Analysis Overview
SHA256
33596bf1ec339f5d22da8374fea5fcb615f7ed5b700219c051c096c06af422ae
Threat Level: Shows suspicious behavior
The file a4c0d7448e127bf6332ee12f32d5316c_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Queries the phone number (MSISDN for GSM devices)
Requests dangerous framework permissions
Queries information about active data network
Queries information about the current Wi-Fi connection
Queries the mobile country code (MCC)
Uses Crypto APIs (Might try to encrypt user data)
Registers a broadcast receiver at runtime (usually for listening for system events)
Checks CPU information
Checks memory information
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-13 09:01
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-13 09:01
Reported
2024-06-13 09:04
Platform
android-x64-20240611.1-en
Max time kernel
8s
Max time network
152s
Command Line
Signatures
Processes
com.zqhy.safepay
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.180.8:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.178.10:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.179.238:443 | android.apis.google.com | tcp |
| GB | 216.58.213.14:443 | tcp | |
| GB | 142.250.178.14:443 | tcp | |
| GB | 216.58.201.98:443 | tcp | |
| GB | 142.250.179.228:443 | tcp | |
| GB | 142.250.179.228:443 | tcp |
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-06-13 09:01
Reported
2024-06-13 09:04
Platform
android-x64-arm64-20240611.1-en
Max time kernel
8s
Max time network
133s
Command Line
Signatures
Processes
com.zqhy.safepay
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.187.200:443 | ssl.google-analytics.com | tcp |
| GB | 172.217.16.238:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.206:443 | android.apis.google.com | tcp |
| GB | 216.58.201.100:443 | tcp | |
| GB | 216.58.201.100:443 | tcp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 09:01
Reported
2024-06-13 09:04
Platform
android-x86-arm-20240611.1-en
Max time kernel
28s
Max time network
160s
Command Line
Signatures
Queries the phone number (MSISDN for GSM devices)
Queries information about active data network
| Description | Indicator | Process | Target |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
Queries information about the current Wi-Fi connection
| Description | Indicator | Process | Target |
| Framework service call | android.net.wifi.IWifiManager.getConnectionInfo | N/A | N/A |
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
com.hpw.ty.jiuyao
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | serverip.sdk.quicksdk.net | udp |
| US | 1.1.1.1:53 | sdk-ns1.jiuyao.yuzhuagame.com | udp |
| CN | 180.150.189.181:88 | tcp | |
| US | 1.1.1.1:53 | s1-byzh-cw.oclkj.com | udp |
| CN | 180.150.191.127:80 | serverip.sdk.quicksdk.net | tcp |
| US | 1.1.1.1:53 | sdk-ns2.jiuyao.yuzhuagame.com | udp |
| US | 1.1.1.1:53 | sdk-ns3.jiuyao.yuzhuagame.com | udp |
| US | 1.1.1.1:53 | sdk-ns4.jiuyao.yuzhuagame.com | udp |
| US | 1.1.1.1:53 | sdkapi00.sdk.quicksdk.net | udp |
| US | 1.1.1.1:53 | sdk-ns5.jiuyao.yuzhuagame.com | udp |
| GB | 216.58.212.238:443 | tcp | |
| CN | 106.75.35.13:80 | sdkapi00.sdk.quicksdk.net | tcp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 216.58.201.110:443 | android.apis.google.com | tcp |
| CN | 180.150.189.181:88 | tcp | |
| CN | 180.150.191.127:80 | serverip.sdk.quicksdk.net | tcp |
Files
/data/data/com.hpw.ty.jiuyao/app_crashrecord/1004
| MD5 | 028cb80d69d8685c60ed51c759b7c520 |
| SHA1 | 3c77fc08e66dbdd034f4ee005a862646ac4d2827 |
| SHA256 | 4a0b4550c2757d4ea3767d09271fd3ce01dd586d431590757d959657d39bf067 |
| SHA512 | b92e78db4c2f85f536f7d93084fa79bb5d11aa06f0781a6adc8d0c79a0c9948f6e10ac897cdb987ddea9fceef2691a94d9d4cab6265e4a2c5afa5b51a2fa3c1b |
/data/data/com.hpw.ty.jiuyao/databases/bugly_db_-journal
| MD5 | 1778395ec001d6429a3faf7ec5478836 |
| SHA1 | bf397c189c16e8c53e1774451e02532c5c440027 |
| SHA256 | d3340627a26ab1cb431391e1b45f8dc26766fb7bda68c3a92ea17bc898da95bb |
| SHA512 | b8201379638b38704eb0d9a23eabde31080e8d8a13b6d28d5840db4c90b7845e778aee75aaeeafd4912b740ad3ee5f69e7b1444d2d81c11da303df541dc0defe |
/data/data/com.hpw.ty.jiuyao/databases/bugly_db_
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/com.hpw.ty.jiuyao/databases/bugly_db_-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/com.hpw.ty.jiuyao/databases/bugly_db_-wal
| MD5 | 129c9a5ba44482c25e04fbb6f8802acc |
| SHA1 | 7d042dae928289f24087530292bce8765ae4e721 |
| SHA256 | b41d77a75e9613b77b96ee7e91449ab1d49cd0bb4773c9fe6a18412f82236825 |
| SHA512 | 9b5eb5e5436447af9b9c9a28d4149380159ce1a0c58df1c641e216e49c5ccef6b5c496102c0ad4e81b6293abd0f694bec247318db990d7e7b0256d572a838b5f |
/data/data/com.hpw.ty.jiuyao/app_crashrecord/1004
| MD5 | 0d210bfb2a0e1f1b4c082a6a0f79de07 |
| SHA1 | bb8ed9e364db79d1d9f2fcde3f15091893222faa |
| SHA256 | 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d |
| SHA512 | 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1 |
/data/data/com.hpw.ty.jiuyao/databases/okhttputils_server.db-journal
| MD5 | 6003f38060f566bed65aba816f97ddc1 |
| SHA1 | d5b2226495cbcc6b9c2064260b4fdb5b77c18860 |
| SHA256 | e21607b9edd2e2db16c26fd786bb83b56285d7f7c89d1780f7e3081c13a33da7 |
| SHA512 | 2ef5b1b6bf903e9b9f7afe9689fc38af60eb14fd644b22a33308c8f480d8038cb0d3c39a3e143ea25a006ea616c41ba50ce8d0511cea1f30a39afbfa1df1d544 |
/data/data/com.hpw.ty.jiuyao/databases/okhttputils_server.db
| MD5 | 2c25d43030ce6fe8847af2055173a32d |
| SHA1 | 60a4422c903bc5956406822e5469c5f825689972 |
| SHA256 | aae7651d7e13e1b8181612cd55335938e2fbc11c89a3a81cace0e6c410d6eb1d |
| SHA512 | 0c6d97d74743d506522e92548506cb9fa8bfae2a4d2f7801d4cffefa310e01506611a127afa3df2a2ab2c770191165f2aa7074ebd042ef9b7ceceef29dd017aa |
/data/data/com.hpw.ty.jiuyao/databases/okhttputils_server.db-wal
| MD5 | 636e9ff702f5467e4569ac26f52aa9f5 |
| SHA1 | e7482ceb707759ad2c63d0f6c0e3633adf4a766a |
| SHA256 | aeda91086f0d914255f8e2fbbf4b19eefdc742862ee53cdae2850819951c6e59 |
| SHA512 | 3ed0aff9f9ce3d485393352a415db55717a97484ae417e4c883625d60d3a7b613b9b300c1ef9ec82da645493194e1f1d00034c8709b90a6162c01020a2b9a5c2 |
/storage/emulated/0/UcQkDir/qk.dvid.txt
| MD5 | c977eff5f3febaaca93c47da0a170b61 |
| SHA1 | b03b1d69282db85eca42359cb0adefecefff2890 |
| SHA256 | 2d93ebd9aef252b0ef35b38316081a73fe42ff5d218650c4c72fe7dd843b279d |
| SHA512 | 854a985a21b01e5342e5f94b6d1bc93fd098ebab4edfc16e83f20222d6b141a8770b094306a4ca105e7954d3c153b7a05f7172ce99b0f638d193a5b4b9552c4b |
/data/data/com.hpw.ty.jiuyao/cache/ACache/-1330580981
| MD5 | 6a93194c9d78da0bdc4697864717f7f0 |
| SHA1 | d2d0c0ed8c044c35c6499d594a3615aba90029c4 |
| SHA256 | e96d92bf479741fce0e1fbfa8aec638320ec4c8ccce6a3e17bedf5b93335d0b3 |
| SHA512 | 2477502f94b02f254f7a1774e0857925ae1be0060f71cda04d52f2f8dcd5c750ad5e0807a79489f4661513f373f9445797d2e60a5a8d9f7ada049ad8dba6916d |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 09:01
Reported
2024-06-13 09:04
Platform
android-x86-arm-20240611.1-en
Max time kernel
7s
Max time network
152s
Command Line
Signatures
Processes
com.zqhy.safepay
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.204.78:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.238:443 | android.apis.google.com | tcp |