Malware Analysis Report

2024-07-28 14:36

Sample ID 240614-afdvnaxamg
Target a73fc71559231d3250a4cfbbc8404879_JaffaCakes118
SHA256 a0d3f353e6cf1abfdfbb6ec9c743ecb5a333830878274ce77bf0668006966cf1
Tags
discovery evasion impact persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

a0d3f353e6cf1abfdfbb6ec9c743ecb5a333830878274ce77bf0668006966cf1

Threat Level: Shows suspicious behavior

The file a73fc71559231d3250a4cfbbc8404879_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion impact persistence

Loads dropped Dex/Jar

Queries information about running processes on the device

Requests dangerous framework permissions

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries information about the current Wi-Fi connection

Queries information about active data network

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 00:08

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 00:08

Reported

2024-06-14 00:12

Platform

android-x86-arm-20240611.1-en

Max time kernel

179s

Max time network

159s

Command Line

com.adeskring.music

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.adeskring.music/app_qzn/classes.jar N/A N/A
N/A /data/user/0/com.adeskring.music/app_qzn/classes.jar N/A N/A
N/A /data/user/0/com.adeskring.music/app_qzn/classes.jar N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

com.adeskring.music

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.adeskring.music/app_qzn/classes.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.adeskring.music/app_qzn/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 oc.umeng.com udp
CN 59.82.23.79:80 oc.umeng.com tcp
CN 59.82.23.79:80 oc.umeng.com tcp
US 1.1.1.1:53 service.52ring.adesk.com udp
US 1.1.1.1:53 feedback.umeng.com udp
CN 47.93.91.229:80 service.52ring.adesk.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
US 1.1.1.1:53 analytic.androidesk.com udp
CN 47.93.91.229:80 analytic.androidesk.com tcp
US 1.1.1.1:53 ms.ie2o.com udp
US 1.1.1.1:53 ms1.ie2o.com udp
US 1.1.1.1:53 ms2.ie2o.com udp
US 1.1.1.1:53 oc.umeng.co udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.206:443 android.apis.google.com tcp
CN 223.109.148.141:80 alog.umeng.com tcp
CN 223.109.148.178:80 alog.umeng.com tcp
CN 223.109.148.176:80 alog.umeng.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
CN 223.109.148.130:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umeng.co udp

Files

/data/data/com.adeskring.music/app_qzn/classes.jar

MD5 e00216c55d3ad107df8229aa1c503d3c
SHA1 9214285f38be233ae64748acb0e7dc71f5a17b5f
SHA256 7f3c75c75fb2a5e2357b70ea435f186289ca710582e2356a6b3ae58962cd4e17
SHA512 62e8c09f423585d6801b019adb84f8d25e7d827b01802fee222647afb4ad7ea835e20013d67e12f89d12ec856cd63221077308af66ee7d0c8012c0383bea38d2

/data/user/0/com.adeskring.music/app_qzn/classes.jar

MD5 3bc76749438e0d16cbb1534249f043f7
SHA1 f8792c1fdf7de0291b6f45861350e4359cd40b65
SHA256 f2a4f45a4ad20d2dea423c82bf5202d242620ce24d9a443dfd615df6668258f1
SHA512 2693907cfb8f711897ccbb265279b70bf0625eaa9fefc896e03fac964a93f5cf7014274e7023d51ef4c72e770f1326f3d8d8c1954537fc93ce0bfb54f6198e96

/data/user/0/com.adeskring.music/app_qzn/classes.jar

MD5 eb7488268bb1aed418f246e0129c68e6
SHA1 961ed5baaf5062ca6f326b7fe869085f5031897c
SHA256 bcbb9af6914ac534d5025e0ecb1f8540949e9b29ce42490d88982d0a9681f02c
SHA512 55ee61bbb02b19f9b6c14e27b3c1a4ece1bbd5f88301905abe0ee013ece3357c2596f87005f2092ffc52946e87fc9be18386fdc3bfcc119fc3ddbf334f1a6e72

/storage/emulated/0/adesk-rings/.cache/journal.tmp

MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

/data/data/com.adeskring.music/databases/dbkhq-journal

MD5 f1e9e79de55bbf4cab83bfd04039abc6
SHA1 cef3b4e4b161edc997f462e346405418bd180809
SHA256 ea15b86a4ac37615cccf3730fc84e2ff1769a5920b751afbcdffc5c64cb3ab3f
SHA512 fb568ce3d773db8e0d078a86fa368e64d6ea6a5096932b3228584eab83ceab832350961441813596696a577e365c5be14c2049fe7f120f38e6d652051493eef9

/data/data/com.adeskring.music/databases/dbkhq

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.adeskring.music/databases/dbkhq-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.adeskring.music/databases/dbkhq-wal

MD5 e15c8bfd9cfedeb5d5027931c1f9ee82
SHA1 cb18c64079183cea9aa4298c25e3b9494f07d33f
SHA256 6ea346ae1013439a5d768c15406a3b46aecdf1d843dcd59705e42fe596a2f543
SHA512 92d7c181e8b76dcd7c0e6ccd96c1bd5adb6d1b07d2a1994d0c8f70899de4811fb6a0be6019047026bf2170296e1ae6f1378045f9f11da55423b267ebe47ce7e3

/data/data/com.adeskring.music/app_qzn/oat/classes.jar.cur.prof

MD5 d0bc196a4daf1c62d4242d0cc8d443bf
SHA1 0453af42680aef2cdb8805ad42e10eb5083d3fc1
SHA256 ffb1607c85b60548ddea3413bdef8b063c0ae77f635c3ab5789f49a83a1a3ef8
SHA512 9135c0cc92f5983eb7573e40e6e08dae9f021bc3153202a7b76a368f8138e7bbd6e722e7578fa556dfe0c0ea257a5c3521e532e249866624abda41a081f0f5f5

/data/data/com.adeskring.music/files/mobclick_agent_cached_com.adeskring.music

MD5 95dcb9104de77665f9c52217957f948d
SHA1 4c07d41bb21a2c374ebb1bcc4bb9286a9abdd824
SHA256 2d21bf949cfc5ae01c163be952327f5ac79078b18b5e022b7a096847ccb6c2a0
SHA512 0ee789b3c741e8b96521e3d1514f88baa44cf5bcc0023254a89c40d1c75e4bdb78dc8ee21af486533328f70fcf5582ff2e6f5c2cfc0def6cef61d3100de9541c