33401ecad901aba45fa1cfc1a8e6a95557d0bdc86669c03af0b339d518124994

Analysis

max time kernel
179s
max time network
151s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
21/05/2024, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
620b040f2b9dc535a4eaa084260a2de8_JaffaCakes118.apk
Size 5.9MB
Sample240521-e7ba3ahc85
SHA256 33401ecad901aba45fa1cfc1a8e6a95557d0bdc86669c03af0b339d518124994
MD5 620b040f2b9dc535a4eaa084260a2de8
SHA1 32c6e529db788e678558abc78d8cb1e8da804394
SHA512 9222704f2d82181560b2227438179fbc5fdbc1e944d6f3237850056d72183ff82b46ac3bd84767602e21695beb84d7c165ad879a01986d0515c67bfd0e324cee
SSDEEP 98304:5fsadOybik4gpS8U90VUJyr53bgOE25JAOPArfT6+F95UHmZkgs:MLaS8U9qUJyVgORbPgT6qKz
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.br.pizzamaker:Metrica
/sbin/su	com.br.pizzamaker:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.br.pizzamaker
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.br.pizzamaker:Metrica

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.br.pizzamaker
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.br.pizzamaker:Metrica

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.br.pizzamaker

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.br.pizzamaker

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.br.pizzamaker:Metrica
Framework service call	android.app.job.IJobScheduler.schedule	com.br.pizzamaker

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.br.pizzamaker:Metrica
Framework API call	javax.crypto.Cipher.doFinal	com.br.pizzamaker

com.br.pizzamaker
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5171

com.br.pizzamaker:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5256

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/data/com.br.pizzamaker/files/ZPkFS.log
Size 12KB
SHA256 bc54428e5a17a39fa74d308870777b71a9c9fd09aa2640233108df4017273d46
MD5 2951ed813629468d360201df2fa9344a
SHA1 f261d37fe9255692fe19d32ee475b03ec55389e1
SHA512 c31d144746ab3c4be0518cf9848802f5842550d68269a62d213e16e545e5f80bc543de4f2d3c2107b89627efe90734179445e6852b7a50d35cb1e1a5d33e3ef0
SSDEEP 12:7+tY6KHXD+QBncQmtVftPRQBncQm2zZZHFdkqLWs9wfcGtSBw8w2RmBEyPbLX:7+tsXagncL5WncCdOqLpKfcQlNGSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/data/com.br.pizzamaker/no_backup/credentials.dat
Size 233B
SHA256 7023ca441f1734e3672e06053bd45147abf7cc15e155651557fd5b9bba6fd7ae
MD5 ce662250f8551086d5f232436f934c75
SHA1 a6057e05bcc1b10e6e4130cff5605e8557fbfc2b
SHA512 5cbe0c8d661dde358ffdd99d2cfe15268d71762d115322db906f110c52d641b5564f87288bf16140a4e55b8e73420d9f8ae48a998a29527e9f87c952596918f0
MD5 SHA1 SHA512

Submit Download

db_metrica_com.br.pizzamaker

Path /data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker
Size 36KB
SHA256 300f36c90b50589ebc8139d4dfd74214d22711838235180ac3ea7a9d3af64b73
MD5 e9891e87d24bdc86c52a220667f8b6ea
SHA1 c2c871bb55f3122a792219f99bca38a66a2042c3
SHA512 b6946d59271813e56801d8959e68892f2472ce02cf397b8e990821cf3567878df00218ebea14d5ee4418fcd9b0d07054d87770ae7ea200abe952b2a507cb71c8
SSDEEP 48:TVE8WctFMkUe9kftcPSN4nc7k9+qfje+gX86uSInpXI89GGgLb3p6ej1uK4WbzfL:JE8LtFNpkFcaN4ncigJ5bH
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.br.pizzamaker-journal

Path /data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker-journal
Size 20KB
SHA256 9d2abc75d12f2a1f9b7d49af996192c3f3db7d839ef74b66d02fbafc30164e8a
MD5 1854f8ffc4b294cfb1ed1bcabea766bb
SHA1 764d54beda47d9057600657178e25b289c1d638b
SHA512 964c883d041bbc28533436625e93c5828c68ecd839090ebf203297db0841dd69ebe570c1ff6854f9eada715bfc611e6fa6f3a011b8d6a19302ad747a92c11757
SSDEEP 24:TLQfcQlNGSP//IYzMm3EHszlgncPQD3EMNdSzPn3ncC5:TUfcZSP//fRUHAlgncI/dav3nco
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.br.pizzamaker-journal

Path /data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker-journal
Size 20KB
SHA256 e95afbde71ac0c4288566dd2ecc757bb4580fd654dddbdc3fade0f9793846aed
MD5 e9e5b76a9014b0dfc0de88960eb9caf7
SHA1 8f158eaca6dc51b9cdf86f35998e8888d04b754b
SHA512 c4780319ff36d45ea4f59567aee91fcea7c74c9183161734a78b76bd3b0ef8e8329387e608c59771f9a11dcd3b36cf8497d251b1f69062d3dc23d678a02a9b2e
SSDEEP 24:TLwfcQlNGSP/1qLiuWRGSRFY0MmDEwZxzlgncDDMEMvgsncCG:T0fcZSP/1qZWESR20gEdlgncD4ncb
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.br.pizzamaker-journal

Path /data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker-journal
Size 8KB
SHA256 fbdc7bf9a0eddbef21b422d03d66a754dddf689da72624218c9fa8a14aa4cede
MD5 3a49453abac8b5efb9c8b2eea83ef06f
SHA1 5d33ab3335d70d937d7ad6419f6a4c12a274bcc0
SHA512 dab89d7bdb67e338eabf74a0c976f3651c01c4fdde725f26bb48f4f3dd781a12e1b5479158841866a52684165906ac61ddbe808a3ff0717e14be450a0d3a136b
SSDEEP 12:4kc3HW7lPTWRbeYCj4DCo17ryX7+jL9erqyM0ji+8qLJdTRmBEyPb8n:4D3HOWvy+dyMG8qLJyGS8n
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.br.pizzamaker-journal

Path /data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker-journal
Size 12KB
SHA256 7601ff9ff2478e8ac4a2531f9d18e1847553e58f3bd2cfe39e8b680260a1a447
MD5 3953de23a837032ae245098a6b88b8f2
SHA1 0437b4e14493f346916d4100d1fdf26137422b2d
SHA512 72e05f5748b7d4a0685514b51d11b7a5c00dee643e53ca8512369f5b1727e1ea5bbb9e5ce916813f6320a5d5952b7784f9a8f33c9d7d64b6d5dbb8dc32da5a90
SSDEEP 24:4QaPsqLGpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSgx:45sqVE8WctFMkUe9kftcPS0
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.br.pizzamaker-journal

Path /data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker-journal
Size 12KB
SHA256 80000e62e51ca9e9535f50e67e01b7f90c22ceafc2043d67acb4f56456c1258b
MD5 b296f7f4522cd94b7e76cc3ec55eebf3
SHA1 0fde8a18310076cc9da6ffd3239a07a5935e8477
SHA512 356d584b9604e788d3175add42ca532e44eb4265f41e92bcdfcaa269a9aeb55991b241e34467f00b72044646b23d90ada3e7f79cbb92ef4b86ebb12c1d32b757
SSDEEP 24:7+tXE2fbNi1qLZUpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GS+:7MU2fbNi1qtDE8WctFMkUe9kftcPS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.br.pizzamaker-journal

Path /data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker-journal
Size 12KB
SHA256 1da2dbb5ef05a72cb254dc8ed81b6ed809685cd84026aabbdecd7e765e351035
MD5 5f803626212c3907f6307cd000ff2264
SHA1 a2746968a4bb503cf5829a21554a9aaa9bf7e663
SHA512 db9d2523c7305761ead380eda0711e8dfe8b59c7167f5a2d488bbd85c918df2d3c24a9b6add21d3192b378fd6a552d6731f715d59e14e22c6d2df65ed8b49f8a
SSDEEP 48:7Mitk9uqfje+gX86uSInpXI89GGYxLb3pA0ej1uK4WbCqlE8WctFMkUe9kftcPSk:7VEMG5bCOE8LtFNpkFcak
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.br.pizzamaker_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 e90786bb0b5f2bf788987053823da2690b7efa461acdeb98e4b55ddbdeae161f
MD5 d51f8fe7fd5816fdc5b15599cb0d59cf
SHA1 607ebe65a9dc922e0ccb7ecdf41fd7f20e663ed5
SHA512 da3edf00d4d1dcd2014f133a1f52970da6f013f06248d3ffb139fefb68d6dccb9a79447ab27769bdec8addf837e75f4e2a0fba61f3a415cfd06410c8be23d9e6
SSDEEP 48:TVE8WctFMkUe9kftcPSB8U+4HdNbC7tjE4AfjO8lZ26If1oGe25VTpmGTsbzfL:JE8LtFNpkFcaWTuNbC9HLsbH
MD5 SHA1 SHA512 SSDEEP

Submit Download