d2139ab5f76dd6f5881260dc79113cca5c7a591891fa5cf6edf373a426de8f4d

Analysis

max time kernel
179s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
03-06-2024 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9140986b805a5582f5e071dfb76f94d9_JaffaCakes118.apk
Size

5.9MB
MD5

9140986b805a5582f5e071dfb76f94d9
SHA1

d00cc345916ebbb9299b45f81e7af056b161af7f
SHA256

d2139ab5f76dd6f5881260dc79113cca5c7a591891fa5cf6edf373a426de8f4d
SHA512

2ee0cabf749a699d33371cbc2be22ccc0713bd6960945a5f5d91a2d2ccb4394eb655cd63cac2088dbb4a6078242c4b28861b39980f2cb06c0e15dff1e668b00c
SSDEEP

98304:OemGwKfKK+7BNygvtLMsTOf4uXJvUfjetu3vnLC6IsabUn1Arfaur1Y6dsm+2dL4:rbfodNyAmsTOZX14jes3fLjV/gZm621B

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.gentongsehat.fudzapp:Metrica
/sbin/su	com.gentongsehat.fudzapp:Metrica
/system/bin/su	com.gentongsehat.fudzapp:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.gentongsehat.fudzapp
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.gentongsehat.fudzapp:Metrica

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.gentongsehat.fudzapp

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gentongsehat.fudzapp

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.gentongsehat.fudzapp
Framework service call	android.app.job.IJobScheduler.schedule	com.gentongsehat.fudzapp:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gentongsehat.fudzapp:Metrica
Framework API call	javax.crypto.Cipher.doFinal	com.gentongsehat.fudzapp

com.gentongsehat.fudzapp
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4621

com.gentongsehat.fudzapp:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4689

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.gentongsehat.fudzapp/files/ZPkFS.log

Filesize
36KB

MD5
9a9fdaa26a8dea30e0a85a390cc45625

SHA1
1249e181764aa79674873cbc77400fc01fd2a410

SHA256
d62f7cf8451d3c8c07ba630b7c30e5756877ca69c72a2782d249c96914b679dd

SHA512
0924d9ee0ba2ffcf4a06328175a54d572a230c577fb9bbedb199088ca54d398d59fca4ec31d2c3c39cf5d19a205755f8eba6b4ca931af633961c1eb867be03f1

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/credentials.dat

Filesize
234B

MD5
d874bd35c07055d2b2d7bd59876152be

SHA1
c5ce22593e4b1c36090cba0219ac91e24f9e5d37

SHA256
c40c6dc4efbd12ee3e2d76694fb003f33d633f37b03db8e9e5130b59747d284a

SHA512
80f5e6ae3f2b4f2bfde115e84af1324480f8ff2dbe7fa51b9eda7b124de8b53e159a01bb019860539a5203521a43ddbedf096cf9b5ed17b98c05cc14c65de374

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp-journal

Filesize
20KB

MD5
693bb853fa96c766a71142f11c955b0f

SHA1
5f4fac4478514f18c197bda68e1fb98bc4b4bb37

SHA256
671e103ff5861b732c3f9bb7c08b72c398b7b07d13c2a06eb4c3b0348236553d

SHA512
7cb4869d49659b175899f290ea7e2d3f09f39a6d460457769af0a6024e1da7803ca0332fe7b7f94af421e9accc7630ece7c2efc0018135e489c43b678b9a53aa

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp-journal

Filesize
20KB

MD5
2b906a7505a5a64755dc1b4c18f5963f

SHA1
97f71bc8e1c73b3e718c9da8ec79803a7a5ad0ee

SHA256
19a5a0e3710c08a4f220fcbacb53a5a456cdfc72970ac526af3280868838b17b

SHA512
df4f4445ebd925723077f24c105645c714f420a5025ca155367a20bc571eea5ea824c8acaae927548887c55450ba18a60104a201605c55a67fb48f995bbffaf3

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp-journal

Filesize
8KB

MD5
67aa9a43f701ea139faa23805c7c7109

SHA1
c5a4651c708ebff1ea8abb1ec2db4ddd6541bab5

SHA256
25753fd9f63e55706a0786a21c14791fdfc94c23d95820f932c47d655b11f532

SHA512
25972dc7e74c4debefc7089454b8a8c0f4c12775f82de095d9e5773bc89c150a93e209aab22d9039a6a79ec9a9fdf82ec6fccc842a27a93e32ae50c1d771fb57

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp-journal

Filesize
12KB

MD5
05b6735b5f9f8977dc9983343b508268

SHA1
b78051087e5a30afbc9dfced53ad77cb2e142cb6

SHA256
c2a51010ef491b6ee200e1532b0f39174a3f1555f6e15822bdb1cc6b41752d5f

SHA512
ca9104fc8f00d7b398a848a9934275808677fc73874717f5cffd1b27d41e4417767ba5b001ef4d0d91ffcaaa3080938aa9e2f4e975d6085db00e3d3429db3cb3

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp-journal

Filesize
12KB

MD5
167fe86d24d9131ca93101d349d04108

SHA1
0f4c627a40d01aa3c3e163b2926a0dc1e1c45200

SHA256
f9a449b9ddf441620012e5580c693d47db9d12323ab4c0e611cda9f894559de4

SHA512
d390f6fba14acebebc53379873fcbe67a287a2a66f96e4448f81bbd67ec21d3c1190f05faf9f8efec94da3230d72e39ae58ac45965cfcab93c8344eaa3c7a609

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp-journal

Filesize
12KB

MD5
79f5fec3f0e9fec3fc2809dcb100feff

SHA1
1fe16e6af2d87fe78c5fa4ca01d3f3783dc5afc1

SHA256
9622d0bde0176ec97bccd7c468c227d6c9dae5380823a9626641b09d432da963

SHA512
277579224eace454cab36bede3d4aa103d2c121271bb2a39048c719777e0570cb3d022296e89c7c5c188ba91b981ea7c58a8a4e039f4dd1b03f977686fe1d96f

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp_20799a27-fa80-4b36-b2db-0f8141f24180

Filesize
36KB

MD5
f5c66ca6d3aefe53f86e0e864d6bcf82

SHA1
305ca1f1beda76287ea3910f644d0ee4a2f9b9e2

SHA256
ce28bdc65509415ea37fd07b66aed41ce6ac38a038aa6c1e1048492da0b395f3

SHA512
1e540eeb17cbee212356d1303e9730adc5fa0419253eac1ba10653a039b2a8e6a9589caacf77ff9b06600e4583f2c8ad077fd238fd68fe75d27aedd8138d7a35

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Filesize
512B

MD5
41c8933da880c5980b7a82ddc7292d2c

SHA1
c04abb15098fdff253e5813732891e626b76db9c

SHA256
d61dcc1f03e6f4f4f4b5aff9bcf52ea5bdd2b8dd6edfaeccb9594557deaf1e20

SHA512
651fcbebf5a39ce504d0565d7442b0f1bb941f0db5620283e7d0169dfd6138db0b86d6ed995654b075112880cee9eff6ac2c91846829fd59df62828bc9699ffa

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Filesize
8KB

MD5
491847215c122af9a39b1c069ac409f3

SHA1
1d071bb2058b72d61a4cd8f117a3abced69241fa

SHA256
3e855034d547eee284bdb77866b272571c70f7d8d2a4bd6c9a9216fc282761db

SHA512
1e601b98da450e2878eabc8c34047c7afd30501059eed8d1ab2c6603d3ebc8b10237122cea778c02d707a4b727656e238ed8b53ca13a0f3b55224fe36b9578ea

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Filesize
8KB

MD5
012eab870d20ff5e64973eafd2fa9c85

SHA1
76a87eff2e68e4cedad90f469f833df4e480847e

SHA256
5b6a5b67eddfc0f486c0db0543715318be4af6be5abe1512bbb17d2618bb2821

SHA512
764f4a493ebd5858dedec125ce8bfb23c72b3dc31ba31a666456cda547ae537bbb327ea1dc6c53478c02aac5efe6e74cdcd97a59761953ec6132cd855ef09cfb

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Filesize
12KB

MD5
98ce3d61e33ef2a18c03f885af9af3d4

SHA1
3f3e44a205fdf8cd43973f131d2e87ee418274a7

SHA256
feffd9d36770ad364110f1258aa87f3e78cd2040b8128f517c66ea6548901708

SHA512
5415bc692f7e4ca06f96175d56d6acccf40e6e1eff401b0d764b1b1e57d8ad0a6ddf9124e2e3046ed471962bcb156018c56014e08a4e622b9cbb8f0d682dcc5a

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Filesize
12KB

MD5
7fedba44f7e08c66602822edcb1b8e1a

SHA1
1b6ab542a2ac6ea2ce28d0c5cd0d643648ef0e7d

SHA256
3ca85ac1ba3835f023fcea6601d064f7bd24d40c43a89bb9a49c108bb7e70a61

SHA512
908f34bff13db6d699cde88959e00faff2bf16b73a2a60b24ee6fe5cc3b6cd2522028c39cd457f8cc66ca64871d505da38b5659f400eb00fdaf09aab4a887458

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/db_metrica_com.gentongsehat.fudzapp_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Filesize
12KB

MD5
cf35eb35f0199a90a25228e11189e8a0

SHA1
f3bb4eb2be6a925cf1954dc4e7183bae57f4e4ed

SHA256
c3757d6b92d0a0fbabaed3586ba60220ef2b74255d05122bebd435724e538723

SHA512
1e46b14f4c60037d3e48a44c3e31b0b991de47f5363455307e5173e84edea7a6ecad5be6a85846fa8a2af8f7faca3de52fff148a4ffe067757f3c2c0082547fd

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/metrica_client_data.db

Filesize
20KB

MD5
f51a769b3cbe56981f1ee4426cd63868

SHA1
76ba550d4bd3e3d49e19e27f122e5f413ce2b5dc

SHA256
192e91baa7f355638eddeadc2d77ac98bd489509c849fbef69286587aaf9e04e

SHA512
83299c9e35d6f72f7e7fc08fffba984c624d701d136ef1584089885995caa5797b4daefaeb7683f24fb33a4c1492ebd786f44a70a133415c84ae1c2d42723fca

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/metrica_client_data.db

Filesize
20KB

MD5
e8b880926e636e6ecd7e64d69804ad69

SHA1
178459cc676c31ea0f1b17ed9a0fbdfa712c0a99

SHA256
5191957c9137743505cb4bc0c1bbb5b13375a1bc1eaaeed3cd11e1bd5ace15fc

SHA512
bf7129a65dc08c2b2e4b4ebfccea852fa3c6023edaa444ebf18e730f95e83191848e867d7d20b89ca666f4995cc6d2b4ada7c3b9f7335d0d44d27df782b93ad8

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/metrica_client_data.db

Filesize
20KB

MD5
e5639b469346d3d19c79ae3bdc2f4a9a

SHA1
b4d9041b94176f65417e63e77f0f324b81e8dded

SHA256
cf283c9f2c282ef339f1ac0c4eae7d6f44f86bc1744cbf8a9b5703edc7368aaf

SHA512
273aa09cf7f4de26661bbedf2ecd180b5adb537022cd824d2185beaf7eb1784bd1ea1f1f22c01e4762729bdefeb81964f1a47f13e90b883beb27ce7c8d1f03b4

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/metrica_client_data.db

Filesize
20KB

MD5
6d7dfb781772c407c4ad588f80c2ee00

SHA1
febcaaa134836e0cb8c24fa1e333d4a3f3efc751

SHA256
ceddf3441940c7b33ffff065f16b96f54de86b5cba6260494ef087fe021babc8

SHA512
0b88ba15e613d3154f6555094222597e880ad790a19cd2d5b8e5cf4dd5f1a6c3e652a1606abaee54d6914290b739368b9602101b449f872eeda73e08f906afc0

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/metrica_client_data.db-journal

Filesize
20KB

MD5
05a6c36c0aa3c8208b492034c4fb26cf

SHA1
e958e4bb77a632a1dd6610eb4231f0fecc6b59e2

SHA256
25c9033211936f4618aad5339aef0b41c413f5af99913f1395065baf7e2b939b

SHA512
67b881835f6ce90e6559662342b59d1b3958b9756cea80d0e214f047116e4e52ab22c742d5437ef8c1c71e6350f042180deba46e67464c0686f1237eaa1fd74f

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/metrica_client_data.db-journal

Filesize
8KB

MD5
18646fdc0a85af6a6f2a736e47b84264

SHA1
ef663c8ebb133a5b634fcdbf888d4d2d5f00dce9

SHA256
6f8b180fd08eb9be8d56ecea98ba30385ef9ac255b7369cc8d22ef5bdfe94e00

SHA512
f6a5977d74a7d0c26a2ddb4f90ce7ea4f35fccf6cbd0bbc1e43e6ceeec7395957504498840fd6f9d1058b2936eabcfe6e09800e0c3e3453dec0da46b141ac74c

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/metrica_client_data.db-journal

Filesize
8KB

MD5
1a8012e3dfc337382a620fd79877b638

SHA1
3a0accb417a1f24c6b0d488c6f776bb6b0b7c628

SHA256
8b386b4161d0e3932bfe5487074a6c9956ebf21d4845871d75093e05d8a19d82

SHA512
6d7dd764815a5d89e47e482e0c6aaa703fa72c30bcfa9824066223816d8d466344c48bbdc03ca4c29376162e7d3107870b56715ad3dece12056b737fb301035a

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/metrica_client_data.db-journal

Filesize
12KB

MD5
3bb4e69772d88ca34fc820227d53d0e5

SHA1
be15516be6d02aa76989128cfd74fb159f688c19

SHA256
ccadb7769d1fc091e8903377055f3583683f54f71526056818c1abab5e8f7595

SHA512
5a11e316d9ff8469fe2e42e35cd723ffce70b035b09835c2eae6214687b6bf20c3a5c94f671a7af3181710b6b1134cf9097879db6dd2a78e278c93289f163e93

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/metrica_client_data.db-journal

Filesize
12KB

MD5
78fd1f3014fe7aba0087349a9eb545a3

SHA1
188f39f020d87e5efb65c5ed80b735ebdab7c639

SHA256
87cb346932c7c03e06f67cbf92cb34ef4f8a4d457f3a9bd0f3255feb338e50e0

SHA512
465d4d8d9247354ec4d5221c1a8e201d0def15850bd549a81c36bdb0bb5873b3545c51eaccfa238ffc2de09045044528391582eec0dd501d398af017e53754bf

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/metrica_client_data.db-journal

Filesize
12KB

MD5
4cd1b1106c25d08467952ceebc0f9221

SHA1
0e45350ef003973e17c039a9e439afcf67b4ace4

SHA256
9447ae638588c40ba47f19accfb2fb2edfcf35621dd34461d15e63ee38c39aa0

SHA512
36c698aeca5ec6cd539ea3c2a471dd467ec9f7eec29a15b2f7fd168475d67b128282977df1c98877a0e6e9b8d5fadc1ddf6ea3068fe74162b2402b237ee0c524

Download Submit
/data/user/0/com.gentongsehat.fudzapp/no_backup/metrica_data.db

Filesize
44KB

MD5
4958e7641422b5e038505078e0b4d0f1

SHA1
111d5364db594bf450b82715ba71061b8bbd1161

SHA256
fd17d59f8701cc957edc67e2546a7cec091f8776de61af6b21aa30a6437eff61

SHA512
aa31fa6d36e8b5d3ba344d2a677c3c3280f139624b5b50d89e18a38e8a39f12790aa076edefb63d4636a645b1f8f3fbb772add3b69e87f8916d5ae383f401d14

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads