Analysis Overview
SHA256
0417dacab91d18157c9d5c488a722666b4667efe4bb2859cc5102f37d67043f2
Threat Level: Shows suspicious behavior
The file acecf5177b57bff4ecc14cb69dffaf15_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Queries information about the current nearby Wi-Fi networks
Requests cell location
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
Queries information about the current Wi-Fi connection
Requests dangerous framework permissions
Acquires the wake lock
Queries information about active data network
Reads information about phone network operator.
Registers a broadcast receiver at runtime (usually for listening for system events)
Uses Crypto APIs (Might try to encrypt user data)
Checks CPU information
MITRE ATT&CK
Mobile Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-15 04:47
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-15 04:47
Reported
2024-06-15 04:50
Platform
android-x86-arm-20240611.1-en
Max time kernel
161s
Max time network
178s
Command Line
Signatures
Queries information about the current nearby Wi-Fi networks
| Description | Indicator | Process | Target |
| Framework service call | android.net.wifi.IWifiManager.getScanResults | N/A | N/A |
Requests cell location
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getCellLocation | N/A | N/A |
Acquires the wake lock
| Description | Indicator | Process | Target |
| Framework service call | android.os.IPowerManager.acquireWakeLock | N/A | N/A |
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
| Description | Indicator | Process | Target |
| N/A | alog.umeng.com | N/A | N/A |
Queries information about active data network
| Description | Indicator | Process | Target |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
Queries information about the current Wi-Fi connection
| Description | Indicator | Process | Target |
| Framework service call | android.net.wifi.IWifiManager.getConnectionInfo | N/A | N/A |
| Framework service call | android.net.wifi.IWifiManager.getConnectionInfo | N/A | N/A |
Reads information about phone network operator.
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Processes
com.ekuater.labelchat
com.ekuater.labelchat:core
io.rong.push
Network
| Country | Destination | Domain | Proto |
| GB | 172.217.169.74:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | oc.umeng.com | udp |
| CN | 59.82.23.79:80 | oc.umeng.com | tcp |
| US | 1.1.1.1:53 | alog.umeng.com | udp |
| CN | 223.109.148.176:80 | alog.umeng.com | tcp |
| US | 1.1.1.1:53 | apilocate.amap.com | udp |
| CN | 203.209.230.23:80 | apilocate.amap.com | tcp |
| US | 1.1.1.1:53 | oc.umeng.co | udp |
| CN | 223.109.148.141:80 | alog.umeng.com | tcp |
| GB | 142.250.187.238:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 172.217.16.238:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | nav.cn.rong.io | udp |
| CN | 223.109.148.178:80 | alog.umeng.com | tcp |
| CN | 223.109.148.179:80 | alog.umeng.com | tcp |
| US | 1.1.1.1:53 | apiinit.amap.com | udp |
| CN | 106.11.43.113:80 | apiinit.amap.com | tcp |
| CN | 223.109.148.130:80 | alog.umeng.com | tcp |
| CN | 223.109.148.177:80 | alog.umeng.com | tcp |
| US | 1.1.1.1:53 | alog.umeng.co | udp |
| CN | 203.209.230.23:80 | apilocate.amap.com | tcp |
| US | 1.1.1.1:53 | apilocate.amap.com | udp |
| CN | 203.209.230.23:80 | apilocate.amap.com | tcp |
Files
/data/data/com.ekuater.labelchat/databases/settings.db-journal
| MD5 | 1494493137146bc1da8e7b80ad9b5b72 |
| SHA1 | 5b055baaa923375c456c41d58afe425065321c27 |
| SHA256 | 843425482ab070834cec70a5587026f3a63cea98fd28c9658b9f3663f22ef504 |
| SHA512 | 56cf435d2295c6cb7584b5d2bc4df844fc0cfe7a6cd177980b67b28c2b571a27b551bf39d39920375020eb39c89809bf0cdeaa2b38cdc33b331301e5221564d9 |
/data/data/com.ekuater.labelchat/databases/settings.db
| MD5 | 4ae4c6a3fe048407bc2e7ef047448fd9 |
| SHA1 | 2cafeb53dc3f302d52346505f9243aff4964df67 |
| SHA256 | 45db83ebf9b4c8d0afc438aff4a27a13afd8a0897c2a41b8ce4981fe335904d0 |
| SHA512 | ebbe58d34ad6404d825b5a56c57d580652113b633986a578b271fe13e6153faf36c05e6ec16f16f2112efaa8d9e4cadcbdf8324a6071407b396722d939707e47 |
/data/data/com.ekuater.labelchat/databases/settings.db-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/com.ekuater.labelchat/databases/settings.db-wal
| MD5 | 743048e5c1db85acb112fe971bafa762 |
| SHA1 | 6e5e2e8f9db3347a41819b6cda19889d6c76239f |
| SHA256 | f88d401fc81b535ad24df359ed2e6dfd142f9bffb6c4164661bbc4ab7b8dc1dd |
| SHA512 | d53f1e58f0f24aaac409c480dd646ec6e2b41f9e45019867ec525ff891b7b15d264f7962b4ef122f2a4311486b50dd6225a5e1a9e2e84405d3b51a51b7a4ccc3 |
/storage/emulated/0/Android/data/com.ekuater.labelchat/cache/locationCache/journal.tmp
| MD5 | 8c92de9ce46d41a22f3b20f77404cc1d |
| SHA1 | 8671a6dca00edb72be47363a7071be65cf270373 |
| SHA256 | 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274 |
| SHA512 | 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56 |
/data/data/com.ekuater.labelchat/databases/rong_version-journal
| MD5 | 0a7c9b811111a966814109e6d44537c9 |
| SHA1 | 8f2eabe9f56d1dc31ea71a4871fa95bfc8402a47 |
| SHA256 | 2619e5b7c98409a0b39dcd110f1656d93f44e45b0cdf81fb9378c33a6db61a16 |
| SHA512 | 0267532a11e444365b535e3026a22488fd586fe2a9adfbf642aee1f4d2b860bb282c939ee7113f66e3af38c1e03c6148615e4d0fbe8a10658def36856453af32 |
/data/data/com.ekuater.labelchat/databases/rong_version
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/com.ekuater.labelchat/databases/rong_version-wal
| MD5 | 2940ba710b1bb21e912c86a63b0faca2 |
| SHA1 | fb430d1014e57708bc75702751c2b26f30696b70 |
| SHA256 | ebdbba07edfcb8901e5445fe81a8d06753f072b1ee83cdb6ac3a4b00c026b906 |
| SHA512 | eb217114fa8f381283058d14a2e19330101bb61b9f21ad48073b724e511d4981e3762f40b5941057b76e2a59e858e671f8229765d114eef82cda3b3ec44eeeae |
/data/data/com.ekuater.labelchat/databases/pending_chat.db-journal
| MD5 | 8fdcb96391b356a86d1b467491cdb4dc |
| SHA1 | 528d2c4986e5ce745ab63d6689ea9a12bdfbcefc |
| SHA256 | 90c5fc6f3bbeadf9f778493bcbf12f4daad66f862870e47c3c1c18e4ac3b2538 |
| SHA512 | 55856e16f4344d563b851a2c8814454db582e057e20791b843742deccafc11cd76738ad91a819ac9a091176868c2ffce0ca7b31beb32447cb523437e54d70fdf |
/data/data/com.ekuater.labelchat/databases/pending_chat.db-wal
| MD5 | 4036f6eaec0c42d3fa7844442ad169ce |
| SHA1 | 13623f28a08850819f4632d05411e6e259db6149 |
| SHA256 | 5db79d1be4e376380b40b71791148b7aa1d73f6beaac5c1e5f12487573097a76 |
| SHA512 | edeebf06400e7ecb55eac6281dd3110b6b25adc65286e1ba885fd5e0562e15b6ff64d7612162350a879f2468b0f32bf2af7e3bf6f72701b7a00dccf5cc73c54c |
/data/data/com.ekuater.labelchat/databases/strangers.db-journal
| MD5 | e11040e673d0a6d20d885d77d61d6d56 |
| SHA1 | da5bc929efcffc31cf2cdf990cbe3d92cb56b04e |
| SHA256 | 80b084e54de80b81c5fa890d268b148ddaaf7860fb72260a9926b1b4055e6a52 |
| SHA512 | fbed703c771748d35346d1ccc94474276d8d14b3a0728540da4aabc5e4369a284dfb6c19517eec177781bc726f8cfad0787806a28048fcd694b05527503a368b |
/data/data/com.ekuater.labelchat/databases/strangers.db-wal
| MD5 | 9dd386a89deb914b2cae19495aaa2a96 |
| SHA1 | eefde7d854cd86f33318c0e5f0ff47787af3facd |
| SHA256 | 09d53400bb32c0374cfe6f433c4610af4a814ba9fb2316018d3fd5fe0643906b |
| SHA512 | ba31f078a640e8576e2eec9c2d09e308dee1668f9142778465738b27631bcc374f01d8b2a7f61d13e83b3f8982f8d68d3c32dcc6e4260c928f8d2df0420535c8 |
/data/data/com.ekuater.labelchat/databases/litestrangers.db-journal
| MD5 | 5d74b21efba501e13c24e8a007506154 |
| SHA1 | b8f5b0c7af10bdfe005d15bad327d079e0f82092 |
| SHA256 | 9ac86f3a5e417e23edc8e99c84a3198d8442f0d3c6d1cb11d4597b41545b7a61 |
| SHA512 | 3e46e686d4f584768a0431bb4a112c5d474cbf0d6ac6aa2f7f341108cd8deb16a67af855e76cb53dbd029a9ecc0a13a88e44938de769efb7711a03b07a4f4530 |
/data/data/com.ekuater.labelchat/databases/litestrangers.db-wal
| MD5 | 8da788c8611adca7508f7068ad4696b3 |
| SHA1 | ab5bc03941a9ac3a924194935c273d492ffaa38e |
| SHA256 | 395790d8095fae1949f5a5aa5c47bc63ce282769578ac4d9bc153bfaded442e3 |
| SHA512 | bb3b76f759ce76b3866d83bf724fd0189a3f4c0347c374d9f29f205269e4a9e01907fffd8402b59a3c18feda074a8c4d4359b43d3425e3fa318436700f4c48cf |
/data/data/com.ekuater.labelchat/databases/follow_users.db-journal
| MD5 | cc2b787bcd3a9fec5a3ea34556e80147 |
| SHA1 | 884422c6c082f30c1648f7819af81b8b1c509c48 |
| SHA256 | b7ef74461afdd921529ff1c658c352baa78290d2e8912f9bf2c36baa6bb424ca |
| SHA512 | 98823ff9f7b19a4ab12a9654df8bdebf919f2aae1e005c7b62dcb71826382da593c0db9e3ae01799dbcee35f4bc12e3b6720bafc8e7eb29652771da0129ffdd9 |
/data/data/com.ekuater.labelchat/databases/follow_users.db-wal
| MD5 | 496b06f98870911b62d7922f8779bf32 |
| SHA1 | f58d66c814fb8bfcc2de69f4c092b24e534a4b91 |
| SHA256 | 68859168b2e074e26e861bac67c0ec74745df9673621cd1965d8c058b723a2d2 |
| SHA512 | d8e3a7bfd82d897af9b51653a4227a86e015854fc74ac250acf32b5a4c1663ca8155acc69359207ab0b70e5cb23f83751cf62a3a8060f44c45c1714e5b9a0c42 |