Malware Analysis Report

2024-07-28 14:33

Sample ID 240613-q5pw8awaql
Target a5e00b16d26012ab1221d4a63cbaa287_JaffaCakes118
SHA256 504e7d85f6128d40beabc873eedb957eac9ed2ad0d5c67780125e97e4c959af4
Tags
discovery
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

504e7d85f6128d40beabc873eedb957eac9ed2ad0d5c67780125e97e4c959af4

Threat Level: Shows suspicious behavior

The file a5e00b16d26012ab1221d4a63cbaa287_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery

Requests dangerous framework permissions

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries information about active data network

Queries information about the current Wi-Fi connection

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 13:50

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 13:50

Reported

2024-06-13 13:54

Platform

android-x86-arm-20240611.1-en

Max time kernel

63s

Max time network

143s

Command Line

me.drakeet.inmessage

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

me.drakeet.inmessage

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 oc.umeng.com udp
CN 59.82.23.79:80 oc.umeng.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
CN 223.109.148.130:80 alog.umeng.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umeng.co udp

Files

/data/data/me.drakeet.inmessage/files/umeng_it.cache

MD5 158cffad13afd0432eaed70815641c52
SHA1 7a6fc2072b793e2a6cee8e6353f847336946adcc
SHA256 16b3b9de4894e4f3a16b7f451ced30e9b8ea60ce097d5276f48e7440601895de
SHA512 5e64d83ad2909edb74b9fdd4644ced874f9c6e25df56fdc9170ee136da00fd70ee2dbad5670dde9f2335710175880a19d2457ff41d3d762f30e6b214ad3ecd01

/data/data/me.drakeet.inmessage/databases/messageDatabase.db-journal

MD5 6c02259458b8e5f91df6a00440f2045e
SHA1 a80318e2d0f3f8360db8981645e563321c4767d4
SHA256 4497561728ba9c1d3c5eee9ebe440337a5e42a8908d01f8cc68b49dd2ff83ab4
SHA512 f36b7feda01997fb671cdb7721e498201e8dd490f79dc635bcad8fe900c7083e4b4e8a7bfc4c9b277632e387f191859d988542d29a1e9a3e398e9aee7d6e7a08

/data/data/me.drakeet.inmessage/databases/messageDatabase.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/me.drakeet.inmessage/databases/messageDatabase.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/me.drakeet.inmessage/databases/messageDatabase.db-wal

MD5 419144a9f332f2e7787eff98b5b6d490
SHA1 2493e74db53fe8280576a98248bb51c4ee245f8a
SHA256 7bcdec101f659e5060485f25dc76ee76fb47a8a00d9877a68593668238d485e7
SHA512 c5fe5ae4a5219c396b6d0362d9e9a8ca4720bad25b49666c0f32b648a5938329351f07c953bfa16803827100f1e0cb4308b94249ec23863285917c0ce6ee0cd4

/data/data/me.drakeet.inmessage/files/.um/um_cache_1718286726472.env

MD5 ca8bae4513d5ed61cd751d054bff8510
SHA1 ff4ea3ff6c90decf32130db6272ca8b3020bcef2
SHA256 53c89fcbbaa0ee5fe7dcf4ac76094b311f3d6864d1423a9ec96c7983e8e64dc5
SHA512 7e951f7c6f63b586f28939d86511f4082e3521b8edbf6347b8319346d3c2aaeae5144b2f12e3a1431e9d712fbe2c1c1632ee90fb19254162cc843ef5516f99be

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:50

Reported

2024-06-13 13:54

Platform

android-x64-20240611.1-en

Max time kernel

64s

Max time network

137s

Command Line

me.drakeet.inmessage

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Reads information about phone network operator.

discovery

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

me.drakeet.inmessage

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 oc.umeng.com udp
CN 59.82.23.79:80 oc.umeng.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.176:80 alog.umeng.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 142.250.200.10:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 223.109.148.177:80 alog.umeng.com tcp
CN 223.109.148.130:80 alog.umeng.com tcp
GB 172.217.169.68:443 tcp
GB 172.217.169.68:443 tcp
CN 223.109.148.141:80 alog.umeng.com tcp
GB 142.250.200.46:443 tcp
CN 223.109.148.178:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umeng.co udp
GB 216.58.212.238:443 tcp
GB 142.250.200.2:443 tcp

Files

/data/data/me.drakeet.inmessage/files/umeng_it.cache

MD5 03ac2b5be741f0df43ced38e33a59002
SHA1 35e0d9617dd314101501a96f8b6d61e06226ee2b
SHA256 a467e03213d1e98037bdfbdab4da67370d4d585c24a8604a8e6c089a1e8a937c
SHA512 1220f65f18360edceff2eb4721e0f8b06f176327ea76e209639854868a6c48cdfe098fee66b030de7915dd2bacaf33d5a31c41a047d93b7478dcff53f20bfc9d

/data/data/me.drakeet.inmessage/databases/messageDatabase.db-journal

MD5 f4e0e756ca80ca6ecca46897579031e2
SHA1 c60302f3446fbdedc923af817e4ff8a7b25bd1e0
SHA256 13614af91c75be1036cd98d21907e4c6103385c1bf7f685c51cbee88255fb5b6
SHA512 ada2f01b3944e05107a788359f51f54225b302bdfdc94671915d958e778a3796f723ebd7219611b9714af3c5aa1c4ba428945640a96b41ba606b9379ba004b49

/data/data/me.drakeet.inmessage/databases/messageDatabase.db

MD5 f06126e7420e8e88dc8a60567d421fff
SHA1 d15b576d2a1902ef79a182903fd4d2b1819db935
SHA256 9ff971e4e865639899f54bedd523cf75c2916403cc572cd422d3adffdf4d1447
SHA512 2d3de23042d9a668ab75f5f868e416bf574b3438cbeb84084d43b612e62d0f0d8549f540f8306fede57b63fd04ac80fb2f8d4f8278ea26e3be70c5121be5e58e

/data/data/me.drakeet.inmessage/databases/messageDatabase.db-journal

MD5 5f4ce4c5f1d12848c59512218922d7d3
SHA1 2182e1f075a74943b9a3b02869bcee930c25cd95
SHA256 2da624f54cec12f33d19737119e00b44327a40523a8bc679a41a781844b9068f
SHA512 51c05c0bf3a7180c4fb6ec351783c15d3919c7fc0fe1dbcc6ce0f6ba42f515faa28b8c7795333e85e6b68cc291a8b3b7dedfd14fb354890eb348db5a62135d55

/data/data/me.drakeet.inmessage/databases/messageDatabase.db-journal

MD5 b55cb02258fb8a5a5a081d7bc3789231
SHA1 c8c0ed274c902dcb7c5445fa6904b892b0956bcf
SHA256 b889ca73194d918e58edc0ab3a710ba693fa377ab86a9e01a28d92ad02d56a6f
SHA512 d13babb2f5e3d0a248047a1d5a3592c2363db6699e831f06f1e2cd86f8b5db20fad6680a6f6a649574e1eec302e3b01c03ec1e0c82bf07ebbe2af89a5d4ab5f5

/data/data/me.drakeet.inmessage/files/.um/um_cache_1718286726352.env

MD5 fbb87d77db4d15333bb62e0af98ec7a0
SHA1 fa73460ab225bb29587d11dd0450bb0d8aa96ac6
SHA256 5d4351c149da919103f9d400d30b90800f00cd7c9ff52838c72b035a9d80875a
SHA512 aa602efe55eafa30e2f5e611295f6f5a254f3e8f9d8663a9f49abedbfff6c28a7c048121239a3c950ab954425f9bc4b1017ad9a96a3b75503e23dc87b573a510

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-13 13:50

Reported

2024-06-13 13:54

Platform

android-x64-arm64-20240611.1-en

Max time kernel

63s

Max time network

132s

Command Line

me.drakeet.inmessage

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

me.drakeet.inmessage

Network

Country Destination Domain Proto
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 oc.umeng.com udp
CN 59.82.23.79:80 oc.umeng.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.141:80 alog.umeng.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.180.8:443 ssl.google-analytics.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
GB 216.58.212.196:443 tcp
GB 216.58.212.196:443 tcp
CN 223.109.148.130:80 alog.umeng.com tcp
CN 223.109.148.177:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umeng.co udp

Files

/data/user/0/me.drakeet.inmessage/files/umeng_it.cache

MD5 e92382faef212c83aa7d55e790465e05
SHA1 34c6cf5c034758a2aacfdfdd926846076aacbe86
SHA256 43154fc6a3a5d3dfd3e121070da0339968e40f3498a8306db0457e4bad36eaf9
SHA512 d4ae473c885a33a2535c7c577fd324b3c0fd3db25568e0bce823da686a9b3030d9bee4d6be0c9532e7f4ae0924bc2ce4ac2a1054307d268fbff1de65ff62ee32

/data/user/0/me.drakeet.inmessage/databases/messageDatabase.db-journal

MD5 5bea4b31ec37c984893792942e9c4896
SHA1 1a6f945368dcbb9c51029b85fd05501d3893782b
SHA256 a56e3601965a9276a0f57fe4900772df04b0ff14577ec3599f9237dffe0b55cf
SHA512 48f11e77d99f012d5803732330416f1ac9383e2aba1a6c742da8eda08f2b057bdafaf07bd53b0cd522ce4015beec95bbe8ad3b0b9dcd617acd2bd3722b2fe937

/data/user/0/me.drakeet.inmessage/databases/messageDatabase.db

MD5 ad8ba28db36fce0a7da66dad483d9848
SHA1 9a781a271421dc885968bd9e141373925d69b4fa
SHA256 f83c440936fa917cdcb08c52b1f5fe0e74b90884e31362ed7e7ac13cd4e99558
SHA512 5b9ae0c71bc35b49ce88eb4397f838db5011fa567e75e5986024a67cb2aec0cea9f7fc52b6e8af918cc3cbb46287e4353f5b8f5d26ce12b4b1bf2addaa63da8f

/data/user/0/me.drakeet.inmessage/databases/messageDatabase.db-journal

MD5 2611c5915558dee7abe9e26eb6605995
SHA1 29db3ab4e59bb1a3fd3b75c4fcdac5bb6091e558
SHA256 cb3118406dca4784201c0bc77e4d0c7723ad1b061bf51d652452e51a5e34fa86
SHA512 1663881dc94284d875755651aaae3d4e7cae2624e87a799a1bdbae975634fde26cffa661acb506dccdf1a46992b73cf3df455dfc826ce5de83e7a333b1dc0444

/data/user/0/me.drakeet.inmessage/databases/messageDatabase.db-journal

MD5 4ad9b9fd70570e1d0dad2f1d5e6976f3
SHA1 4d73475c8a040eb5e071fcb0e515b4bd7dbddb26
SHA256 aa7de1c551d94edfc91c4efa77c69566edc12c5f9b9c13803bc3814fd1454f48
SHA512 25b63b47fe72f2528c939b1937b9743bb2bac38f9111421cff998bca0598bd1950c01f3dfd362908127e0cfb8ce6426a8c39a5ea23be32c3b927dead237dc74f

/data/user/0/me.drakeet.inmessage/files/.um/um_cache_1718286726483.env

MD5 a0fe1d54d90755d9bf894edff6f80376
SHA1 cac85d236022ffd74de50795444a4d65953755d3
SHA256 2a419e125a8868116314ab46e5c3591df02a10d22ef33f69745af01dbd101ce4
SHA512 6a7eb3fca7f3c055126cdf5b12e31544b026e605f7cca3b23b9aceef27a3a6e882ea42182ed29abee868fee5503f2fcab93b30d248e75c80af6f6009767bddef