02bb61463e6488ff0e0d796802bbf4e6ff7a3af5e131331dcb8bbe75a07c6c6b

Analysis

max time kernel
175s
max time network
151s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
01/06/2024, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8983ada140ff2064a5368f37280438a8_JaffaCakes118.apk
Size 5.9MB
Sample240601-geya8scd97
SHA256 02bb61463e6488ff0e0d796802bbf4e6ff7a3af5e131331dcb8bbe75a07c6c6b
MD5 8983ada140ff2064a5368f37280438a8
SHA1 2c06a0ecc07c3fa922c2a10aff40c5ddefb1aa76
SHA512 fe1a26b3e07aee47237aa2445331905be41d10fc20eb0bc397f999ff995e155dcf1ecf0682a9c4fe91d7addeab43cd9d2ba9daa2571d395bb65a652df8852773
SSDEEP 98304:XHQljvUKULoYgMmTRavh0nsudJ6VMyq0QBa9uqArf0iLhZ601mT6PPm:XHQlDU8dcKPMU0QQgz/600b
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.appsmart.delivery.darbarmuenchen2087:Metrica
/sbin/su	com.appsmart.delivery.darbarmuenchen2087:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.appsmart.delivery.darbarmuenchen2087
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.appsmart.delivery.darbarmuenchen2087:Metrica

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.appsmart.delivery.darbarmuenchen2087
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.appsmart.delivery.darbarmuenchen2087:Metrica

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.appsmart.delivery.darbarmuenchen2087

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.appsmart.delivery.darbarmuenchen2087

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.appsmart.delivery.darbarmuenchen2087
Framework service call	android.app.job.IJobScheduler.schedule	com.appsmart.delivery.darbarmuenchen2087:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.appsmart.delivery.darbarmuenchen2087:Metrica
Framework API call	javax.crypto.Cipher.doFinal	com.appsmart.delivery.darbarmuenchen2087

com.appsmart.delivery.darbarmuenchen2087
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5220

com.appsmart.delivery.darbarmuenchen2087:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5288

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/files/ZPkFS.log
Size 12KB
SHA256 b67e69d14e780e5b8683566de63cf4d3ec88a73c2e1e885fb31e31c3abda2b47
MD5 1089d01941a5756b3e9cc964376248d5
SHA1 e45d4c7b4599fa1150c4910c3dc923b233913b36
SHA512 599ce766836ffc80013938ec9f1ff65897860e1b2750bf4d04f43096c48e9592b0fa77983ffee677e9448a4610cf462d0be7a7357fe1d7434aeabc380ec79bf0
SSDEEP 12:7+tFEyrETQBncQmsWOWwEKgGQBncQmABtKqLytMwfcGtSBw8w2RmBEyPbW:7+tFL0gnc7OWqgnccKqLytjfcQlNGSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/credentials.dat
Size 233B
SHA256 44a07758f9244d1c8dec516b5c637277cb3f1f5f048e6bbfbf8da23c23c579de
MD5 0da732567413cf7cb70a370c7ae8dec3
SHA1 0a8c74b881f7da7ca085d87cd1f3d34ae6ae6a17
SHA512 7a19ab2b808b6e08fdd35e5e21b6bece3f693d30739138565cf48d429f94034b7501fb297124cb854374d8e579de7c0b046f42a7e6d4f877978b84c7592bc0c6
MD5 SHA1 SHA512

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087
Size 36KB
SHA256 05d82823a2eb050e18b865a864361c16c826b41172da7fafcc6e01051a10572d
MD5 295f07b6b8a604f504f6b5bec76c4bb4
SHA1 0fbc22c1f81710ddcac06b0dd77d4de1052945a6
SHA512 bb02f672bffe674bac6bed9a2d7cdd9679fe53bbfaccb6b2209064f135021a7fa8016324e1d35349be05f6469b6fef41d3b1d0de6d5bc43acfb6762112424e35
SSDEEP 48:TlE8WctFMkUe9kftcPSh7vnchGpKk9kK9fjD7dXIgu8sCMIsjpY14+3GWnS9wMoo:ZE8LtFNpkFcah7vnchGuLb9YTQcO
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 20KB
SHA256 c0444887060448196b535797f206429c34d425bd15234c77208966967a3245b2
MD5 f9c48db94235a8b17a6f5cdc5fccef71
SHA1 d2b0e30b8c00623de604775e27d0e4e1d4bf2452
SHA512 bc28b73b0b71741c7a164ccc5020033efebf2e52064f5156943dc6efb270b19dbc84c098a8d8a4c38bef6e4cb72c21ba1d0c888c589e3afa86d1065bc2dc10e5
SSDEEP 24:TLQfcQlNGSP/1YI4MmuuETPwdvgnctzickLEMmox2gnchGOv:TUfcZSP/mIgu1T8gnctzic7GXnchGS
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 8KB
SHA256 ed25b3f25731389dbf6a7f52f6f80e6b139cf823ad2c067d5f01d153e856eae2
MD5 7d0d931948c0322fe215ca3207bc0ecc
SHA1 13551f0073d748d4ba1ab836771a3b7ac499de45
SHA512 257fe2342f9574b89b4b83636455f22397267b99959c9bbdf703f68762deda9d6aaac31259808588c3f5ca30b9cfdc20c40b2656337fcdf6a61e52d7057a6a9a
SSDEEP 12:xHO2e3HW7lPTWRbeoDM1ysbmfwVoH+jLjcji+yqLiuWdwRmBEyPbn:o2e3HOWhM1pm+TOyqLiuWRGSn
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 8KB
SHA256 3b6a6c473741e7b4789dbacfc6595d451b1e16dc9a7014867f9f94d20c867348
MD5 ff6367db746fc31fcce3b12225cafd18
SHA1 e3baf8ed27ee2197a4931568599f26b1048127a0
SHA512 32d1bc4bdfe757b1f0e55df7e9fe29ecc0fe37729b02f1213877c6f4bf1fc799789611e7157293ee9782d45ebdc4e32618e1adbb5b5352be9b79dec797275819
SSDEEP 6:xHOnQbPDnkPzhgg9bNFlLdrlOERX4PBX4ogLugMBX4suuKb/sG:xHOnQrDg9gqLJdTRmBEyPb8sG
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 12KB
SHA256 500d8bcc8e4de641b9bce01dd6c819d94f06081749ae59d83902c7f036848269
MD5 d30f695a8eeff1cd0395d987302a12d4
SHA1 8c6e31c0ff07185cdc67b2bb6fa0781e47130b1e
SHA512 9d540d181734d7706cc92f9ea82b7ff075030e6e44aed271468451b176d5deacb299d26ccd9ba3ff5a396bae58cdb57632c1e0ba18e4ea2497afb229cf143167
SSDEEP 24:7+t7GEoqLGpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GST:7MpoqVE8WctFMkUe9kftcPST
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 8KB
SHA256 7795e2945c3d309840c9a17cb3f06041f162d73945f16acda2e9289c567da617
MD5 566d5989cdd406b7717c0eb25dbebfff
SHA1 0283fd208f3c50e5dd5a89358c1a3817b3a7987f
SHA512 be80bc840cc575248afb94351404f2e2a0015623ce5c96da241dde29ca240472b2ae0de57984561a629ada0f57af0e125898f8df80bb12d213571c97f286df51
SSDEEP 24:7+tQjfqLZUpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSA:7MQqtDE8WctFMkUe9kftcPSA
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 12KB
SHA256 a42dc2dce541825b5c83317a45eec480c17e72df49fd6186e9e364438a904821
MD5 d643cb250a25f62600f9550960fd10b8
SHA1 6fc20e95f56a8654965d39484b9f87f7a7aa0d61
SHA512 453df7e8766370b9d5e43bbfc6ad122185c919163f91397d1c788a2a7802cc1fa622343d5587df960e22dabf00d70eb26444b67c5b9e65ebd169daf1dd94b6e3
SSDEEP 48:7MLLk9w9fjD7dXIgu8sCMIsjph4+3GpnS9wMozQ/EoVq1E8WctFMkUe9kftcPS3e:7hb9MQcoV+E8LtFNpkFca3e
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 891a428ef4edaf4dd721ea45bafb23fc95e95b8a0d1422d2d6505bcf76bde122
MD5 16304a11394725a7e47eab3e09a05323
SHA1 788090da82a34952ffa79198d5a802a016193e45
SHA512 a758adecdbcf8f71b7406242012636f6a724fb3ceac905d8a5540d0a1981d51cf50d57602046eeaf51591c9b9d4d8578425fdde06493822ff177b8ba87b1fbea
SSDEEP 48:TlE8WctFMkUe9kftcPSB8UMw9HHbC7yjEdWfjSLfb27I/C1oG32O1jnScTsbzfL:ZE8LtFNpkFcaWWRbCvMHzfsbH
MD5 SHA1 SHA512 SSDEEP

Submit Download