Malware Analysis Report

2024-09-09 12:52

Sample ID 240614-fwj99szfmq
Target a81dfe05dece00e06ef0608c5319d6fa_JaffaCakes118
SHA256 324f8c5efc58116b27f66c7a2a6fc005e5ad95456d33722064ff22b743e1687a
Tags
banker collection discovery evasion impact persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

324f8c5efc58116b27f66c7a2a6fc005e5ad95456d33722064ff22b743e1687a

Threat Level: Shows suspicious behavior

The file a81dfe05dece00e06ef0608c5319d6fa_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

banker collection discovery evasion impact persistence

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Requests cell location

Reads the content of the SMS messages.

Loads dropped Dex/Jar

Reads the content of SMS inbox messages.

Requests dangerous framework permissions

Queries the mobile country code (MCC)

Queries information about active data network

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 05:13

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 05:13

Reported

2024-06-14 05:16

Platform

android-x86-arm-20240611.1-en

Max time kernel

16s

Max time network

175s

Command Line

com.llk.kxmbxy

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.llk.kxmbxy/files/cua/tpDLoRRNZw.jar N/A N/A
N/A /data/user/0/com.llk.kxmbxy/files/Pdd.apk N/A N/A
N/A /data/user/0/com.llk.kxmbxy/app_dex/utopay.jar N/A N/A
N/A /data/user/0/com.llk.kxmbxy/files/yl_plugin.apk N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Reads the content of SMS inbox messages.

collection
Description Indicator Process Target
URI accessed for read content://sms/inbox N/A N/A

Reads the content of the SMS messages.

collection
Description Indicator Process Target
URI accessed for read content://sms/ N/A N/A

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.llk.kxmbxy

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 app.jtmtht.com udp
US 104.155.138.21:89 app.jtmtht.com tcp
US 104.155.138.21:89 app.jtmtht.com tcp
US 104.155.138.21:89 app.jtmtht.com tcp
US 104.155.138.21:89 app.jtmtht.com tcp
US 104.155.138.21:89 app.jtmtht.com tcp
US 104.155.138.21:89 app.jtmtht.com tcp
CN 120.55.89.238:8977 tcp
US 1.1.1.1:53 sdk.qipagame.cn udp
US 1.1.1.1:53 jx.hamofo.com udp
US 1.1.1.1:53 xiafa.hamofo.com udp
US 1.1.1.1:53 vpay.api.eerichina.com udp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
CN 120.55.89.238:8977 tcp
US 1.1.1.1:53 passport.migu.cn udp
US 1.1.1.1:53 zyin.bjmcmj.cn udp
CN 120.55.89.238:8977 tcp
CN 112.25.126.116:80 passport.migu.cn tcp
CN 120.55.89.238:8977 tcp
CN 112.25.126.116:80 passport.migu.cn tcp
CN 120.55.89.238:8977 tcp
CN 112.25.126.116:80 passport.migu.cn tcp
CN 120.55.89.238:8977 tcp
CN 112.25.126.116:80 passport.migu.cn tcp
CN 116.62.54.183:9004 tcp
CN 115.159.152.136:8090 tcp
US 104.155.138.21:89 app.jtmtht.com tcp
CN 116.62.54.183:9004 tcp
US 1.1.1.1:53 v3.utopay.cn udp
CN 120.55.89.238:8977 tcp
CN 112.25.126.116:80 passport.migu.cn tcp
US 1.1.1.1:53 log1.ilast.cc udp
CN 120.55.89.238:8977 tcp
CN 112.25.126.116:80 passport.migu.cn tcp
US 44.221.84.105:80 log1.ilast.cc tcp
CN 116.62.54.183:9004 tcp
US 104.155.138.21:89 app.jtmtht.com tcp
CN 116.62.54.183:9004 tcp
CN 115.159.152.136:8090 tcp
CN 120.55.89.238:8977 tcp
CN 112.25.126.116:80 passport.migu.cn tcp
US 44.221.84.105:80 log1.ilast.cc tcp
US 104.155.138.21:89 app.jtmtht.com tcp
CN 115.159.152.136:8090 tcp
CN 116.62.54.183:9004 tcp
US 104.155.138.21:89 app.jtmtht.com tcp

Files

/data/data/com.llk.kxmbxy/files/cua/tpDLoRRNZw.jar

MD5 5932f3445878c3c53c978508d81cb259
SHA1 85739585c1fd59c4fb89fd443d24cd83242904d6
SHA256 0630203fdb15cc5f786b00c8d1fbc027e47d90e3b6ceef1d72b47cb04d92f72d
SHA512 ef80baaf514e10b98a3e6b94fdfefb3d58a4cc6bb17d8394e771bd43e5b41aaa6647b6e5104db7e9caa934d75fe442c93f8dfa5cb5e0ffc430bd037a45901892

/data/user/0/com.llk.kxmbxy/files/cua/tpDLoRRNZw.jar

MD5 5198d7149fea3a3658fe78de729743d7
SHA1 31b88bf4fbd4773dd38738acef666aceee43195d
SHA256 4eb39771f7cc3865d97e151a66ae434661dcf7025f706405fd27f673b736ba6a
SHA512 6a19f847bb8d2acc5621c5fe2ff1ffae8d031c261620ed3cbb5eae472638388baecbdbeac3ff9720ec44d1b870d2f0fd7bef78fee9431f6178df7f5b44a6230b

/data/data/com.llk.kxmbxy/files/Pdd.apk

MD5 e8fbf92c750dbd6fb316be82a6b7b7ae
SHA1 2a6ae9568698807cacc8cf4349556446c996b136
SHA256 2a3cb93d0ca14a1d0b0820c2a26df502a461fb2546ef4587524087c130553f10
SHA512 7848191878b5b8ba2d5020c7be953e70ccc4d392d29e400a65a57cd3731604933125de1d81b3732d251b3450fd4766a814ccd01f3975beda2499a9ba585a26e0

/data/user/0/com.llk.kxmbxy/files/Pdd.apk

MD5 a4237ef36f11c2db307f6d9701da0062
SHA1 5d11008a4b9275034db8904e538f7115a429ef0d
SHA256 32f697f7444c79efe23be55fdcdab52c8e6f5cd43474cd1735602675feb5639e
SHA512 6921b3cbb4e6a062eb9408c06e46e6d6cd7554f6e485b8f6275d8df3b7a8d23b26220c0cb979d3fe919fb6622d5d49160769b0567eebe61488cc4c7708f3b34d

/data/data/com.llk.kxmbxy/databases/wochi_v4.db-journal

MD5 56ea09c6e343f57807fc5bd4ef961cc4
SHA1 b329226d9295f485ba8819cac2553d8d644a939d
SHA256 170f41c7069ed05e906387cd07ffd528af7f51aeffe49d6033cd94b91a6ac85e
SHA512 27ea677b0a78e8baa697ad7e63a4907bceb0940fd2ccb23bdf34d7f954dddf16bd30afaf0e6b87d7138d35f4420f9c2823b820baa3209dcb0caeec331809f56b

/data/data/com.llk.kxmbxy/databases/wochi_v4.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.llk.kxmbxy/databases/wochi_v4.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.llk.kxmbxy/databases/wochi_v4.db-wal

MD5 8e9cbad4ef0050c95578209daf13a01b
SHA1 243f990e7496606af67565cc9f033edbd03f1698
SHA256 2d819a5b2f3f43509d26083bdc06e952023ade59ccec0705f08dd582c919395a
SHA512 8cec6d4873daaeeaadcb87f26ce3230e0af060b1581827be848b552ffb2a09cd7bfcd349f66d6b473973d4b998502def88c311cf7e69e4225462d8b3a8e7bb76

/data/data/com.llk.kxmbxy/app_dex/utopay.jar

MD5 eb6089c1acfa9f12535e533aebee845e
SHA1 165e39ee07dcd9ed00fc2dc1ff466bc1d6b813c9
SHA256 b825cde84e3dddfc147c71265d2259c422d51a7e56d1dcdba1321e3119b1df07
SHA512 5b1bc26bcbcf05fc331865fb4dd572b673a52650d68ab4d9b028ea15219e0d93c1ec17996953436801913388d78e25c67ea33aa93544d65e96a799eb06cc70f5

/data/user/0/com.llk.kxmbxy/app_dex/utopay.jar

MD5 5220524411d0bacd600da60814d1ee9f
SHA1 fef7210ff44e757328bc0ff7aae7bb2191cbf634
SHA256 6286a800597b845785eb664710253ebd20771737dddd5b80067e0e9d37c804b2
SHA512 b2d8af5019c176d682634747d83320e609fb6122ef850f4069a0c78c2415d242087099cf60ecb03039a9ab71902a4e3b22e9cf144de89e506991fb93280f6a5f

/data/data/com.llk.kxmbxy/files/log.dat

MD5 ff9229f8e7c92d44d48e25206d43b021
SHA1 be3d75050c16c5b7484652ba292fdd6510f205d3
SHA256 77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2
SHA512 be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58

/data/data/com.llk.kxmbxy/files/yl_plugin.apk

MD5 5a4c666b43ee7f2b6995aaf3527e4a4d
SHA1 b205bcb022797f3b16635db139c7524c0c388adc
SHA256 05eb3e1ca331b8c6a1f60f92abb2bddbac54a7b2c229ac07bf26c756297fe72a
SHA512 c84fceddbf9928110fc3b85e0989b9cedd06383007ff99dea5a25096d8f892ab52d30ed9b52b72211449041f1274ead85bb42929ec269b58b6b0e616a8545e17

/data/user/0/com.llk.kxmbxy/files/yl_plugin.apk

MD5 918890b3fc5a3dc184a57d027ead24da
SHA1 c638f375f49bc4731b633bdc001aeeadf9462039
SHA256 57d03ac2189851d5069515da6997e12ca307c145aa21679da001477df5f81836
SHA512 fd9bfe41ce4041dc8c7db17df2a2164a24ea96372c212399c499f94d1fb7d95d430b8a7eb86041b9b2db88dfca0cf39e53cba2dad1e346aebed29e4ca5deb2ef

/data/data/com.llk.kxmbxy/databases/740410100062013-journal

MD5 b500ac00d2e1867e81adad3dd39a7da3
SHA1 a1b76d02eb4dbda21825616df56fd382d1f34906
SHA256 f5726c1066cc6b7342da47a65584910c928e1093d35e9283778fb75ad95fc55a
SHA512 f0f06a4e8d52d27072471c378fb24ad27ba654b4ea95c4f3253a71b36236abb03aac16d66f47ba604d9908557fe0d64f411bd48af2bc5d66afa69e0f9f18699e

/data/data/com.llk.kxmbxy/databases/740410100062013-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/com.llk.kxmbxy/databases/740410100062013-wal

MD5 84dbaa6254f76bd5acaad2904d3eec50
SHA1 88023a5ef4f1774acf2782d7626607243bbfbd92
SHA256 103e173bf06eb32d02aca160b12bd04ac8873a8f201be14c6ad7f3682f394aae
SHA512 973105787a853daf1ba876d8a22b9cd00b79b2b38ac783779729a487b39dddd654817777c0cfc9fd96b47256a1a628a769ed119120f650d3ecc6b05ff1e28c8e