Malware Analysis Report

2025-08-11 07:10

Sample ID 241017-q8cq3atcpm
Target 5249a2f95a8c71ccc9ebb240d4ee9be8_JaffaCakes118
SHA256 7487720d131e66166b5e6d22849b3cd7597d61fc02c43f71fc05de82b9f817d8
Tags
banker discovery impact persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

7487720d131e66166b5e6d22849b3cd7597d61fc02c43f71fc05de82b9f817d8

Threat Level: Shows suspicious behavior

The file 5249a2f95a8c71ccc9ebb240d4ee9be8_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

banker discovery impact persistence

Queries information about running processes on the device

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about active data network

Acquires the wake lock

Reads information about phone network operator.

Requests dangerous framework permissions

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Checks memory information

Checks CPU information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-17 13:55

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-17 13:55

Reported

2024-10-17 13:58

Platform

android-x86-arm-20240624-en

Max time kernel

130s

Max time network

136s

Command Line

com.wta.NewCloudApp.jiuwei52474

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Description Indicator Process Target
N/A alog.umeng.com N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A
File opened for read /proc/meminfo N/A N/A

Processes

com.wta.NewCloudApp.jiuwei52474

com.wta.NewCloudApp.jiuwei52474:pushservice

com.wta.NewCloudApp.jiuwei52474:remote

com.wta.NewCloudApp.jiuwei52474:push

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 api.exc.mob.com udp
CN 180.188.25.46:80 api.exc.mob.com tcp
US 1.1.1.1:53 pack.yundabao.com udp
US 1.1.1.1:53 api.share.mob.com udp
CN 116.255.131.209:8181 pack.yundabao.com tcp
CN 180.188.25.42:80 api.share.mob.com tcp
CN 180.188.25.42:80 api.share.mob.com tcp
US 1.1.1.1:53 push.ydbimg.com udp
US 1.1.1.1:53 oc.umeng.com udp
CN 59.82.23.79:80 oc.umeng.com tcp
US 1.1.1.1:53 m.niujiaxueche.com udp
CN 116.255.131.209:80 push.ydbimg.com tcp
US 1.1.1.1:53 alog.umeng.com udp
CN 223.109.148.179:80 alog.umeng.com tcp
US 1.1.1.1:53 sdk.open.talk.igexin.com udp
CN 183.134.98.76:5224 sdk.open.talk.igexin.com tcp
US 1.1.1.1:53 utop.umengcloud.com udp
CN 116.255.131.209:8181 push.ydbimg.com tcp
US 1.1.1.1:53 api.exc.mob.com udp
CN 116.255.131.209:8181 push.ydbimg.com tcp
CN 116.255.131.209:80 push.ydbimg.com tcp
US 1.1.1.1:53 api.share.mob.com udp
US 1.1.1.1:53 api.share.mob.com udp
CN 180.188.25.42:80 api.share.mob.com tcp
CN 180.188.25.42:80 api.share.mob.com tcp
CN 180.188.25.46:80 api.exc.mob.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
US 1.1.1.1:53 safebrowsing.googleapis.com udp
GB 142.250.200.10:443 safebrowsing.googleapis.com tcp
CN 116.255.131.209:8181 push.ydbimg.com tcp
US 1.1.1.1:53 api.exc.mob.com udp
CN 180.188.25.46:80 api.exc.mob.com tcp
CN 183.134.98.76:5224 sdk.open.talk.igexin.com tcp
US 1.1.1.1:53 api.share.mob.com udp
CN 180.188.25.42:80 api.share.mob.com tcp
US 1.1.1.1:53 api.share.mob.com udp
CN 180.188.25.42:80 api.share.mob.com tcp
CN 183.134.98.76:5224 sdk.open.talk.igexin.com tcp
US 1.1.1.1:53 api.share.mob.com udp
CN 180.188.25.42:80 api.share.mob.com tcp
US 1.1.1.1:53 api.share.mob.com udp
US 1.1.1.1:53 api.share.mob.com udp
CN 180.188.25.42:80 api.share.mob.com tcp
CN 180.188.25.42:80 api.share.mob.com tcp
CN 183.134.98.76:5224 sdk.open.talk.igexin.com tcp

Files

/storage/emulated/0/ShareSDK/.dk

MD5 7235c7832f318a41b62e8449a6a32b3c
SHA1 9858340ebfe8a02f61ccbb936d0dbcf4be6187f2
SHA256 f291faa647ceaa5cc07502796d5b0eaabd717fb43cb331eaedecdd54cac14b90
SHA512 b29224a18484f4085672472fe5efa15cd1e6afa09f86822c3c7611b96178dd3289b1fdaafa11ade962a2a4acecb460102c9d433076a3a4127c07bd23e825da6b

/data/data/com.wta.NewCloudApp.jiuwei52474/databases/UmengLocalNotificationStore.db-journal

MD5 67510f4b3efe77d8168651002e757c1b
SHA1 dd301f8e542b0869e73e4e319fbc4c6287a046ea
SHA256 469195ea3469859816be5d43fff35a60c42e5a8ca93bc67204a2051835c82fdb
SHA512 af792f064cccf4e32cf3dc166951bb8ecbdad1259c7c5c64cae7f3350ee32932cbe94c4e7fddcb2a1f51c2c5f9174c94563ec20b0395e5decf8506381f2e0a28

/data/data/com.wta.NewCloudApp.jiuwei52474/databases/UmengLocalNotificationStore.db

MD5 1c4274aa7a9a5cac8c6d1df71e4588c6
SHA1 abaecd685e01cc68801292e3dc7085654a22feba
SHA256 3f6cd5f480ae69859b7841450f3d032c528ba385ebf9f371b9c8fdc6eb4231be
SHA512 1adb95935798607bd36cedcd183924d3068f50097d017b278da7caee7771532b61ec3606f6189b6dec8426eb038fe40be75079ce35894b1a8e0d1d815261150c

/data/data/com.wta.NewCloudApp.jiuwei52474/databases/UmengLocalNotificationStore.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.wta.NewCloudApp.jiuwei52474/databases/UmengLocalNotificationStore.db-wal

MD5 b3c4811265fe617ae130e7224402b40f
SHA1 6f1b30a9154954c561c78f928c44eebc1eb00a98
SHA256 de31f1e0f3dc0403fe5728572e49362be4c25710eab4e4ff2fbc600ec5b356fc
SHA512 6c6f4576ebf5dc5dfac9069abfd6bb38c40d6129f89920fbfa15eaf2d74348ba290c3eccf4d8aadeda048ebe57e613d4327d93a3c2b08e202ec4c72fb71e606f

/data/data/com.wta.NewCloudApp.jiuwei52474/databases/pushsdk.db-journal

MD5 f2de4c1a3b21119b689ad32ad9476016
SHA1 0abfee9790a4e2bcdddad4a1555d0e6d625cebd0
SHA256 51083fa14509793863c970c77ef7754b16474d678f0553fe4f15c7b7f0fbce5f
SHA512 048726f3fd97c005646ed0a34ef6c52a5407eee2aa1e53d3a076e54da91aede852c80fa0c81c03729e6dc6bdb321fd07db87bbc5bcb80b2a3e11fb0e3558b400

/data/data/com.wta.NewCloudApp.jiuwei52474/databases/pushsdk.db

MD5 b10387619dc04736792f4e1c6a5523bb
SHA1 6732fb55484876dc10344edf75743678002dd459
SHA256 b0828d460a03d6cf151140b9a0929cf25293eebf7b4bb57a1a4a5071542ed2f0
SHA512 31a47f9c98f93548ce96bf4128d73fabbdc7afa679b162239ea765fcb291756cd0626b57c28e3e53f1393efe2770064da9283d450fdbed91d3b096cf105868fa

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 94e5cee67cc43635c4f24f85a9b0ac59
SHA1 413a9b7b7743b140517af04cca4c2aef235226bd
SHA256 a18bae74f949667aff1cf8e0207d2f23acd4ccc503ac033a6c9f4f102eb5f3d4
SHA512 f4b690117fdb1e7052cd874d968b09b27933cc41824d671241fcf92b0d578e22e67257b93f7c3af03dd3ebd352fa94ab1fbdfc7386663d6609a12ba9919df586

/storage/emulated/0/.DataStorage/ContextData.xml

MD5 090b2da58a57cabb6674695b3c1a5a44
SHA1 a5f00aa9591ae37f24335e4a1857f6ff3bf8ee6d
SHA256 146ad5db27faf09f687c51be6659d7e9c35801bade1d6f03d14bac0e78895fb7
SHA512 008cb7f19a8e4aa358f5fa7e0f7df361776af53162bef53ad07f4ef94a0b68aa656a62f2bbd64af4ce0f32aa93952e315377de5583f65fd82205abb1c892ac2b

/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

MD5 b4dd9921626539febf87cfc252544462
SHA1 db3a3b5e78f0b6f9881bbc1210552b54063fd2c4
SHA256 dd01bab60e9819abc33f37f6795950cbfc146bf074a4d3af3c4484ca92c3b655
SHA512 823172305f7bb643263aa81d2ddd642e4407d37043c3379e8dbeb9089495216ae307b6681852eed3b18a4771bbff934965a0ab4854ff20c712f1ff348d585f6a

/data/data/com.wta.NewCloudApp.jiuwei52474/files/umeng_it.cache

MD5 36397318fbb6b0fbc3e7bd17e38175ae
SHA1 31cf5e8c97c2e46c129b25ab9eda2ff75587e1d7
SHA256 06a5fb39e722f9368852d02b0c9ba98bfcf4065405014ae31d26fa1a4445937d
SHA512 c500748d3ac2b557276d218289e55bea5d878eec004237f3bef17f5268a3860cd0a9cf27203f7410754a0d8f871510b4f8707491dcad3be3297f4537d88976bf

/data/data/com.wta.NewCloudApp.jiuwei52474/databases/ThrowalbeLog.db-journal

MD5 5ec730d41d8a5b69a912cfbe8ca8ef04
SHA1 b4ead35969b65346f1c6aa07f47b709a083a0d59
SHA256 1010cabff53a6112640732d92136a4fe03f16931065b9769d6b1588eb7130a77
SHA512 462567128611e6f6e2d4cc535075f4779c8bb16de7850f67993a6fea629ed61fdcf833428b3c14d782974a770ef77f118c1c687b40a2e6db98f05710682b604f

/data/data/com.wta.NewCloudApp.jiuwei52474/databases/ThrowalbeLog.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.wta.NewCloudApp.jiuwei52474/databases/ThrowalbeLog.db-shm

MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

/data/data/com.wta.NewCloudApp.jiuwei52474/databases/ThrowalbeLog.db-wal

MD5 4f1f760d3147d11bbd1439ee5a242399
SHA1 7759de0db7588e2126ebfe7a40d1537babcfb2af
SHA256 6551e6f709f9562187fa52bb173f56639a1d4e661260517cacfa54f972ca830a
SHA512 c04823b2f6fb472679e0dd9abf44ba049752fdae63725932e8155935c78387945fd526120d7ad07fcd5267502cdeafcc8ac497a67faab7a0125da5ceb54b8a67