Automated Malware Analysis Report for Bdsmlr-3-4.Apk
Total Page：16
File Type：pdf, Size：1020Kb
ID: 220720 Sample Name: bdsmlr-3-4.apk Cookbook: defaultandroidfilecookbook.jbs Time: 04:05:01 Date: 07/04/2020 Version: 28.0.0 Lapis Lazuli Table of Contents Table of Contents 2 Analysis Report bdsmlr-3-4.apk 4 Overview 4 General Information 4 Detection 4 Confidence 4 Classification Spiderchart 5 Analysis Advice 5 Mitre Att&ck Matrix 6 Signature Overview 6 Location Tracking: 6 Spreading: 6 Networking: 6 Key, Mouse, Clipboard, Microphone and Screen Capturing: 6 E-Banking Fraud: 7 Spam, unwanted Advertisements and Ransom Demands: 7 Operating System Destruction: 7 Change of System Appearance: 7 System Summary: 7 Data Obfuscation: 7 Boot Survival: 7 Hooking and other Techniques for Hiding and Protection: 7 Malware Analysis System Evasion: 7 HIPS / PFW / Operating System Protection Evasion: 7 Language, Device and Operating System Detection: 8 Stealing of Sensitive Information: 8 Remote Access Functionality: 8 Malware Configuration 8 Antivirus, Machine Learning and Genetic Malware Detection 8 Initial Sample 8 Dropped Files 8 Domains 8 URLs 8 Yara Overview 9 Initial Sample 9 PCAP (Network Traffic) 9 Dropped Files 9 Sigma Overview 9 Joe Sandbox View / Context 9 IPs 9 Domains 9 ASN 9 JA3 Fingerprints 10 Dropped Files 10 Screenshots 10 Thumbnails 10 Created / dropped Files 11 Domains and IPs 12 Contacted Domains 12 URLs from Memory and Binaries 12 Contacted IPs 13 Public 14 Static File Info 14 General 14 File Icon 14 Static APK Info 14 General 15 Activities 15 Receivers 15 Copyright Joe Security LLC 2020 Page 2 of 39 Services 15 Permission Requested 15 Certificate 16 Resources 16 Network Behavior 36 Network Port Distribution 36 TCP Packets 36 UDP Packets 37 APK Behavior 37 Installation 37 Miscellaneous 38 System Calls 38 By Permission (executed) 38 By Permission (non-executed) 38 Disassembly 39 0 Executed Methods 39 0 Non-Executed Methods 39 Copyright Joe Security LLC 2020 Page 3 of 39 Analysis Report bdsmlr-3-4.apk Overview General Information Joe Sandbox Version: 28.0.0 Lapis Lazuli Analysis ID: 220720 Start date: 07.04.2020 Start time: 04:05:01 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 6m 13s Hypervisor based Inspection enabled: false Report type: light Sample file name: bdsmlr-3-4.apk Cookbook file name: defaultandroidfilecookbook.jbs Analysis system description: Android 6.0 APK Instrumentation enabled: true Detection: MAL Classification: mal48.spyw.evad.andAPK@0/253@0/0 Warnings: Show All An application runtime error occurred Excluded IPs from analysis (whitelisted): 216.58.205.227, 172.217.23.168, 64.233.167.188, 172.217.23.104, 216.58.208.46, 172.217.16.206, 172.217.23.110, 216.58.210.14, 172.217.22.46, 172.217.22.78, 172.217.21.238, 172.217.21.206, 172.217.23.174, 172.217.23.142, 216.58.205.238, 172.217.22.14, 216.58.206.14, 172.217.18.110 Excluded domains from analysis (whitelisted): connectivitycheck.gstatic.com, ssl.google- analytics.com, android.clients.google.com, android.l.google.com, ssl-google- analytics.l.google.com, mobile-gtalk.l.google.com, mtalk.google.com No interacted views No simulation commands forwarded to apk Not all executed log events are in report (maximum 10 identical API calls) Not all non-executed APIs are in report Not all resource files were parsed Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing dynamic data code. Detection Strategy Score Range Reporting Whitelisted Detection Threshold 48 0 - 100 false Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2020 Page 4 of 39 Strategy Score Range Further Analysis Required? Confidence Threshold 5 0 - 5 false Classification Spiderchart Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Unable to instrument or execute APK, runtime error occurred Copyright Joe Security LLC 2020 Page 5 of 39 Mitre Att&ck Matrix Remote Initial Privilege Defense Credential Lateral Command Service Access Execution Persistence Escalation Evasion Access Discovery Movement Collection Exfiltration and Control Network Effects Effects Valid Windows Winlogon Port Obfuscated Access System Application Location Data Data Eavesdrop on Remotely Accounts Remote Helper DLL Monitors Files or Stored Network Deployment Tracking 1 Compressed Obfuscation Insecure Network Track Device Management Information 1 Application Connections Software Communication 1 Without Data 1 Discovery 1 Authorization Replication Service Port Accessibility Binary Network Location Remote Access Exfiltration Fallback Exploit SS7 to Remotely Through Execution Monitors Features Padding Sniffing Tracking 1 Services Stored Over Other Channels Redirect Phone Wipe Data Removable Application Network Calls/SMS Without Media Data 1 Medium Authorization External Windows Accessibility Path Rootkit Input System Windows Network Automated Custom Exploit SS7 to Obtain Remote Management Features Interception Capture Information Remote Information Exfiltration Cryptographic Track Device Device Services Instrumentation Discovery 1 Management Discovery 1 Protocol Location Cloud Backups Drive-by Scheduled System DLL Search Obfuscated Credentials Process Logon Input Data Multiband SIM Card Swap Compromise Task Firmware Order Files or in Files Discovery 1 Scripts Capture Encrypted Communication Hijacking Information Signature Overview Click to jump to signature section Location Tracking: Queries the phones location (GPS) Spreading: Accesses external storage location Networking: Checks an internet connection is available Opens an internet connection Performs DNS lookups (Java API) Connects to IPs without corresponding DNS lookups Monitors network connection state Urls found in memory or binary data Uses HTTP for connecting to the internet Key, Mouse, Clipboard, Microphone and Screen Capturing: Copyright Joe Security LLC 2020 Page 6 of 39 Has permission to take photos E-Banking Fraud: Has functionalty to add an overlay to other apps Spam, unwanted Advertisements and Ransom Demands: May dial phone number May use Google Cloud Messaging (GCM) or Google's Cloud to Device Messaging (C2DM) services Loads advertisement Operating System Destruction: Lists and deletes files in the same context Change of System Appearance: May access the Android keyguard (lock screen) Acquires a wake lock System Summary: APK is signed by a suspicious certificate Executes native commands Requests potentially dangerous permissions Classification label Creates SQLiteDatabase table Loads native libraries Reads shares settings Registers a Sensor listener (to get data about accelerometer, gyrometer etc.) Data Obfuscation: Obfuscates method names Uses reflection Boot Survival: Has permission to execute code after phone reboot Installs a new wake lock (to get activate on phone screen on) Hooking and other Techniques for Hiding and Protection: Aborts a broadcast event (this is often done to hide phone events such as incoming SMS) Queries list of running processes/tasks Uses Crypto APIs Malware Analysis System Evasion: Accesses android OS build fields Checks CPU details Queries several sensitive phone informations Queries the unique operating system id (ANDROID_ID) HIPS / PFW / Operating System Protection Evasion: Copyright Joe Security LLC 2020 Page 7 of 39 Uses the DexClassLoader (often used for code injection) Language, Device and Operating System Detection: Checks if phone is rooted (checks for su binary) Queries the network operator ISO country code Queries the network operator name Queries the network operator numeric MCC+MNC (mobile country code + mobile network code) Stealing of Sensitive Information: May take a camera picture Queries media storage location field Queries stored mail and application accounts (e.g. Gmail or Whatsup) Reads pictures stored on the device Remote Access Functionality: Found suspicious command strings (may be related to BOT commands) Uses DownloadManager to fetch additional components Malware Configuration No configs have been found Antivirus, Machine Learning and Genetic Malware Detection Initial Sample Source Detection Scanner Label Link bdsmlr-3-4.apk 0% Virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches URLs Source Detection Scanner Label Link https://api.flutter.dev/flutter/material/Scaffold/of.html8 0% Avira URL Cloud safe http://www.ijg.org/files/Wallace.JPEG.pdf. 0% Avira URL Cloud safe https://fontawesome.comhttps://fontawesome.comFont 0% Avira URL Cloud safe http://www.ijg.org/files/jfif.txt.gz 0% Virustotal Browse http://www.ijg.org/files/jfif.txt.gz 0% Avira URL Cloud safe http://www.limbicsoftware.com/quickpvr.html 0% Avira URL Cloud safe https://google.github.io/ExoPlayer/faqs.html#what-do-player-is-accessed-on-the-wrong-thread-warnings 0% Avira URL Cloud safe http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txt 0% Virustotal Browse http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txt 0% Avira URL Cloud safe http://www.ijg.org/files/jfif.ps.gz. 0% Avira URL Cloud safe https://app-measurement.com/a 0% Virustotal Browse https://app-measurement.com/a 0% URL Reputation safe Copyright Joe Security LLC 2020 Page 8 of 39 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Sigma Overview No Sigma rule has matched Joe Sandbox View / Context IPs