Malware Analysis Report

2025-01-19 07:42

Sample ID 240616-add3ms1amd
Target b0cfa9c96615b265a44ea2d7245588c7_JaffaCakes118
SHA256 51054d7da1cabd967c46276c79f5234d8cf60f366ec2db763db9c9336d8bd11f
Tags
banker discovery evasion persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

51054d7da1cabd967c46276c79f5234d8cf60f366ec2db763db9c9336d8bd11f

Threat Level: Shows suspicious behavior

The file b0cfa9c96615b265a44ea2d7245588c7_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

banker discovery evasion persistence

Checks Android system properties for emulator presence.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Loads dropped Dex/Jar

Reads information about phone network operator.

Requests dangerous framework permissions

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries information about active data network

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-16 00:05

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 00:05

Reported

2024-06-16 00:10

Platform

android-x86-arm-20240611.1-en

Max time kernel

10s

Max time network

131s

Command Line

org.chromium.caster_receiver_apk_piccomic

Signatures

Checks Android system properties for emulator presence.

evasion
Description Indicator Process Target
Accessed system property key: ro.product.model N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/data/org.chromium.caster_receiver_apk_piccomic/dex/qcast_sdk_core_client.dex N/A N/A
N/A /data/data/org.chromium.caster_receiver_apk_piccomic/dex/qcast_sdk_core_client.dex N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Processes

org.chromium.caster_receiver_apk_piccomic

chmod 755 /data/user/0/org.chromium.caster_receiver_apk_piccomic/asset_res/tab_blank_root.html

chmod 755 /data/user/0/org.chromium.caster_receiver_apk_piccomic/asset_res

org.chromium.caster_receiver_apk_piccomic:castlinkerservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 www.baidu.com udp
HK 103.235.46.40:80 www.baidu.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.177:80 alog.umeng.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
GB 216.58.212.202:443 tcp

Files

/data/data/org.chromium.caster_receiver_apk_piccomic/asset_res/tab_blank_root.html

MD5 2603e3a7eba8b03af315c590c0ebeb76
SHA1 1843c16eaa2dac0570d41c0e3d306151289eef68
SHA256 501b8e6adc184ee1a1ccd7904e60566abf509cbcb1d17580fcd062d28b6b1e50
SHA512 1858d96de812f90e9a8d9d38ad397916e1fc606138708aac765bec26d3ded3d950852f1ee0ea5075140da6f646c4206178d58f066ef782ab15b7e8465579e152

/data/data/org.chromium.caster_receiver_apk_piccomic/app_content_shell/paks/content_shell.pak

MD5 736b282401615ae39eb0f278759258f7
SHA1 730db06ab2a8409bb2ab2441848b7706bb120c47
SHA256 c487e0133b3a7e5772d5147365e41d2648a635c2ca2e66047661fc5222bf2874
SHA512 14ada472efbeaf0625e0a55f7e46b91aa2ce2a11cb86e235409f39532b2d68d904ddcc4d8c10b6e537d3e9ed9c3f43c981226f1aea752e7c5c5f34838533006f

/data/data/org.chromium.caster_receiver_apk_piccomic/asset_res/my_app.html

MD5 531c9a595128f278cc3086d45874ed8e
SHA1 e433f4b48d3a504b13dd15482cf2fb90e7da1dd8
SHA256 4bf0d449bb3c6f6da2e20f889174dfb77fe8936a21d0e7a98945b394bed0ee18
SHA512 b34117c07b2b841b4a3b2a58b05a883417d5fab6959de17025d2c59052442306c52ae51199ac6e972f76acf8a95a503a3bedf6f28a4d96b66a52293e5d9f0c4a

/data/data/org.chromium.caster_receiver_apk_piccomic/asset_res/blank.html

MD5 b8639ac0df7466d734bb2a29d9da93a6
SHA1 3000732c8cbc68a569a3925d0a6a2700e07f415e
SHA256 12333f0a11a4c58c8bff33b44d4585b6bb142caf1b898985a69e44be7c6a8371
SHA512 550e8011fa7357a56aa0c1a9734767434342dacf2658d6781c03ebc226a5a7f02e82a874fec811f4c9603a48f7740debab0f8d2421682fd2f3fb42b3196a8ef9

/data/data/org.chromium.caster_receiver_apk_piccomic/asset_res/my_app.js

MD5 af1541e3f0c1c3ec44e55f1cd411a95f
SHA1 f0f87c39abe196d33e0021e7ddfa8b3a0f1b34ad
SHA256 9ee8a286964a3557302c95de9d09574892da2a41ac8014a9d060fa3867760213
SHA512 1761300d10c7af6289d3550e171acf1bbf6b0b0d84f4d4c0e9ab318ed20ba75cdbd2c4014335c7a65bb222c4e7963dc293b6ab586d9b1965f86493ea367554a0

/data/data/org.chromium.caster_receiver_apk_piccomic/app_content_shell/icudtl.dat

MD5 016b7c560b53fe4fcf41f4b2eca9f61f
SHA1 b7e60915aeb077c7e4ba54f87b4b8b8c4f335956
SHA256 86030aafd3e4128b37d50bfa63aecad20bcccacd8037925f9ada49a40620394c
SHA512 867b84f196609c212736904ed733ca9c24a0e9d1a4d3b5246955c053b743801b4e7f1d0b44aceaf2cc108b80c06b016399bb8b27b97e91e0eeca1ce95b56a609

/data/data/org.chromium.caster_receiver_apk_piccomic/databases/download_v3.db-journal

MD5 30641c995261cbe0134b64b7bdfafe63
SHA1 492698ac3925563fa5f03efb6c5bc8f427dd3460
SHA256 bad285b05cda36454c977338f5440d9a640983a91ef4b80ceada3f1734967e6d
SHA512 c5db2d53a581e887ecc0991a58a27d8a5f1dd8c38009ca62712346ffa126d2ec730f932fa76790122aae5564887c7ae38a2ded95f5d0756a8bc2461baaf8b2de

/data/data/org.chromium.caster_receiver_apk_piccomic/databases/download_v3.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/org.chromium.caster_receiver_apk_piccomic/databases/download_v3.db-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/org.chromium.caster_receiver_apk_piccomic/databases/download_v3.db-wal

MD5 80d16c39927f7b2e8ef5e72b66018cd5
SHA1 380fa51eed05bda6de0216070a92072e6a62717e
SHA256 d8275b976fa5ebe5626903d4cd8bbc302ea949dfc7db2d662501af099b79be74
SHA512 4f7d3c23382d028a2017a075f078a9c95a2cdc4ce8242f7258f2310be383b102b9574e35b8a003fefe54f4ce8b41a752f1917e2aea6f951a0c128680afa18fcf

/data/data/org.chromium.caster_receiver_apk_piccomic/dex/qcast_sdk_core_client.dex

MD5 ca66df84c3b275a7d83d6dd16cd3b4ad
SHA1 b22b0c6bd13926b0e04276b70f778172df319ed3
SHA256 afca4d6679c307b3fedd47d1f206b236b316454459a84c4896494d583b0d7be0
SHA512 752df789e19cf0422cfb3dcaff26c206dcb8fef6dde675fa3196e7cffcc0930ceeb36172366b820182596a08e8a8fd1b3ec1e1696ac4752d67d341018c09c7c0

/data/data/org.chromium.caster_receiver_apk_piccomic/files/umeng_it.cache

MD5 3e2506c7e6bc87768c6e0dae0192a81f
SHA1 f6d6106bf3cf2012d0976e9de079c592fa11eca7
SHA256 f79eb738bfb749275787e1ab696b3f3241027da15f858a967f26ca26f95e0073
SHA512 ea45006f2a6418168c842727ac565b2b25ac1edd8461559d0d3f6365cde50a976d7df151ecec3f2c8e699a258d3fc97b363f71edd163c3efcd854e28c2243ccd