ff8d26298722d14e2ca076a72ffca609688ac5bb2cc68ddda
SHA512 7f5f6e4d0d2cfa80605dbf7c1251ad896c284a259621182b3bc016a9abbb254b5d1337d81eee2ab8737dd39db664724b4978db37533118471487323c8f87b6cb

/data/data/com.fangdd.mobile.agent/databases/pushsdk.db-wal

MD5 3894b7935ea2d153c952f42ebcab7056
SHA1 97c3691c87c1fd834b67a48acc8e90586aeb5e18
SHA256 ae8289c7461c228e253bca6294a8675e0fcd784b6a4c4c9c375b62bccb95d92e
SHA512 65443db0d2303605fc487802b995d6b517a52314d62f57b6b10808a6ec2c7243a4045088c2e5765205bb9cd582b8ab2c5178fc190ae5252770e79544942424dd

/data/data/com.fangdd.mobile.agent/files/mobclick_agent_sealed_com.fangdd.mobile.agent

MD5 79f4e3b504b3e7b3691936d4fddac862
SHA1 517883fc0c074fc378db56b241e0c9816720a653
SHA256 1c7ee2f33d5cc2dde6f7fc7d931357bf8e5b2086502902ccd280af7a6a017655
SHA512 5c26719c85f4e892197a008ced25a90ecf48dcaef28838864216ca7bbbdbc9ad91242ee9e911aabc1709b756f5d1762a76e761959b3fec8f81c9869cbd1e29b7

/data/data/com.fangdd.mobile.agent/files/.imprint

MD5 85ec3c0a95ba6107e792f870b6d39db3
SHA1 afcb1a4cad1b9fea02512ea09f2cb85106ab4fc8
SHA256 e417b598be100c74623bfefa1354e7ae75e752ed66562d44c5199d6ecd8af347
SHA512 213bb9ed77a11fa15a17f3edc2fb9ffb396fc1bf61240504f84850ea3c91b2028ca4982b13ac706535886adf2ad6e8144d8527ff235fb6ecc9c519678806e213

/data/data/com.fangdd.mobile.agent/files/umeng_it.cache

MD5 70a7e4c053053ed3c9e9e566463ff6e9
SHA1 22dd9a010d4f943406ab71bf70fd28955c3ce9f1
SHA256 40302e143af45a82b3ce53fcc094faecb9295bc32fba35e5661c5fa72d0e8539
SHA512 ddd24410152a775e2ba19569824a7839c2a077719e7a1c8c52e5b253a8f7ae9a4de228c657988b8303ee43a6a9d6de32ebb6df18a8b2448573f8dae3e59968da

/data/data/com.fangdd.mobile.agent/files/mobclick_agent_cached_com.fangdd.mobile.agent100040

MD5 234c1ee9fa120b499501378a6be2ff9e
SHA1 415d7b32c18ce25468ea7dc78978e42d4c2f56bb
SHA256 0c1c0f84e3b6479dee8e7671588be0309f5dbbaf1622afd15658d2072c7a5bea
SHA512 8641eda988074d9d73c7d8f33583fa99c458e64d6f568abec966b02955266161095e5a6e7bf8d9ec45c6e7f7541081608af05ab08b85ebcec198fa09990ff146