Malware Analysis Report

2024-10-19 11:47

Sample ID 240615-fephnayhrc
Target acecf5177b57bff4ecc14cb69dffaf15_JaffaCakes118
SHA256 0417dacab91d18157c9d5c488a722666b4667efe4bb2859cc5102f37d67043f2
Tags
collection discovery evasion impact persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

0417dacab91d18157c9d5c488a722666b4667efe4bb2859cc5102f37d67043f2

Threat Level: Shows suspicious behavior

The file acecf5177b57bff4ecc14cb69dffaf15_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

collection discovery evasion impact persistence

Queries information about the current nearby Wi-Fi networks

Requests cell location

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries information about the current Wi-Fi connection

Requests dangerous framework permissions

Acquires the wake lock

Queries information about active data network

Reads information about phone network operator.

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks CPU information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-15 04:47

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 04:47

Reported

2024-06-15 04:50

Platform

android-x86-arm-20240611.1-en

Max time kernel

161s

Max time network

178s

Command Line

com.ekuater.labelchat

Signatures

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

com.ekuater.labelchat

com.ekuater.labelchat:core

io.rong.push

Network

Country Destination Domain Proto
GB 172.217.169.74:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 oc.umeng.com udp
CN 59.82.23.79:80 oc.umeng.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.176:80 alog.umeng.com tcp
US 1.1.1.1:53 apilocate.amap.com udp
CN 203.209.230.23:80 apilocate.amap.com tcp
US 1.1.1.1:53 oc.umeng.co udp
CN 223.109.148.141:80 alog.umeng.com tcp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 nav.cn.rong.io udp
CN 223.109.148.178:80 alog.umeng.com tcp
CN 223.109.148.179:80 alog.umeng.com tcp
US 1.1.1.1:53 apiinit.amap.com udp
CN 106.11.43.113:80 apiinit.amap.com tcp
CN 223.109.148.130:80 alog.umeng.com tcp
CN 223.109.148.177:80 alog.umeng.com tcp
US 1.1.1.1:53 alog.umeng.co udp
CN 203.209.230.23:80 apilocate.amap.com tcp
US 1.1.1.1:53 apilocate.amap.com udp
CN 203.209.230.23:80 apilocate.amap.com tcp

Files

/data/data/com.ekuater.labelchat/databases/settings.db-journal

MD5 1494493137146bc1da8e7b80ad9b5b72
SHA1 5b055baaa923375c456c41d58afe425065321c27
SHA256 843425482ab070834cec70a5587026f3a63cea98fd28c9658b9f3663f22ef504
SHA512 56cf435d2295c6cb7584b5d2bc4df844fc0cfe7a6cd177980b67b28c2b571a27b551bf39d39920375020eb39c89809bf0cdeaa2b38cdc33b331301e5221564d9

/data/data/com.ekuater.labelchat/databases/settings.db

MD5 4ae4c6a3fe048407bc2e7ef047448fd9
SHA1 2cafeb53dc3f302d52346505f9243aff4964df67
SHA256 45db83ebf9b4c8d0afc438aff4a27a13afd8a0897c2a41b8ce4981fe335904d0
SHA512 ebbe58d34ad6404d825b5a56c57d580652113b633986a578b271fe13e6153faf36c05e6ec16f16f2112efaa8d9e4cadcbdf8324a6071407b396722d939707e47

/data/data/com.ekuater.labelchat/databases/settings.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.ekuater.labelchat/databases/settings.db-wal

MD5 743048e5c1db85acb112fe971bafa762
SHA1 6e5e2e8f9db3347a41819b6cda19889d6c76239f
SHA256 f88d401fc81b535ad24df359ed2e6dfd142f9bffb6c4164661bbc4ab7b8dc1dd
SHA512 d53f1e58f0f24aaac409c480dd646ec6e2b41f9e45019867ec525ff891b7b15d264f7962b4ef122f2a4311486b50dd6225a5e1a9e2e84405d3b51a51b7a4ccc3

/storage/emulated/0/Android/data/com.ekuater.labelchat/cache/locationCache/journal.tmp

MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

/data/data/com.ekuater.labelchat/databases/rong_version-journal

MD5 0a7c9b811111a966814109e6d44537c9
SHA1 8f2eabe9f56d1dc31ea71a4871fa95bfc8402a47
SHA256 2619e5b7c98409a0b39dcd110f1656d93f44e45b0cdf81fb9378c33a6db61a16
SHA512 0267532a11e444365b535e3026a22488fd586fe2a9adfbf642aee1f4d2b860bb282c939ee7113f66e3af38c1e03c6148615e4d0fbe8a10658def36856453af32

/data/data/com.ekuater.labelchat/databases/rong_version

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.ekuater.labelchat/databases/rong_version-wal

MD5 2940ba710b1bb21e912c86a63b0faca2
SHA1 fb430d1014e57708bc75702751c2b26f30696b70
SHA256 ebdbba07edfcb8901e5445fe81a8d06753f072b1ee83cdb6ac3a4b00c026b906
SHA512 eb217114fa8f381283058d14a2e19330101bb61b9f21ad48073b724e511d4981e3762f40b5941057b76e2a59e858e671f8229765d114eef82cda3b3ec44eeeae

/data/data/com.ekuater.labelchat/databases/pending_chat.db-journal

MD5 8fdcb96391b356a86d1b467491cdb4dc
SHA1 528d2c4986e5ce745ab63d6689ea9a12bdfbcefc
SHA256 90c5fc6f3bbeadf9f778493bcbf12f4daad66f862870e47c3c1c18e4ac3b2538
SHA512 55856e16f4344d563b851a2c8814454db582e057e20791b843742deccafc11cd76738ad91a819ac9a091176868c2ffce0ca7b31beb32447cb523437e54d70fdf

/data/data/com.ekuater.labelchat/databases/pending_chat.db-wal

MD5 4036f6eaec0c42d3fa7844442ad169ce
SHA1 13623f28a08850819f4632d05411e6e259db6149
SHA256 5db79d1be4e376380b40b71791148b7aa1d73f6beaac5c1e5f12487573097a76
SHA512 edeebf06400e7ecb55eac6281dd3110b6b25adc65286e1ba885fd5e0562e15b6ff64d7612162350a879f2468b0f32bf2af7e3bf6f72701b7a00dccf5cc73c54c

/data/data/com.ekuater.labelchat/databases/strangers.db-journal

MD5 e11040e673d0a6d20d885d77d61d6d56
SHA1 da5bc929efcffc31cf2cdf990cbe3d92cb56b04e
SHA256 80b084e54de80b81c5fa890d268b148ddaaf7860fb72260a9926b1b4055e6a52
SHA512 fbed703c771748d35346d1ccc94474276d8d14b3a0728540da4aabc5e4369a284dfb6c19517eec177781bc726f8cfad0787806a28048fcd694b05527503a368b

/data/data/com.ekuater.labelchat/databases/strangers.db-wal

MD5 9dd386a89deb914b2cae19495aaa2a96
SHA1 eefde7d854cd86f33318c0e5f0ff47787af3facd
SHA256 09d53400bb32c0374cfe6f433c4610af4a814ba9fb2316018d3fd5fe0643906b
SHA512 ba31f078a640e8576e2eec9c2d09e308dee1668f9142778465738b27631bcc374f01d8b2a7f61d13e83b3f8982f8d68d3c32dcc6e4260c928f8d2df0420535c8

/data/data/com.ekuater.labelchat/databases/litestrangers.db-journal

MD5 5d74b21efba501e13c24e8a007506154
SHA1 b8f5b0c7af10bdfe005d15bad327d079e0f82092
SHA256 9ac86f3a5e417e23edc8e99c84a3198d8442f0d3c6d1cb11d4597b41545b7a61
SHA512 3e46e686d4f584768a0431bb4a112c5d474cbf0d6ac6aa2f7f341108cd8deb16a67af855e76cb53dbd029a9ecc0a13a88e44938de769efb7711a03b07a4f4530

/data/data/com.ekuater.labelchat/databases/litestrangers.db-wal

MD5 8da788c8611adca7508f7068ad4696b3
SHA1 ab5bc03941a9ac3a924194935c273d492ffaa38e
SHA256 395790d8095fae1949f5a5aa5c47bc63ce282769578ac4d9bc153bfaded442e3
SHA512 bb3b76f759ce76b3866d83bf724fd0189a3f4c0347c374d9f29f205269e4a9e01907fffd8402b59a3c18feda074a8c4d4359b43d3425e3fa318436700f4c48cf

/data/data/com.ekuater.labelchat/databases/follow_users.db-journal

MD5 cc2b787bcd3a9fec5a3ea34556e80147
SHA1 884422c6c082f30c1648f7819af81b8b1c509c48
SHA256 b7ef74461afdd921529ff1c658c352baa78290d2e8912f9bf2c36baa6bb424ca
SHA512 98823ff9f7b19a4ab12a9654df8bdebf919f2aae1e005c7b62dcb71826382da593c0db9e3ae01799dbcee35f4bc12e3b6720bafc8e7eb29652771da0129ffdd9

/data/data/com.ekuater.labelchat/databases/follow_users.db-wal

MD5 496b06f98870911b62d7922f8779bf32
SHA1 f58d66c814fb8bfcc2de69f4c092b24e534a4b91
SHA256 68859168b2e074e26e861bac67c0ec74745df9673621cd1965d8c058b723a2d2
SHA512 d8e3a7bfd82d897af9b51653a4227a86e015854fc74ac250acf32b5a4c1663ca8155acc69359207ab0b70e5cb23f83751cf62a3a8060f44c45c1714e5b9a0c42