Analysis Overview
SHA256
68a2b554d412a6b3188b96cab2a0809fa8ca25624746f7ab103772d3ec3273ba
Threat Level: Shows suspicious behavior
The file a79c793cbc09ed25249020f4218440d4_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Queries information about running processes on the device
Queries information about the current nearby Wi-Fi networks
Queries the phone number (MSISDN for GSM devices)
Requests cell location
Requests dangerous framework permissions
Queries information about active data network
Queries information about the current Wi-Fi connection
Reads information about phone network operator.
Registers a broadcast receiver at runtime (usually for listening for system events)
Schedules tasks to execute at a specified time
Uses Crypto APIs (Might try to encrypt user data)
Checks memory information
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-14 01:48
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-14 01:48
Reported
2024-06-14 01:51
Platform
android-x86-arm-20240611.1-en
Max time kernel
179s
Max time network
185s
Command Line
Signatures
Queries information about running processes on the device
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.getRunningAppProcesses | N/A | N/A |
| Framework service call | android.app.IActivityManager.getRunningAppProcesses | N/A | N/A |
| Framework service call | android.app.IActivityManager.getRunningAppProcesses | N/A | N/A |
Queries information about the current nearby Wi-Fi networks
| Description | Indicator | Process | Target |
| Framework service call | android.net.wifi.IWifiManager.getScanResults | N/A | N/A |
Queries the phone number (MSISDN for GSM devices)
Requests cell location
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getCellLocation | N/A | N/A |
Queries information about active data network
| Description | Indicator | Process | Target |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
Queries information about the current Wi-Fi connection
| Description | Indicator | Process | Target |
| Framework service call | android.net.wifi.IWifiManager.getConnectionInfo | N/A | N/A |
Reads information about phone network operator.
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Schedules tasks to execute at a specified time
| Description | Indicator | Process | Target |
| Framework service call | android.app.job.IJobScheduler.schedule | N/A | N/A |
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
cn.cainiaoshicai.crm
cn.cainiaoshicai.crm:pushcore
cn.cainiaoshicai.crm:watch
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | semanticlocation-pa.googleapis.com | udp |
| US | 1.1.1.1:53 | data.openspeech.cn | udp |
| CN | 117.48.148.47:80 | data.openspeech.cn | tcp |
| US | 1.1.1.1:53 | scs.openspeech.cn | udp |
| CN | 117.48.148.47:80 | scs.openspeech.cn | tcp |
| US | 1.1.1.1:53 | s.jpush.cn | udp |
| CN | 120.46.84.108:19000 | s.jpush.cn | udp |
| US | 1.1.1.1:53 | www.cainiaoshicai.cn | udp |
| CN | 39.96.80.175:443 | www.cainiaoshicai.cn | tcp |
| US | 1.1.1.1:53 | sis.jpush.io | udp |
| CN | 121.36.193.140:19000 | sis.jpush.io | udp |
| GB | 216.58.201.110:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.206:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | easytomessage.com | udp |
| CN | 123.60.89.60:19000 | easytomessage.com | udp |
| CN | 123.196.118.23:19000 | udp | |
| CN | 103.229.215.60:19000 | udp | |
| CN | 117.121.49.100:19000 | udp | |
| US | 1.1.1.1:53 | im64.jpush.cn | udp |
| CN | 139.9.138.15:7003 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7005 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7004 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7000 | im64.jpush.cn | tcp |
| GB | 216.58.212.202:443 | semanticlocation-pa.googleapis.com | tcp |
| GB | 216.58.212.202:443 | semanticlocation-pa.googleapis.com | tcp |
| CN | 139.9.138.15:7007 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7008 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7009 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7002 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7006 | im64.jpush.cn | tcp |
| CN | 120.46.84.108:19000 | easytomessage.com | udp |
| CN | 121.36.193.140:19000 | easytomessage.com | udp |
| CN | 123.60.89.60:19000 | easytomessage.com | udp |
| CN | 123.196.118.23:19000 | udp | |
| CN | 103.229.215.60:19000 | udp | |
| CN | 117.121.49.100:19000 | udp | |
| CN | 139.9.138.15:7008 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7002 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7009 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7006 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7007 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7005 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7004 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7003 | im64.jpush.cn | tcp |
| CN | 139.9.138.15:7000 | im64.jpush.cn | tcp |
| CN | 120.46.84.108:19000 | easytomessage.com | udp |
| CN | 121.36.193.140:19000 | easytomessage.com | udp |
| CN | 123.60.89.60:19000 | easytomessage.com | udp |
| CN | 123.196.118.23:19000 | udp | |
| CN | 103.229.215.60:19000 | udp | |
| CN | 117.121.49.100:19000 | udp | |
| CN | 139.9.138.15:7002 | im64.jpush.cn | tcp |
Files
/data/data/cn.cainiaoshicai.crm/lib-main/dso_state
| MD5 | 93b885adfe0da089cdf634904fd59f71 |
| SHA1 | 5ba93c9db0cff93f52b521d7420e43f6eda2784f |
| SHA256 | 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d |
| SHA512 | b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee |
/data/data/cn.cainiaoshicai.crm/lib-main/dso_deps
| MD5 | f88e6fff3b8988cbd3ba224b8348e10e |
| SHA1 | 9520eb3132a98915627f0bcb995fb7341a202c0e |
| SHA256 | 355b6702577660073d741bd609dedebe0a98d66a4c804cee9763b94ac1dc9f51 |
| SHA512 | d37c76839bec00038697a603dcccfb7474e5c059d6048ec5dce62e900af2fd60ff4899d41f4228a657c17686cdbb6a4d9368f1ce00bfe855c4e8f1021138a754 |
/data/data/cn.cainiaoshicai.crm/lib-main/dso_manifest
| MD5 | abf3560e5348dae4d123642bb14c6876 |
| SHA1 | 67142c7be3a99b7a7992a4e96b90e5fbba828dcc |
| SHA256 | 744c0ab9e66691efd597ec71e0f6f133893142b3e815fad066630b83dcd503ef |
| SHA512 | f539ee635bdb309d7e1dd9dd62bf8f6694ae52ec28935f6c6a9740f8497357759142813a2a5da893585c7e2af8ed9b45af62f402a45d2b4fbf151f0f114027cc |
/data/data/cn.cainiaoshicai.crm/lib-main/dso_state
| MD5 | 55a54008ad1ba589aa210d2629c1df41 |
| SHA1 | bf8b4530d8d246dd74ac53a13471bba17941dff7 |
| SHA256 | 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a |
| SHA512 | 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339 |
/storage/emulated/0/data/.push_deviceid
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/cn.cainiaoshicai.crm/files/jpush_stat_history_pushcore/normal/nowrap/d732aa48-15e3-42bf-9a81-063d4f951aaa
| MD5 | 8f8711a38435effc4d016d3ca20a8baf |
| SHA1 | 10929b88d33c7def7d6cbf6d75414ec26cdd741a |
| SHA256 | 723434080416a28bbf642c4eace68d64d5c1482b8bcaca69687624c1f3682d00 |
| SHA512 | 43c5e82936ac0c841f42173ef7399213d9128dfdca01881615d948246ff1d8004cb7329f5e97feddeca7c57bb70d9c7beacccb5d682e8cd8d5e162ef62df3b13 |
/data/data/cn.cainiaoshicai.crm/files/jpush_stat_history/active_user/nowrap/a974d32d-7a39-4ee8-94f7-6654ac143ffc
| MD5 | 8188f6830d9992356cfeb44648f65761 |
| SHA1 | 5bbaaf7cfd7fa08d8407e5d0c659e4dae0b7ba2f |
| SHA256 | 032edf2de6cd2ffec7e6f49cad1043220c7d6fc82c0c864b09a08850bc0c9852 |
| SHA512 | d3a44d10ca09a1f5e1a96b4ae6e611acf3f74394127781c16ef708a9c22363924148707385b07dec081c3f50615ddbe758acf9eedd19a18a2a185de11a3fa69a |
/data/data/cn.cainiaoshicai.crm/databases/RKStorage-journal
| MD5 | 96146791e4b9781871fd2e7e97a265b7 |
| SHA1 | 2b954d7a9aa1aca1c263f9c48cc944c6672f7e0e |
| SHA256 | eb626ba106c431ff8dc76c6951e937e3cb7f72f3e4922ce113c01f3bbac0731a |
| SHA512 | 5991c6eb377e495dba434056a988b648ee54853d3c4d2d5d1d0380efa228808930b5de22d82a799f2968ca33af5e7742e64823ae3f7f63580c6f82c36c6d6c05 |
/data/data/cn.cainiaoshicai.crm/databases/RKStorage-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-14 01:48
Reported
2024-06-14 01:48
Platform
android-33-x64-arm64-20240611.1-en
Max time network
8s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| BE | 142.250.110.188:5228 | tcp | |
| GB | 172.217.16.228:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 172.217.169.68:443 | udp | |
| GB | 172.217.169.68:443 | tcp |