68e71cdf7ed6923046c1eea13355cb37460c8249d48f09ef477fab65e79ca9a9

Analysis

max time kernel
178s
max time network
145s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
19/05/2024, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
578895d91c2d3fb8432793fc6f3ba277_JaffaCakes118.apk
Size 3.4MB
Sample240519-aaf3tsfe87
SHA256 68e71cdf7ed6923046c1eea13355cb37460c8249d48f09ef477fab65e79ca9a9
MD5 578895d91c2d3fb8432793fc6f3ba277
SHA1 fabed40f56da106656255069a1c9542d1662f5fc
SHA512 3a2c7610038b57cb06ae82ec67323bc0e40ef6d906a05a3a6df941f7b6d0dd680da2974613984be28d8fe1a8f295e3dd57672a11f270e0f0c9c9678e796ef78f
SSDEEP 98304:9nbwpw2KMyNW2kEA+sBzh/pYJG0mU0I/OZmSFy:9nUZhuvpvOnFy
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.goldmobileservices.militarydiet:Metrica
/sbin/su	com.goldmobileservices.militarydiet:Metrica
/system/bin/su	com.goldmobileservices.militarydiet:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.goldmobileservices.militarydiet
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.goldmobileservices.militarydiet:Metrica

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.goldmobileservices.militarydiet

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.goldmobileservices.militarydiet

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.goldmobileservices.militarydiet
Framework service call	android.app.job.IJobScheduler.schedule	com.goldmobileservices.militarydiet:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.goldmobileservices.militarydiet
Framework API call	javax.crypto.Cipher.doFinal	com.goldmobileservices.militarydiet:Metrica

com.goldmobileservices.militarydiet
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4596

com.goldmobileservices.militarydiet:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4643

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/user/0/com.goldmobileservices.militarydiet/files/ZPkFS.log
Size 20KB
SHA256 477bd41c92d45d060b57856b501048725ba8cd344d54d65459d2f6a0d5c38e68
MD5 d01115ab3b3ab6cd76adfbc07994cd9a
SHA1 2e7e72949ae2c3c9fc3faef4ff50f29153ce10de
SHA512 bdf67bda728f6ba75d0f993d24b0feb954d5cbc369d522ea553400482ccb65ed6c9fb042608d7ecb2940bfae1df0e47a7cdb37409561581c8aa31a774334092d
SSDEEP 12:TLfwfcGtSBw8w2RmBEyPbP/hqVK+QBncQmThzoQV7PRQBncQm2zZjn:TL4fcQlNGSP/hAgncHVWncCh
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/user/0/com.goldmobileservices.militarydiet/no_backup/credentials.dat
Size 234B
SHA256 1ad09933c8fbc4bc64476924fa12235082a4914c28e5d7405f73c27f4d20968a
MD5 df985b665bf9d595ab4c0243ba445367
SHA1 be39b1cb419a7cbbe4d8f39da540d66a492a5de5
SHA512 687cc56111270c3a79fcfce702f8650f081c1544c9083c6741cb1e0dc0d78b6e13fde4949f611b5484815728df2025528a8e20d229e1f9737f20df2f81ba2bd0
MD5 SHA1 SHA512

Submit Download

db_metrica_com.goldmobileservices.militarydiet

Path /data/user/0/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet
Size 36KB
SHA256 39d525b2b5e9556ffb025bf811ab5b415294362ab9d7b447eaedec81ec030894
MD5 e3e254cf3d4b17e14db7dbb7be6d8674
SHA1 ec116365be54075b88829fbef7a6853c18e423f2
SHA512 e9564859d38f544c3f0d073838b269dcf909335e8694b66056c46d864ba2c984a734444b6dbc09c9e4d9be03114151f461133a2a0545eaf8d87307580f0541e7
SSDEEP 48:TdE8WctFMkUe9kftcPSLknclk9K2vtujggX8HuOIRvpXI04cRpOp+ejGFuK4Wb6v:hE8LtFNpkFcaLknct4skmjbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/user/0/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 20KB
SHA256 7556a708701ee6a774421dfda0a31dc3b4090bd374d21cb51ac01909eae9b979
MD5 fd757198097ab1c97afb633becdcec5d
SHA1 60ab5c647f4b8cea6594ea41c4974cb1313fe6db
SHA512 cb0fb33d8244a5be02903312c78ceb7a61642cf570e8fad5f6d3a65fc4c90f898cf06a9de069cb1bad60fce2f7fe605983739348d84f02f59db9f65ea6598bcd
SSDEEP 24:TLYfcQlNGSP/PX6OMx5z8EKDgncINL5yEMZF3ncCk:T8fcZSP/iLjKDgncId+3ncl
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/user/0/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 8KB
SHA256 ba9caefbeb51f5ddffff3a316a7ade73c973b38b7c6fa3f9c5ee78c18b9956d7
MD5 7d6e70fbcae369b2bd191f6d34adcebd
SHA1 7bc5a6f21545fa5109bea956ee4429ad22ead580
SHA512 9c7f3543cada7b908d2df33ac8d80377c5cd587172e94d00e9a583c51738ef169b0a42b9eb9a6eb241dd53674a71dd10b58a266484fde6175cfa71c390debef9
SSDEEP 12:se3HW7lPTWRbefqs9ggSIkHkBIBsu6vqLiuWdYRmBEyPbfy:se3HOW+ahtJ6qLiuWpGSfy
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/user/0/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 8KB
SHA256 c4aac9b77336754df77599701b4d1dcf2de4d36d9a23b5966fe84ef34a32a3fd
MD5 51333d4d85566dac50a3205808337565
SHA1 b59cfb6999f20f4d028dd5d7aa900f8561142a3f
SHA512 c161ba0daef8eec484023a6effb52d3b308f87b45ebb7e79e304701087ab611bcb9e37228f915c6caf812f6b4d5ad5e512314ad87aa7d9d099be10f3c2a511cc
SSDEEP 6:3pPDnkPzhgg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK/s//s:RDg9gqLJdeWRmBEyPbPXs
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/user/0/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 12KB
SHA256 f779c416dd0371af0688f51e8fdecb237285a0c04f9fbbef445651faa0a31b4a
MD5 1e6703c0c7de1f0d30e3339173a19822
SHA1 9f5321f9d5ccd2fd735f695ba619aefefda6198d
SHA512 2ec3214fd400ab757693e91351c07d904c1058cea7eeeaff54405f1a7b70e3503ff406a7689fab809823f9bea5667bcaf9457ee9459615aa3f189f0e44188ffb
SSDEEP 24:7+tEEIvqLOpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSj:7MDQqNE8WctFMkUe9kftcPSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/user/0/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 12KB
SHA256 bb73fd68a4f6300f447f505e07923dd9089aafdef663542868df8f5c7d0a8aff
MD5 250f50968e0d65dbd17b38ce0bacfb31
SHA1 78322a10f3c2dafafbe4307d02973feae11a5cb6
SHA512 9081eda302151218c804e269233118359c2ed212ff3ca0cc796761beb6db5462b2ffc6754411abe55e045065a87641dc7e688237fa39953b52115b5e0216b1df
SSDEEP 24:7+taE2fbjkigqLepOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSB:7MJ2fbgigq9E8WctFMkUe9kftcPSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet-journal

Path /data/user/0/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet-journal
Size 12KB
SHA256 4ac01289c7c8ec06a31df7eba659d5fda3fa6e4432a90cdd5773f519eab5bb25
MD5 327d4d631a1a9a377f2ebece49b04b9c
SHA1 49ceb86b11d3f7c10fcc493e06a6822c0629e9ed
SHA512 593518e9393bb585cba50ee4504be4d85ccfb63786be969d407bb6a882f2de43e04df0ccd5a9ccfa5f73ffbe32ca6f2cee3aae8a892d080487a3ec4ee506b0f1
SSDEEP 48:7MGk96tujggX8HuOIRvpXI0R5cRpOp9ejGFuK4WbvqNE8WctFMkUe9kftcPSo:7WR5srmjbvmE8LtFNpkFcao
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.goldmobileservices.militarydiet_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/user/0/com.goldmobileservices.militarydiet/no_backup/db_metrica_com.goldmobileservices.militarydiet_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 b7995222b1d8e060efadfb4ec61cff3267b1e285c580463074c63a102faebb4f
MD5 5c0c9b65f63bdabb43e868400c18718a
SHA1 57d4af1aa3232c49c3c2923ccc8dacb9b0ee5b6a
SHA512 e6a638aedfa3ff3c91c8ca5d9824b26000173d6770d9a212fbcf4a2c0fa94cbbd5ff2ad530d98c7b40961035eb7ba7eff5b3a82ac7c74e3a75d98e47183e7d57
SSDEEP 48:TdE8WctFMkUe9kftcPSB8UMr2HHDcWzJnvbKqkJEjElPfjO8ESX2vI41odgo2b0k:hE8LtFNpkFcaWFEcOnvbbxBwkNsbA
MD5 SHA1 SHA512 SSDEEP

Submit Download