1f0cfe625ef96d9362427052da78e4902115d0c0c8df6e3d6946c9f65b336f51

Analysis

max time kernel
178s
max time network
177s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
31/05/2024, 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

857801c464917c1315cfa7b4cbab4fd9_JaffaCakes118.apk
Size

5.9MB
MD5

857801c464917c1315cfa7b4cbab4fd9
SHA1

981b4a85535f7d02debb0646a7e514943cd3d6ec
SHA256

1f0cfe625ef96d9362427052da78e4902115d0c0c8df6e3d6946c9f65b336f51
SHA512

406227d2881f6583276d91cec097242386376b2e317cb40024d2a89a22f319741c595cd21a87d5aa4f43f945e1e740f7d206ff2ae2bd8f8c994a42a4ee7dcd5c
SSDEEP

98304:5fsadOybik4gpS8U90VUJyr53bgOE25JAOPArfT6+F95UHmZkg1:MLaS8U9qUJyVgORbPgT6qKi

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.br.pizzamaker:Metrica
/sbin/su	com.br.pizzamaker:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.br.pizzamaker:Metrica
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.br.pizzamaker

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.br.pizzamaker
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.br.pizzamaker:Metrica

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.br.pizzamaker

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.br.pizzamaker

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.br.pizzamaker
Framework service call	android.app.job.IJobScheduler.schedule	com.br.pizzamaker:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.br.pizzamaker:Metrica
Framework API call	javax.crypto.Cipher.doFinal	com.br.pizzamaker

com.br.pizzamaker
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4280

com.br.pizzamaker:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4387

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.br.pizzamaker/files/credentials.dat

Filesize
465B

MD5
d427f18c90d8da94cf9187e5240268e5

SHA1
0cce398b3594891957e1585fa9a2415e0dc35b1f

SHA256
6aa3338d1e2d5335ff896e3d54c2debbb566f1e72f261fe8503c5628a46fe9a2

SHA512
72723c9caa1fd34fc58afdaca9bb89e2a28b2b5dc09c4b1c06d6e7c443929a5cc4ed75a611834795171fdb5bbed8e02ebbc6d7c80da879227f696ee911634407

Download Submit
/data/data/com.br.pizzamaker/no_backup/credentials.dat

Filesize
20KB

MD5
9725a53465bac3b84eab0643aa2f7583

SHA1
2f162ab836e89faf36571a897268b7890694402a

SHA256
92210f44829eb1bf1f71d1f52cdce73c7130f1ad383790affaa0dd7aabc1dd5e

SHA512
b0e213c6d0753aeb0e3f4950359e3f00a9a953cdb4dbf6ef095f96bd4da960f3c344651cb864e7ecd75aba7266ce4f22bdc9c71aaae12a1f7b2fb13f54cb72ba

Download Submit
/data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker-journal

Filesize
20KB

MD5
9811688b3962fbf39bec7e328a789c43

SHA1
bb862061ee9e010f0d93e8d40641fc05cfcbe2ef

SHA256
b3b39d2750fba8b82362662f7a96cd6d315bfd7126d7ba54a885ebf8a20a7437

SHA512
ae260f036cac1cd9e5b541aa10b7817a8570443d6abb5e08759c449517fadb5d675457cb5404f0c82e4a29411f34eebb24045d630aefc00b0c4c11d8283c1caa

Download Submit
/data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker-shm

Filesize
32KB

MD5
a93d23913d652f6c667e19ebd2b0d393

SHA1
d062d58297b46b175f81ad57771cd8113ab5fa1a

SHA256
2724507132b109a8bfbd6c6ea7f5344baaef51366279758db23df634fd4586a3

SHA512
9474d1ddcf7acb64b042be3da67722364f44bc36e3bb6f880960813ea671b0f14092fdb644e530502b12ab52ec3393f1fe9a166c4bd57316ae63357a21685a56

Download Submit
/data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker-wal

Filesize
402KB

MD5
4476dfe998868795a8abed338e98c10a

SHA1
d3fd1d4c7d7e5a9d8e18889d8e7c9549af41dcaf

SHA256
fe3cfee6eb468ae1df25152a43d00bf27c0d6b0252b5b53916203a21bbb15ed6

SHA512
1d57ac0dd47abecbc77194eafc3270c8b5e640a8017f56485bd03717393638cf5c9365b5592abd0194dd99cd1e2decdcc118af72bc34556725fbffeee35ef1bd

Download Submit
/data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker_20799a27-fa80-4b36-b2db-0f8141f24180

Filesize
4KB

MD5
ea2f4a476c4200749bea503c7ea0dfbd

SHA1
0f1f508e7667a137cf49e044b0ea36fff0f7ab9e

SHA256
60dd1f982ef676cffb798c1a3c9ee933b6ee828fb49ff66f32c86554309a3982

SHA512
6eb284a98a6a83689ec1c27d6f3239e30fea594c714b024bc65f1bc8c0d70d40b373f3396b1c9470c2ceb5c29ee6ee0126070f45224ab686d13957b9fa979a79

Download Submit
/data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Filesize
512B

MD5
39b719a8460d99fc79e650c36e403210

SHA1
39ac8dff4c051edf24062f79311757abddc135af

SHA256
3ca29347d02694f0322a326dbff2584a1b8b3185a6e565dcad29a499cdef7e7e

SHA512
a5a434aafdda2ed187c77cf790191609a59ae199d4412cce4274d2e79f1f1d71c3554c35a7a6f77dcad50705fa1e19cdb4a9ba9f20a6ffdc7566af4c20e72d38

Download Submit
/data/data/com.br.pizzamaker/no_backup/db_metrica_com.br.pizzamaker_20799a27-fa80-4b36-b2db-0f8141f24180-wal

Filesize
173KB

MD5
15a10c75997d54f35225ea8919bce038

SHA1
b3a9353b7072fe534bf8a68e795af798cde22d32

SHA256
a445a39b502bf8b776fd447503787ef50410d2b30a475ac442bb2f22747d1aab

SHA512
e6dec1665ad76544912e1ecd6c20759e1423545fe05438d2d7bab9fbe812d77f23cb8a9aa0341e229391ac8fdce4ad7acf1e14aaa4522be1229f10b590ebba60

Download Submit
/data/data/com.br.pizzamaker/no_backup/metrica_client_data.db

Filesize
20KB

MD5
511d04c1ecab9d72f905c070556399d5

SHA1
0609fda061e72e3c29c60e3c9e0714ffff2bafb2

SHA256
58538c6452897cd7d70081e956ccd945b23876f0ec0113068df84741495ac03f

SHA512
b09abebc048079f34f63f1f04f5a32f5332b6c1017fc59e92734a26ebc40c5d26edf33a1fe49285138e244451309e470812ae6685c8e77040d47d81b45d9f5e3

Download Submit
/data/data/com.br.pizzamaker/no_backup/metrica_client_data.db

Filesize
20KB

MD5
dd2df99a92f4bc17b3fd16ebc39b16b5

SHA1
ecd4527540df9ce4db6fe36e82b53988c4ad65f3

SHA256
e9188cd393bb4564eb44e6c9caf47b9d8a166ab4e476971c4bdeb86388bfec33

SHA512
255b1d9a2469914b2dbb0db2faadad8547369ef9c9f89acd1cc1fb1a13e4efff8d49df40808f01d1cdefaf829ce94bf1594d5c58d7c041fc8f23a1abd8914d03

Download Submit
/data/data/com.br.pizzamaker/no_backup/metrica_client_data.db

Filesize
20KB

MD5
06956fcd61dde81412cb470eaaf15574

SHA1
d2c4ce7f735d5f7d834928e5e1b1e635d1edeed0

SHA256
3dbf28ea5983f0dc2d1f012b666219bf75e7e13ed73de897a9b68cf6bae2a20f

SHA512
8116faef3c3ddf6433dedc38420fe569e29a884cdbd7dec8bf454a22db41f9f5fd80b14a5c36a2357f9bc448024c77f619ab6f1a0b71fd2a195334b7d4726ba9

Download Submit
/data/data/com.br.pizzamaker/no_backup/metrica_client_data.db

Filesize
36KB

MD5
7f6086910c88c23b31b2cc2b74c7377d

SHA1
2ada605d7234f7068ec502fbf7eb0ad361eeab05

SHA256
2fedd0361a15a0517dbcd0957d1b166f01b4e95a2e52d491c72654adf64051d3

SHA512
76c4ccb26f4b75bb47074d76283a1693bc1906c191b4d837ce564d2a64c1c41bd4b3aec69f5076999b46e0ac0ab6bc0f9970f2f1fe5196d9b70aa53d03f46f3e

Download Submit
/data/data/com.br.pizzamaker/no_backup/metrica_client_data.db-journal

Filesize
402KB

MD5
fbce34e47c59f8c2047c37b513a0f44f

SHA1
539885609a1c05b9c74709254879519a35956481

SHA256
9ade5cf272ab132fc6dc65367796d36f9daf594e6c6422c54335394c26319462

SHA512
8bc5d805558d5421ba0db9e9068e7324f14685f5483b01d99cdf1faf9dfebb3e2f133e9174c42a0e59181a831be99f7fe2991a4ae9d571df0ce5ac67e01a1cfe

Download Submit
/data/data/com.br.pizzamaker/no_backup/metrica_client_data.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.br.pizzamaker/no_backup/metrica_client_data.db-wal

Filesize
8KB

MD5
c3aa0e7ad3df831f097b86a6f121e8b4

SHA1
46bf7d99df2a3f1410aa624f844c75d88e8fb396

SHA256
8d29d16f33a3b0dcf69cea24203974ebf5fd49c0b8de78a8cdd5d752cbc5a20b

SHA512
bf361ee5492e1f51049c97d6e849f96ff49725730ff1bccd71c42981e26759ece6767c67b088b08365c2b9011d4578faf17c44920fc7e73368a520e807948078

Download Submit
/data/data/com.br.pizzamaker/no_backup/metrica_client_data.db-wal

Filesize
32KB

MD5
7a2428a1e8bb5d731c72dfbd14d1b4de

SHA1
5d5d341f8c3b3c45000f3656b7033ef220d124ca

SHA256
c0b427ace0a72e859f0fe4ed3a9518081d309d38bba1d390c78dffb0a28c9ea4

SHA512
d3cf6bcbb494357235f0f22bf89be34bcdf1ee473ddc26701a832b3b0c5c70ee204cab281ec511f8449e083d179d48bd46eeb977833cf5da874be13eae9a53a2

Download Submit
/data/data/com.br.pizzamaker/no_backup/metrica_client_data.db-wal

Filesize
8KB

MD5
18e312de34980a6159a5991cd3a613d3

SHA1
7a03990ab2c8666f2b19c096fe540fa1567b2a62

SHA256
8f780d718d771458d83394d2343bd07c795871ad8ef77072cf487c6167b91a87

SHA512
2ae7c2f334be3cd59e2848347137a8a236cce8313c5e9d7de9c3a1e36ae0a5311f611cfeb20c1aa0ee3231f7ff79ee10842cff7e60a2a5f4f1b92a57d87e977b

Download Submit
/data/data/com.br.pizzamaker/no_backup/metrica_client_data.db-wal

Filesize
32KB

MD5
e917df9ce84fcc44f16aa30e39d7aeea

SHA1
93a0c35ac860f04f0bb7a06689a48ff342bfccef

SHA256
6e92e5333cd81463cb6c2861bdb79fe82bbfadfaf84d5a379825d21939bc7ecf

SHA512
9455894a798de4f917a459ea197c7befef6f57491132fe047f6fd43503834a4ebde44dc5519d4c5339023962905f41e981100a93a27f3397f18451564575c722

Download Submit
/data/data/com.br.pizzamaker/no_backup/metrica_data.db

Filesize
44KB

MD5
3295a5db67147384900e9e3a1e41539c

SHA1
d5672c73ce46ecdbdfa16ac5f92368276e9c4114

SHA256
bcecb20b26c40712da4d5c891ed5fcf15b03f6312063af57de8d14fddbea6726

SHA512
97ae77afca76e2da421d1451b82882942b13ace3b76342e0f1b6d7823a14448de94a68910cbdb429adc6197042191249499eb14fa4f512bf92f31c77a526f208

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads