7b3bb845b187e0ffb2a38ff296c6bd7520503abc678071a0c9a79337e732b463

Analysis

max time kernel
178s
max time network
143s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
04/06/2024, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f8c7f9218b2383dac6ff46dda055294.apk
Size

4.3MB
MD5

8f8c7f9218b2383dac6ff46dda055294
SHA1

fd38bdd0d93769916e88dcfd23cbcd7f397f329b
SHA256

7b3bb845b187e0ffb2a38ff296c6bd7520503abc678071a0c9a79337e732b463
SHA512

c2072e8025b993d916d0ea511c53e7aaed31e48a3abb09c3b14b2eeb0e9c96bc3b70155716e2febad2499a4aca2342a809af05597debbb5e59b0e9ad90c07f06
SSDEEP

98304:XqnZCE17cr8bunuVST2G4TqO9ITbJmnp2KaK1+UqQUSZp4+sx4g:6nZR17crtnuqm9Iop2KC67P4+it

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.restaumatic.easy_fit_catering:Metrica
/sbin/su	com.restaumatic.easy_fit_catering:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.restaumatic.easy_fit_catering
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.restaumatic.easy_fit_catering:Metrica

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.restaumatic.easy_fit_catering:Metrica
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.restaumatic.easy_fit_catering

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.restaumatic.easy_fit_catering

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.restaumatic.easy_fit_catering

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.restaumatic.easy_fit_catering
Framework service call	android.app.job.IJobScheduler.schedule	com.restaumatic.easy_fit_catering:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.restaumatic.easy_fit_catering:Metrica
Framework API call	javax.crypto.Cipher.doFinal	com.restaumatic.easy_fit_catering

com.restaumatic.easy_fit_catering
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4274

com.restaumatic.easy_fit_catering:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4322

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.restaumatic.easy_fit_catering/files/ZPkFS.log

Filesize
20KB

MD5
4a1a18b2063d560a103ef3f632c67d78

SHA1
8c0059afadc6de70fa9d17b55f2e6ff59b879624

SHA256
c79fbf99285956a98225f0255f357a0787d823bf49c1d0a79495a36d87f674f8

SHA512
2822e66e40ef86162ac28be3d4e0bc69b71e7dc0864448fb8cb6190f95bcfedacd58586e2ddd16a6c9eda99d98e4251a586281597453c0f04bca7f3a3fbc889e

Download Submit
/data/data/com.restaumatic.easy_fit_catering/files/ZPkFS.log

Filesize
8KB

MD5
7a38c07355f36e85b9ce30571792dc76

SHA1
e032461f332cc9ddc4aae7887700228fa5467d28

SHA256
909535323beb9e60dacae1ca76815919220aa6bbffad6431d276e99c401d070d

SHA512
d7fbdaa4fa73718f1c9ea95e8bb75cb9583a4f2c89d68278597b1cd70f9ee92ac36652ae1c2f880194f11b9477d960f4004ed7d198586812c004782de4f7cd57

Download Submit
/data/data/com.restaumatic.easy_fit_catering/files/credentials.dat

Filesize
234B

MD5
c3d03304a326eb89820875c547e8e45f

SHA1
b18ce708d79ab1691ec08e80a8e2a0753361e1ae

SHA256
d068c58065db637a153a4413d08b86844d4f711495c49a7e99b68228bc7b56f4

SHA512
ecb7b6e094f4d0a96560c414d620e430ec160a63a5a4baca5a5df40454420e0728dbb2ce9b6ef96488718b2d840d2480c77fd76b16107e24f939f7fb554f236c

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/credentials.dat

Filesize
429B

MD5
a35cd95d4b9d80f3cc57d5e58d150cf7

SHA1
ac9920808dc1aa6772e55fe8546ed9cf605bfac5

SHA256
03bf204d8de4b475f334e55f2238c8bfc0592a2952c9c05fdda4639c9c50436b

SHA512
da008a05f6975455b86c06769a3986d8b70c6d4bb7357536d1bf11c4f075f593614c2b34ed85ece498bcd952bf74fbabb4085412aa48b787d31ac1cc4d431bb2

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/db_metrica_com.restaumatic.easy_fit_catering-shm

Filesize
32KB

MD5
5966a38f6289f2321d171940b3718d17

SHA1
77e80ff3e82fcfa75c138c275713c22b5ed8e1a8

SHA256
b86271446e9b1f863d7e145268c27278b654f23084b5de006c788d991ab5199f

SHA512
cf9c97c4e4b260c0788487dab5afbaa8788f4997c3c05473b76b91e23182939da5d913bee78c30d3c22b6bbe120e8276996758bd30d0a1190ce16afda7748a4e

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/db_metrica_com.restaumatic.easy_fit_catering-wal

Filesize
406KB

MD5
cde57b826b52087c9764b092f1ba5332

SHA1
2cffe2f725074f4dd3c2599f787481c0248b1683

SHA256
85d34fc25194437cf56fe593e0b8a9df801206ecd8cf72609fc800d1d326603a

SHA512
f22dd0befa3247b13cf2114bbbfde30796c59b78cd239618613040003d0c2ba6d9f8d7bf07e50f67b1628fb13eeb210b4d3745d36c7c8cffce97e06e1c8e85d5

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/db_metrica_com.restaumatic.easy_fit_catering_20799a27-fa80-4b36-b2db-0f8141f24180

Filesize
8KB

MD5
f66ee32d0b17e6b09830294275fb5f0b

SHA1
6d06d273024c72f9b21f2a6110b403c0017e9d65

SHA256
d24926c65fda12c58c178a947e1e7df808423750c9bf2d8aead818e82ad853d2

SHA512
324d188cff30744be29426d6c4fcaabbbcb449c0c224d045cc03c62625196e7fbf81de3f253b3634bc85fe7fb67573ab579321e6dfd1759ec0b88f5976a177a1

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/db_metrica_com.restaumatic.easy_fit_catering_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Filesize
20KB

MD5
a126b454c2b44cc2415ebe79fb0600e7

SHA1
30d5d7e724e768455235ce2f983f76c48f197b64

SHA256
a117a02af5a0c1ad2e628cd6a5624d49eb37b6501abb5948e5d7378fdcd3af28

SHA512
4d7f41ce0f9ddf0444192404f7c297236f7138f44e6fbfa65668df500e68f0741246a5000f20b23445ddc12d2c0745d7fb3da5aa9e8f98c9549ac8f60500b7ca

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/db_metrica_com.restaumatic.easy_fit_catering_20799a27-fa80-4b36-b2db-0f8141f24180-shm

Filesize
32KB

MD5
49802fbc8719040709cbb631ee1f5801

SHA1
8fb46eb8be1ff52c244c91577cd239a8c674dfa5

SHA256
980abef58185240f940924743623462fcdc9694964c171f50bce16039dfa07f0

SHA512
e0b0bbb667117adc341c058145e682b50a735be97616f3788c0b2aa64643b464b4b389a494bfc84b3df559cdcb80d35588dfaae6780b1274ea1b61ad48e57a00

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/db_metrica_com.restaumatic.easy_fit_catering_20799a27-fa80-4b36-b2db-0f8141f24180-wal

Filesize
164KB

MD5
32bc964ccd174f1ad4dc606ce37641ef

SHA1
26e0c73d1c4153e1891366fa615823a58871e4bc

SHA256
aa5f3d92bb5525564a74b3efa1357faec64c192bd4af537a9c5664f0ea6dc5d6

SHA512
2278cc63d995c5c1854bf9cf1cfcd69b9a190e9022be07ba3ea767782e6f7e97345579e4ffc5431960432a9970bca4a1e9b1a73e48b9b7cc3bb4901e354ac7dd

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/metrica_client_data.db

Filesize
20KB

MD5
2530f0f2882e393096c9dfcb784f7ddd

SHA1
794c9d9ae9ab071c88dd7140bb7c6e450e2842fe

SHA256
4b1344317724f9b2c4135dd66bd6c6f0118c318469e59f6995a21f16f8b4351c

SHA512
4e62b0434aa9f3c962ba0659c2ae8c39c75fe746bb6b792bbb7c017d316b15c34c7a096e835a5211cbf07675214dfa9ef3c5d25d167b127f17b95ec60bd4125f

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/metrica_client_data.db

Filesize
402KB

MD5
d36c55910527be38b9d3a3b5f0562ba9

SHA1
b7bf99a23165a9cfc258d97bc7672a565c3340df

SHA256
af318c4ef905f05da4425b582bd71902ee17fd26ef3888c4a52fcbb2705c88d9

SHA512
2dfbddff41383f7bc9195d4edcaf43b3c7a883d73bca81ac5322fe0fb6579b72af882f070094edfa461131f06ae24132195f76fab79619e9f868ec908ccf82df

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/metrica_client_data.db

Filesize
32KB

MD5
d9964bc5d8484f6e77c6b3540b1c2341

SHA1
b6162a18a3477d0224fd852f357a0953515b08dc

SHA256
cdeba90423cc0dae12374e37d434689a0af3e3cf1878e646f76d71fcc397168e

SHA512
5e698fcf2287f3bfe281e2cf0be0632779d60015f5fc7878de3c335a5fe880802c5ed95c7cbe9202f24f7b65b665bab0caabf0e32a49d78845736b3b5786e506

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/metrica_client_data.db-journal

Filesize
32KB

MD5
98739afa758ae955e2fd4e67a07c4272

SHA1
634acfe8715cec0c3f73f6c3e468f3b1e6451925

SHA256
2d198f891928db8c4cdbd67e8341637492a49e6599bc9cae180a219f85b9f1d8

SHA512
14891372b163b6020b9f913fff54745fc274b7e746a0e296e197d39e0a9cf2707fa00eb5aa2973f80e3be0152a376ee17e9d3216e80d590e950be82a91b5e952

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/metrica_client_data.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/metrica_client_data.db-wal

Filesize
36KB

MD5
94099242c2564e69e3fb880e88247d83

SHA1
064a4e88208f5d72ddbcccb30c3a5ce14186cc50

SHA256
48cd74c0b305260819283592faeeed95efabb4c6c4dd313cd373b234703ef567

SHA512
5899f4737d4c87a0f09ee6c7d124745ee3765e606bcec1971b367cdeed80c23040aced6b871d517eeedbc86d3ca715f1d991def1fd3579a2823f9a614f3d1b4d

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/metrica_client_data.db-wal

Filesize
32KB

MD5
46814a731bf2d4b3303555acaeaa095a

SHA1
e055d31da539d1d42ec24d826f9a43ca3565274c

SHA256
afc0b5e4bac483a8e8900be62da2cb157d6406921d29feb1fcdd47fbd18f0982

SHA512
740162fdc5fca9aea9bf20d787f1c6792482ddb175f03d187ae74bd98d4d8d1e0c4914c67d24e5a811f0e1c7e1b363b564309fac703c5711a9117ee575f65c12

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/metrica_client_data.db-wal

Filesize
8KB

MD5
15ff5badadcc1ae532dd36c33c7f85ca

SHA1
ee591a6a8ec2c0b6fba69fb0b1f9eaa9a32854f8

SHA256
99f98f20489a7913e6e60efed47431b62c265cbe5a45882304423e9796836bfc

SHA512
ec5a7869fa015d94f3348be385c2ee413ab87cc41fa57abaf1d625a1ffe4a1d802c549632de299a614c058ef340e133f06d3d63a3e4a2128c360b010c3ff0965

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/metrica_data.db

Filesize
44KB

MD5
a8d45e5ff8f92814c1c5b3d77411ee49

SHA1
f827b68f8e667b664662a17fccd169bed3018e54

SHA256
5564d269a39f41c5432999062a5841372b137da9edbb1bf7bf9892d07c9bbaa5

SHA512
dca347078b5bdafdb4f2b3f676213216d7fc19b24872235fa684516f84363aa14447fa80b2ac924061588ea2ca837423f4d0f323d0a582ddbdd6d7a88930b71f

Download Submit
/data/data/com.restaumatic.easy_fit_catering/no_backup/metrica_data.db-journal

Filesize
512B

MD5
0db93644dcd86f456fd7fe6d7152b689

SHA1
ed8f97e7ef59fd7f7c504076d75db8fe2b1b884e

SHA256
5b9b8251bd0217bb0a9e4a4c7ea6faeda0ed2e0b7b100aadd5cdffe509857480

SHA512
b22fc3473824534067a77ba4e9af9113c83d75be5644fe4fc62f671fd03eda3140aacaf230778a896325d09a6cd8dc08dd142bce1a419c7772c5311b39de689c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads