4ee53f8c4e6ac0467de6b74a910772b1637e8d87727ec7cdd9a94ad0b8b17218

Analysis

max time kernel
179s
max time network
152s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
03/06/2024, 05:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
909c349fd23deae561fe9fe31a87db4e_JaffaCakes118.apk
Size 3.3MB
Sample240603-fnv2ssde93
SHA256 4ee53f8c4e6ac0467de6b74a910772b1637e8d87727ec7cdd9a94ad0b8b17218
MD5 909c349fd23deae561fe9fe31a87db4e
SHA1 9a997eb1a5333a4671f0e4f2082823f96a8517f2
SHA512 97ed85028d639eb853e0931688fdc6b365728f6d967b74900726f97cfa9570989b8aaee02c67c6c5ef429ac4be5e47be497b542854732adea684919205db3931
SSDEEP 98304:xugfuWWFkFL7EBasOqFRl8Fr24J73DwpwOtywXN3XWiBj3B:xvLWOLpEcJpXw
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	goldenburger.creapp.com:Metrica
/sbin/su	goldenburger.creapp.com:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	goldenburger.creapp.com
Framework service call	android.app.IActivityManager.getRunningAppProcesses	goldenburger.creapp.com:Metrica

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	goldenburger.creapp.com:Metrica
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	goldenburger.creapp.com

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	goldenburger.creapp.com

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	goldenburger.creapp.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	goldenburger.creapp.com:Metrica
Framework service call	android.app.job.IJobScheduler.schedule	goldenburger.creapp.com

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	goldenburger.creapp.com
Framework API call	javax.crypto.Cipher.doFinal	goldenburger.creapp.com:Metrica

goldenburger.creapp.com
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5204

goldenburger.creapp.com:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5313

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/data/goldenburger.creapp.com/files/ZPkFS.log
Size 90B
SHA256 5998c40408586b9f3b7fab52e1f23b8d1279d00c8377438aa6f131fa1c2b94d4
MD5 2fd8dd0428cc66fd754e32b9f5384f48
SHA1 08bcfbd2bad7aa68153ab1a205f2e56e4ea8df83
SHA512 26769deb6a3fef4962f67f76f9eebe03048ba62ea50db32772b84acc71a47618314115733d6ba0040a411bd01526bdc288696d46dcf2cd96aa286f3ea76bb35d
MD5 SHA1 SHA512

Submit Download

credentials.dat

Path /data/data/goldenburger.creapp.com/no_backup/credentials.dat
Size 233B
SHA256 21d062bbc3a9abae251ba6d7b3f4f44f2566bd56c85718781dc84ed9975e5ff0
MD5 de12f4e73449ba83561bbf953d480fde
SHA1 e465e34f97853f87b595c2e4c8d8e8d160c225f5
SHA512 1cd91523eed04d5a7c65bbd540ab2a70ef0d5d67e79c0105818f5e1233224c0a41e5355e9bd687e0c16f587950e925cea19a0cad75a0fbcd126267e4385404af
MD5 SHA1 SHA512

Submit Download

db_metrica_goldenburger.creapp.com

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com
Size 36KB
SHA256 b70a68aa2764fa8912ccc9cc426618dfa8a19a2943de03983d68e0638692b5a2
MD5 a7762cf5f7f98885f2c30dfba19f71cb
SHA1 875ab54e94487bfaeb1da2edcfc2d2f7cd89d4a1
SHA512 4ca2913b460bfdbc7877376d67972c1999dce0744bc4cae3c1c636a401f5b0bd09b883746365028e781b95ffcdfb6c5c15d3f97ebcdf25250aa519bc042f97ca
SSDEEP 48:TFE8WctFMkUe9kftcPSN4nczabok9LpfjM8S4I8+ALTIUuJZIp4Zbv68I+VI7Mow:5E8LtFNpkFcaN4nczQZiw46bn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 20KB
SHA256 ff4b0c9ca8d1ea97c10b276c6dbc98260f1120ef62d8e1b12fb09a412dd85629
MD5 e10280b9dbca3a1000c1ae7ffba8cb20
SHA1 1bb3814ea3776a93661fa58d667cd9a4fb2654bc
SHA512 e630cb1c8c1acbc263251343ddc0960dd29b2176a861215e2e2ae9856df1e31bbf16bf18d3f57a2208a55ab4a15867f0262ab839e32dbcbf80e58aa680c2f78d
SSDEEP 24:TLQfcQlNGSP//IYzMmqfEHsfwgncPQD3EMNdSzPn3ncC5:TUfcZSP//fRJHowgncI/dav3nco
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 20KB
SHA256 2cfef232f5d20bd0831e3a6fa9570bacc374e4ea336fd190bf72f83c6115754d
MD5 1880f69664118c8e6059e8ef27c2bde7
SHA1 3802671ce48af7b4d9e2696a8f39de1cccc01ef6
SHA512 dada51475564f6f26bb91cd10bb89d9a57501fbfa6347dd05ef552b23f332f84dcb1b50be43933fe31536e315d6bb7662712f2c09d0820d0ee02a4d4a1ca1ea4
SSDEEP 24:TLwfcQlNGSP/kqLiuWRGS0AY2Mm53EvUfMgncXQDfEMtSrP/ncCx:T0fcZSP/kqZWES03OevQMgncXQ8ncA
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 8KB
SHA256 63764f23ca11ca6e1498b87b8b6fcf071b1bcd44c1a3ad30d03d3c7ab9efbaa6
MD5 33af498085985d47fe809671ef6e8ce0
SHA1 054955b5c3cc777e4f69dcbc4d2d009bb80df292
SHA512 ec3ccf32538ce8afc1f88f1e55cba6886e4bdd3b49dfdcc66b67a19c8f62a99cc10e8baaf771328cd3a8df2a61b63bed4493227e061748e48eaf311fecf72785
SSDEEP 12:xXcLcP3HW7lPTWRbeuvNZcGtESW/zgX+jLo7Bo7jilEqLJdTRmBEyPbLCJ:1coP3HOW5N+GDW/0X+moiEqLJyGS2J
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 12KB
SHA256 217e51ffe7d827c56f3a515de5fe4cd5a8c7171ae2b5595232fd1ed59cfe94dc
MD5 917a0a9ae20e9633e94d53f1c6ff19ac
SHA1 2154e16b1b0c5f29b5c36f2f31311bc5af2a0265
SHA512 21953f151ba1574b6e4ae1fa8e17159ee9c8857690c76a3c09e18227482258d5565baf5a7b2ac9464fb9238a6bbbbf454edf637259703aa171d3e8219fea710e
SSDEEP 24:1vaPYqLGpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSXs:1EYqVE8WctFMkUe9kftcPSc
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 12KB
SHA256 ed68ae71ee9d78a5b730de9cf04bdf1d586a0c6565e0b9b629862f52c19d6940
MD5 6356aa0858b5721eff291e493a8475ff
SHA1 7492a643597fc4fcff22c91c11029e558dee34a1
SHA512 67d8bb837f1250eba5e49f3f16ca5d869e0d79a763bd0c17c4b6316c698c0826a4648efb341e782b823919c18348731fff5090bc5a82da6c54693cdc2191ce53
SSDEEP 24:7+tJE2fbLijqLZUpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GS6:7Mm2fbLijqtDE8WctFMkUe9kftcPS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 12KB
SHA256 322b6f2f8ab07698ef6f4b91119efed9d830961e1c56c1364d00204ca94bfd54
MD5 01183837a93e28afe3320eb975a88580
SHA1 c4964532bc292e22df3298010a16f7929b88dc1c
SHA512 7f4ef98fac01522c2b37388138952ce06ffdbc3def39d700df9affd70254f1d05723c05411e6270b73344c01e1bd08162ac5bf86d8bb83e04f984517a014c666
SSDEEP 48:7MHaTBk9+pfjM8S4I8+ALTIUuJZIpyZbvwI+VI7MoDNbqq1E8WctFMkUe9kftcPl:72QriwyNbqeE8LtFNpkFca+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 a1ffff7959e8aaaee902f091215d35280d74761c6a19cb370d42af31b82c119f
MD5 c0d42326cacf47c8eba3ca2d083b4b71
SHA1 846af9803e39b1ff92e1a868baa9e3fda8c9d53f
SHA512 d5b3ec484ef4916a0f2217388d0f01f9ec7c20b933cf3955dcaccc1831e0521d40ffc45a1a1cc62521d33c1a15fd4faa046f60025ae8c92a039d770be42313a9
SSDEEP 48:TVE8WctFMkUe9kftcPSB8UgHVbCbJEjE4AfjO8iX2vI41odgo2b09/uiTsbzroL:JE8LtFNpkFcaWVbCbwk0sbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download