Analysis Overview

score

8^/10

SHA256

4f031c0d671d1f1fefbc9c9fe87f6fc6b36bc9aefd89f8535127b3b16728c78b

Threat Level: Likely malicious

The file a54358ba4dac43d5278f021212795349_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion impact persistence

Checks if the Android device is rooted.

Requests dangerous framework permissions

Queries information about active data network

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 11:20

Signatures

Requests dangerous framework permissions

Description	Indicator	Process	Target
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE	N/A	N/A
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION	N/A	N/A
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION	N/A	N/A
Required to be able to access the camera device.	android.permission.CAMERA	N/A	N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE	N/A	N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE	N/A	N/A
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES	N/A	N/A
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE	N/A	N/A
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 11:20

Reported

2024-06-13 11:24

Platform

android-x86-arm-20240611.1-en

Max time kernel

17s

Max time network

131s

Command Line

com.nari.gzevc

Signatures

Checks if the Android device is rooted.

evasion

Description	Indicator	Process	Target
N/A	/sbin/su	N/A	N/A
N/A	/system/app/Superuser.apk	N/A	N/A

Queries information about active data network

discovery

Description	Indicator	Process	Target
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	N/A	N/A

Queries information about the current Wi-Fi connection

discovery

Description	Indicator	Process	Target
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	N/A	N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.registerReceiver	N/A	N/A

Uses Crypto APIs (Might try to encrypt user data)

impact

Description	Indicator	Process	Target
Framework API call	javax.crypto.Cipher.doFinal	N/A	N/A

Checks memory information

Description	Indicator	Process	Target
File opened for read	/proc/meminfo	N/A	N/A

Processes

com.nari.gzevc

/system/bin/sh -c type su

logcat -d -v threadtime

/system/bin/sh -c getprop ro.miui.ui.version.name

getprop ro.miui.ui.version.name

/system/bin/sh -c getprop ro.build.version.emui

getprop ro.build.version.emui

/system/bin/sh -c getprop ro.lenovo.series

getprop ro.lenovo.series

/system/bin/sh -c getprop ro.build.nubia.rom.name

getprop ro.build.nubia.rom.name

/system/bin/sh -c getprop ro.meizu.product.model

getprop ro.meizu.product.model

/system/bin/sh -c getprop ro.build.version.opporom

getprop ro.build.version.opporom

/system/bin/sh -c getprop ro.vivo.os.build.display.id

getprop ro.vivo.os.build.display.id

/system/bin/sh -c getprop ro.aa.romver

getprop ro.aa.romver

/system/bin/sh -c getprop ro.lewa.version

getprop ro.lewa.version

/system/bin/sh -c getprop ro.gn.gnromvernumber

getprop ro.gn.gnromvernumber

/system/bin/sh -c getprop ro.build.tyd.kbstyle_version

getprop ro.build.tyd.kbstyle_version

/system/bin/sh -c getprop ro.build.fingerprint

getprop ro.build.fingerprint

/system/bin/sh -c getprop ro.build.rom.id

getprop ro.build.rom.id

Network

Country	Destination	Domain	Proto
GB	172.217.169.74:443		tcp
N/A	224.0.0.251:5353		udp
US	1.1.1.1:53	android.bugly.qq.com	udp
CN	14.22.7.140:80	android.bugly.qq.com	tcp
GB	142.250.187.238:443		tcp
US	1.1.1.1:53	android.apis.google.com	udp
GB	172.217.16.238:443	android.apis.google.com	tcp
GB	172.217.169.74:443		tcp
GB	172.217.169.74:443		tcp

Files

/data/data/com.nari.gzevc/databases/bugly_db_legu-journal

MD5	8065ae3a10dad35b32b2780267c18211
SHA1	436a68be5af18f686b80e93910f5708973bd657b
SHA256	2a5dd50a79fd4e893df643bf4a75ae31a85c1cedca6aa9ce05f2d66dce5bbcbd
SHA512	f6579237fdf69b1adfe5b66963f81ce282c202dc35732a067c14ab466f29ad9a693da30de3d343185f5d09d9b37f84dc2c2f6afb6c34fa7259a4fe788ea64bca

/data/data/com.nari.gzevc/databases/bugly_db_legu

MD5	f2b4b0190b9f384ca885f0c8c9b14700
SHA1	934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256	0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512	ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.nari.gzevc/databases/bugly_db_legu-shm

MD5	bb7df04e1b0a2570657527a7e108ae23
SHA1	5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256	c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512	768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.nari.gzevc/databases/bugly_db_legu-wal

MD5	2a1f877947173de365370ddcd0a994ee
SHA1	6f6a329ac878d93a3d2b50a6851e3d7ced9c9463
SHA256	b53419f209f78117726c0a2c93283da64a16a51ef69f530460a8ff5b0e50e8dd
SHA512	477d9624007f499a09a9e321fb62a315d76f8ebde6e2676894f8394541d8f8c32fffd20dadbfed8de8a4235467cfddd68d4b2f938be77d9d90291ed6e309ffed

Malware Analysis Report

2024-07-28 14:40

Table of Contents