Malware Analysis Report

2024-09-09 12:52

Sample ID 240614-b76v7a1amh
Target a79c793cbc09ed25249020f4218440d4_JaffaCakes118
SHA256 68a2b554d412a6b3188b96cab2a0809fa8ca25624746f7ab103772d3ec3273ba
Tags
collection discovery evasion execution impact persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

68a2b554d412a6b3188b96cab2a0809fa8ca25624746f7ab103772d3ec3273ba

Threat Level: Shows suspicious behavior

The file a79c793cbc09ed25249020f4218440d4_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

collection discovery evasion execution impact persistence

Queries information about running processes on the device

Queries information about the current nearby Wi-Fi networks

Queries the phone number (MSISDN for GSM devices)

Requests cell location

Requests dangerous framework permissions

Queries information about active data network

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

Uses Crypto APIs (Might try to encrypt user data)

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 01:48

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 01:48

Reported

2024-06-14 01:51

Platform

android-x86-arm-20240611.1-en

Max time kernel

179s

Max time network

185s

Command Line

cn.cainiaoshicai.crm

Signatures

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

cn.cainiaoshicai.crm

cn.cainiaoshicai.crm:pushcore

cn.cainiaoshicai.crm:watch

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 data.openspeech.cn udp
CN 117.48.148.47:80 data.openspeech.cn tcp
US 1.1.1.1:53 scs.openspeech.cn udp
CN 117.48.148.47:80 scs.openspeech.cn tcp
US 1.1.1.1:53 s.jpush.cn udp
CN 120.46.84.108:19000 s.jpush.cn udp
US 1.1.1.1:53 www.cainiaoshicai.cn udp
CN 39.96.80.175:443 www.cainiaoshicai.cn tcp
US 1.1.1.1:53 sis.jpush.io udp
CN 121.36.193.140:19000 sis.jpush.io udp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 123.196.118.23:19000 udp
CN 103.229.215.60:19000 udp
CN 117.121.49.100:19000 udp
US 1.1.1.1:53 im64.jpush.cn udp
CN 139.9.138.15:7003 im64.jpush.cn tcp
CN 139.9.138.15:7005 im64.jpush.cn tcp
CN 139.9.138.15:7004 im64.jpush.cn tcp
CN 139.9.138.15:7000 im64.jpush.cn tcp
GB 216.58.212.202:443 semanticlocation-pa.googleapis.com tcp
GB 216.58.212.202:443 semanticlocation-pa.googleapis.com tcp
CN 139.9.138.15:7007 im64.jpush.cn tcp
CN 139.9.138.15:7008 im64.jpush.cn tcp
CN 139.9.138.15:7009 im64.jpush.cn tcp
CN 139.9.138.15:7002 im64.jpush.cn tcp
CN 139.9.138.15:7006 im64.jpush.cn tcp
CN 120.46.84.108:19000 easytomessage.com udp
CN 121.36.193.140:19000 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 123.196.118.23:19000 udp
CN 103.229.215.60:19000 udp
CN 117.121.49.100:19000 udp
CN 139.9.138.15:7008 im64.jpush.cn tcp
CN 139.9.138.15:7002 im64.jpush.cn tcp
CN 139.9.138.15:7009 im64.jpush.cn tcp
CN 139.9.138.15:7006 im64.jpush.cn tcp
CN 139.9.138.15:7007 im64.jpush.cn tcp
CN 139.9.138.15:7005 im64.jpush.cn tcp
CN 139.9.138.15:7004 im64.jpush.cn tcp
CN 139.9.138.15:7003 im64.jpush.cn tcp
CN 139.9.138.15:7000 im64.jpush.cn tcp
CN 120.46.84.108:19000 easytomessage.com udp
CN 121.36.193.140:19000 easytomessage.com udp
CN 123.60.89.60:19000 easytomessage.com udp
CN 123.196.118.23:19000 udp
CN 103.229.215.60:19000 udp
CN 117.121.49.100:19000 udp
CN 139.9.138.15:7002 im64.jpush.cn tcp

Files

/data/data/cn.cainiaoshicai.crm/lib-main/dso_state

MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

/data/data/cn.cainiaoshicai.crm/lib-main/dso_deps

MD5 f88e6fff3b8988cbd3ba224b8348e10e
SHA1 9520eb3132a98915627f0bcb995fb7341a202c0e
SHA256 355b6702577660073d741bd609dedebe0a98d66a4c804cee9763b94ac1dc9f51
SHA512 d37c76839bec00038697a603dcccfb7474e5c059d6048ec5dce62e900af2fd60ff4899d41f4228a657c17686cdbb6a4d9368f1ce00bfe855c4e8f1021138a754

/data/data/cn.cainiaoshicai.crm/lib-main/dso_manifest

MD5 abf3560e5348dae4d123642bb14c6876
SHA1 67142c7be3a99b7a7992a4e96b90e5fbba828dcc
SHA256 744c0ab9e66691efd597ec71e0f6f133893142b3e815fad066630b83dcd503ef
SHA512 f539ee635bdb309d7e1dd9dd62bf8f6694ae52ec28935f6c6a9740f8497357759142813a2a5da893585c7e2af8ed9b45af62f402a45d2b4fbf151f0f114027cc

/data/data/cn.cainiaoshicai.crm/lib-main/dso_state

MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

/storage/emulated/0/data/.push_deviceid

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/cn.cainiaoshicai.crm/files/jpush_stat_history_pushcore/normal/nowrap/d732aa48-15e3-42bf-9a81-063d4f951aaa

MD5 8f8711a38435effc4d016d3ca20a8baf
SHA1 10929b88d33c7def7d6cbf6d75414ec26cdd741a
SHA256 723434080416a28bbf642c4eace68d64d5c1482b8bcaca69687624c1f3682d00
SHA512 43c5e82936ac0c841f42173ef7399213d9128dfdca01881615d948246ff1d8004cb7329f5e97feddeca7c57bb70d9c7beacccb5d682e8cd8d5e162ef62df3b13

/data/data/cn.cainiaoshicai.crm/files/jpush_stat_history/active_user/nowrap/a974d32d-7a39-4ee8-94f7-6654ac143ffc

MD5 8188f6830d9992356cfeb44648f65761
SHA1 5bbaaf7cfd7fa08d8407e5d0c659e4dae0b7ba2f
SHA256 032edf2de6cd2ffec7e6f49cad1043220c7d6fc82c0c864b09a08850bc0c9852
SHA512 d3a44d10ca09a1f5e1a96b4ae6e611acf3f74394127781c16ef708a9c22363924148707385b07dec081c3f50615ddbe758acf9eedd19a18a2a185de11a3fa69a

/data/data/cn.cainiaoshicai.crm/databases/RKStorage-journal

MD5 96146791e4b9781871fd2e7e97a265b7
SHA1 2b954d7a9aa1aca1c263f9c48cc944c6672f7e0e
SHA256 eb626ba106c431ff8dc76c6951e937e3cb7f72f3e4922ce113c01f3bbac0731a
SHA512 5991c6eb377e495dba434056a988b648ee54853d3c4d2d5d1d0380efa228808930b5de22d82a799f2968ca33af5e7742e64823ae3f7f63580c6f82c36c6d6c05

/data/data/cn.cainiaoshicai.crm/databases/RKStorage-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 01:48

Reported

2024-06-14 01:48

Platform

android-33-x64-arm64-20240611.1-en

Max time network

8s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
BE 142.250.110.188:5228 tcp
GB 172.217.16.228:443 tcp
N/A 224.0.0.251:5353 udp
GB 172.217.169.68:443 udp
GB 172.217.169.68:443 tcp

Files

N/A