68e71cdf7ed6923046c1eea13355cb37460c8249d48f09ef477fab65e79ca9a9

Analysis

max time kernel
179s
max time network
150s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
19/05/2024, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
578895d91c2d3fb8432793fc6f3ba277_JaffaCakes118.apk
Size 3.4MB
Sample240519-aaf3tsfe87
SHA256 68e71cdf7ed6923046c1eea13355cb37460c8249d48f09ef477fab65e79ca9a9
MD5 578895d91c2d3fb8432793fc6f3ba277
SHA1 fabed40f56da106656255069a1c9542d1662f5fc
SHA512 3a2c7610038b57cb06ae82ec67323bc0e40ef6d906a05a3a6df941f7b6d0dd680da2974613984be28d8fe1a8f295e3dd57672a11f270e0f0c9c9678e796ef78f
SSDEEP 98304:9nbwpw2KMyNW2kEA+sBzh/pYJG0mU0I/OZmSFy:9nUZhuvpvOnFy
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.goldmobileservices.militarydiet:Metrica
/sbin/su	com.goldmobileservices.militarydiet:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.goldmobileservices.militarydiet
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.goldmobileservices.militarydiet:Metrica

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.goldmobileservices.militarydiet
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.goldmobileservices.militarydiet:Metrica

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.goldmobileservices.militarydiet

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.goldmobileservices.militarydiet

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.goldmobileservices.militarydiet
Framework service call	android.app.job.IJobScheduler.schedule	com.goldmobileservices.militarydiet:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.goldmobileservices.militarydiet
Framework API call	javax.crypto.Cipher.doFinal	com.goldmobileservices.militarydiet:Metrica

com.goldmobileservices.militarydiet
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5205

com.goldmobileservices.militarydiet:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5282

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/data/com.goldmobileservices.militarydiet/files/ZPkFS.log
Size 12KB
SHA256 37d392a95b1d330da05e98d6a9c1e7601f415fd1b76faea7f11e4bc5715cc2e5
MD5 9193d2aa9d847f87edbe7ccdb9e9115c
SHA1 3ff1eabb8108e2481c55785324fd9fe2662bf0f5
SHA512 2a873841f5677499d133a6ea1005881e852cda3f9525f8f4f51ac5d81e0cc6da4132e5c90008c32ccd0aa98460b63f22401956acdfd54d0b6fbb511ec90bd7fc
SSDEEP 24:7+tyqLY0MxKyOmctlDWwwTRD5xs5cQlNGSBn:7MyqEkDP6PRtxOcZSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/data/com.goldmobileservices.militarydiet/no_backup/credentials.dat
Size 233B
SHA256 0fbd4df2e381a4ee72845001e4e09367ba6a83c158118da41a9c93850042bf3a
MD5 4d470308ccaf0546088040cd31994c06
SHA1 a47335939eea70a97f03cb0bd316ffbeb99b9acf
SHA512 ba9a503f78c6ba15f1f80c1e5daf5067d86d2e46319af7b0111d79ca1d331790f0216028b2076e9d37d07919941c9e6502be918964e13621ee9481b0f8c19635
MD5 SHA1 SHA512

Submit Download

db_metrica_com.goldmobileservices.militarydiet

Path /data/data/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet
Size 36KB
SHA256 c7df281a6c924a107e6ecd8add76b65682eece1795ce04fa8e0fc57a606dfb3d
MD5 2e33b015f10f0d42ac5cf7b13863ebc0
SHA1 5ae3397469badc2d5aea62981c4d43ab64cf41fa
SHA512 b3a39d6aeca400b7597d240bf00ddf377a286d199aa5dcb58b76dc431e7f7917cd16b40ca5312f147fc0740ac79f4610be4ca99fa436579cf42f9c08ce885780
SSDEEP 48:TVE8WctFMkUe9kftcPSXknczavvk9K+SfjR4I8GALTIUuJZIp4RsviI+Vj7MoDNM:JE8LtFNpkFcaXknczlyw4XbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/data/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 20KB
SHA256 73929991dce4b1143940436fb5da85cbcf2192af56308850304dca847358d0e3
MD5 75c88b3f6d4a241632ef849ac94bb733
SHA1 8352a6ddc7864259d390833f03fc1767534f8de3
SHA512 4d4e72fead7bfe67c120b6958dcba0fa83ff3d2df1700fa44c9ca5772e13d30d56ba29d48c26a74dae67ef0ac01b430a44a460e7c32fff99df569c455dac5590
SSDEEP 24:TLQfcQlNGSP//lgYeMmjCEKDgncINL5yEMZF3ncCk:TUfcZSP//xWlKDgncId+3ncl
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/data/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 20KB
SHA256 c49b68dda62330c8a902c2a2c3951eff1b87359db6abced8e43ee0f8f856bca3
MD5 d9830403f2cde901ecfc114c5ca1aa3f
SHA1 30e7df74da41b404b24b29d13ac75e9b1d9a5994
SHA512 ad6b41e278d747494ae130af5c44cd631fd164ab91b2db05482f0ad18f7ec7e2cb733af17146e39a4871b7452d9cffa199f0fbec825d185782ccb9fcaed22765
SSDEEP 24:TLwfcQlNGSP/NqLiuWRGSJHWjY0MmVIEwZDgncyNTMEMvLncCG:T0fcZSP/NqZWESJ501EDgncy0ncb
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/data/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 8KB
SHA256 5db36b4217c5a838d1d26ade700ed3b8c8f815ad81e0d81d535c4fada228d0dc
MD5 f7866380f2b80810dc42f526a855cc7f
SHA1 8069cc6ce11ea140e34dec3fbd5253d358064a0d
SHA512 bf8f66b6925fd63188addd9efcf4806fb25ca1bc5e7ea979e6fac20bc3a56571dc5a862e6f2ec1baa6f78f0e823866a1e3e8edde43b1e6abe080b9f51f6ab2c4
SSDEEP 12:lO3HW7lPTWRbefqsT9v8+jLMO3Kt9jicnWVSpqLJdTRmBEyPbJlX8:A3HOW+hv8+cO36bWYqLJyGSb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/data/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 12KB
SHA256 471f47e9e29b256d9344d7f8d99d8bb365a43431e1fa9d4c6281f277931e76be
MD5 c4bc361f4fff7db9610b6864211ff69c
SHA1 7bac402cd7b2ed264c3d3b0a0d08277bed2b1538
SHA512 fb0da7e853888832eb43fbd64997101ae489f0364d7a25b52e3d6b247df6614fa02dcb5ba70e34520e38494dd6ab56d94de45196bbcac7aa4ecfef0504bb0d36
SSDEEP 24:G5aPSvvqLGpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSt:Ge4qVE8WctFMkUe9kftcPSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/data/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 12KB
SHA256 025f041f2f3f97608c5cf16b8c846046a7e9b47cea0635e271f933c2366ebbed
MD5 2baf7d2e4e955c6ddb1c669f6c5c1e0b
SHA1 bcca8ea5ceb005149aa7adaf4e1437424ff42b8d
SHA512 1af5b71d1208eb1800fd938216a2741294cd30988463797a76461ec24b004e8085a10c242ac1a48bd3320b4a8f30863433f73cd8844617854e1cdada8125bfcd
SSDEEP 24:7+t7CE2fb4igqLZUpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSN:7M7h2fb4igqtDE8WctFMkUe9kftcPSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/data/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 12KB
SHA256 1860dad6e6a85a9777f239206f2a6eef0b126b8e00d63c685091eb4b4344b23f
MD5 78deaa42d3add7b2d6e71913e328dc83
SHA1 b05c2cb7143d673ca6e3d537b16430fc2661a18a
SHA512 d442b2020dafdfdbbab570a0cfe7844dabdb33c0506bbf6785940e8e66f5ecc5ebd98ed9a4762abdb9f6eabfc39ce1ebaa289ef4b5f65751aa26272a6e468419
SSDEEP 48:7Mzcabok9J+SfjR4I8GALTIUuJZIpDRsv68I+Vj7MoDNbDqFE8WctFMkUe9kftcE:76cQOywDibDOE8LtFNpkFcaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 b3357cc7f2f2390ede6e5868fb5c80dcb74cd266f32294d5bdd76b68041a0939
MD5 ba4d35d70039963356a87a33ec534bbb
SHA1 21aa4300751d65243ddf2b7590f27831142d51e3
SHA512 c63fd22e58855475b9533353b86e7dcb50ebbb1690f49f11c7ad02717942764d3c5fa1593fae439b1a195e3f6654d9e01fc72f943e8d2120c58e0bd650476954
SSDEEP 48:TFE8WctFMkUe9kftcPSB8UM6HtFzJnvbCkJPjE9IPfjO8ESe2vI41ode2b09/lfv:5E8LtFNpkFcaW6nvbCJgwDAsbA
MD5 SHA1 SHA512 SSDEEP

Submit Download