744d06ef1fcf8025aebf5590ad99d106ce1cca13e504ee82407d37f6b8622288

Analysis

max time kernel
179s
max time network
151s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
04/06/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
95490942b1eac0c3fdaeddaa12f87847_JaffaCakes118.apk
Size 5.9MB
Sample240604-seckbabe63
SHA256 744d06ef1fcf8025aebf5590ad99d106ce1cca13e504ee82407d37f6b8622288
MD5 95490942b1eac0c3fdaeddaa12f87847
SHA1 f0af63179dc736df5ef92119255a36fd0b8a3044
SHA512 3f319f1e69f6475b2e47fab8505a866b34abe3f9d6e558738877f07c69d1cafb876c6ded223d3c541b44bc13441619d9f8d016b8f7524f4dd49c0b5264bd261a
SSDEEP 98304:XHQljvUKULoYgMmTRavh0nsudJ6VMyq0QBa9uqArf0iLhZ601mT6PPO:XHQlDU8dcKPMU0QQgz/6003
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.appsmart.delivery.darbarmuenchen2087:Metrica
/sbin/su	com.appsmart.delivery.darbarmuenchen2087:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.appsmart.delivery.darbarmuenchen2087
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.appsmart.delivery.darbarmuenchen2087:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.appsmart.delivery.darbarmuenchen2087

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.appsmart.delivery.darbarmuenchen2087
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.appsmart.delivery.darbarmuenchen2087:Metrica

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.appsmart.delivery.darbarmuenchen2087

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.appsmart.delivery.darbarmuenchen2087
Framework service call	android.app.job.IJobScheduler.schedule	com.appsmart.delivery.darbarmuenchen2087:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.appsmart.delivery.darbarmuenchen2087:Metrica
Framework API call	javax.crypto.Cipher.doFinal	com.appsmart.delivery.darbarmuenchen2087

com.appsmart.delivery.darbarmuenchen2087
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5042

com.appsmart.delivery.darbarmuenchen2087:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5103

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/files/ZPkFS.log
Size 12KB
SHA256 57385b569b0b8821e3936bb9aea295873d91f3a994db6faef24d541878376741
MD5 0ce2001dc632077e68145adaff24fc80
SHA1 9edc4f31dbed75c85d5888250a6cb680f0acae3e
SHA512 e8b7c65bed81b0d6720d338de42de1f828d85e73f7efa753859b40bf7d4ef42546d2dfff62f07e61b41f2847f6f2c11bdf62adda8f670ea0798791beb2fe542b
SSDEEP 24:7+tiqLY0MxKyOmctlDWwwTRD5xs5cQlNGSj:7MiqEkDP6PRtxOcZSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/credentials.dat
Size 233B
SHA256 8c644f06c1e8d26a663a9cbdfcf3fc03dcde9e88ff92569778dce14c0c7b6011
MD5 e255463e9dc7c96ec3bd9b775c870f98
SHA1 de421fa90abae23cd31cd9aadc430010e3cd50b9
SHA512 016abfaa361eb9c2a6808e73f70e3e8c801f5b13b7e96f3008cd03f1a4a01fdc6e857b7a96531e3cf9054176fc58a77c15272e8bbe61cc920d03e02562deac01
MD5 SHA1 SHA512

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087
Size 36KB
SHA256 15601c1f121b52f1223c7ebf75c09a50ea82d4641b7aaae9f7c2abb81ba702c1
MD5 89b8b15fcc1ebba62fdbeb2f229804fa
SHA1 02ebe88bed39064097965a42a1593e257b353923
SHA512 4ecf541136ad92ef5ca52ab39feff9d707a542dec74c3a9dae70412adef2e0856173ba1c6d7836705115d9d4890b5ad93044708b1929dbaa0bf640750257f0e3
SSDEEP 48:TGCE8WctFMkUe9kftcPSYBncWk9K2vcfjDgX80IguFALTI91G45+w/I+ej17Motl:yCE8LtFNpkFcaYBncmg4EXbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 20KB
SHA256 72b2a1c267301e77693799e67eacee0d0da67d342049803d566b06a992e2a7dc
MD5 e785ee939d66912e92cfc00f993bc524
SHA1 904477dc2452896afd36bd4674420adfa8430723
SHA512 716cba52a85de86456420997ec0ce01d736647682b27072dbf5ebd5f5fc4abd87c2a155cdb56bb10f81f5fa42fe55d31d4966581025b1b49825ca104624468bf
SSDEEP 24:TLQfcQlNGSP/0ftMY1+9EHsY1gncNI13EMNFnncCEzn:TUfcZSP/II+Hx1gncOJdncZn
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 20KB
SHA256 c17c05a60a5747b35add56185c7266ed8a37bba4209bab1a3753da651a906441
MD5 d9cf50781ae4f25b3d53cde40bc7d1a4
SHA1 1f0a22bab108ca8bc1090a7dffec1c7cd9171e33
SHA512 3612bf99155a4dbaf941ebeb9ac4bee4d9c2ae6c45f303364ec1922259a6b8071b0a5bceb04c217b8bc1420ea12a28f40524a14cf7b04d36202bcfd78c0a7849
SSDEEP 24:TL61fcQlNGSP/oqLiuWRGSpAjgMYw9EJIjY1gncNL16EMUTigncCEo:T21fcZSP/oqZWESumRJIU1gncN5ncC
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 8KB
SHA256 0ec85cd22dad0e014651fbf3d8892c5e254470675dae1ce363ab73b609442e27
MD5 66b49283d2246a9984e240d9d860a749
SHA1 dbaff1aed6c2c95fe8a7f557235c1279d7413504
SHA512 93cecf36a84aeb8905eca0cf41287508dc107e9549b8c56b3a80aa5ed85c083440adff33a90b288cf7c6d87fbd293096c867c8a0129869c81849d3e976838db4
SSDEEP 12:xRu4e9e3HW7lPTWRbeD91P0O7OpzFi4g3JQnqLJdTRmBEyPbP0v:Xu79e3HOWi91P0O6zA4gJQnqLJyGSP0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 12KB
SHA256 d6f10e92555720d774f5bce269e8769d418678a0228e30819d997d1bb57cc1e4
MD5 ff5c7bbb5a809569a7b3d7ae265967db
SHA1 39d294fe3e77eb639082d23d69e452b2d4e88a73
SHA512 ebb5fa0052373ad880bc7e735f7d1ab8ffdb7fc5a8d003b7d6a43e0a8d8400dd6951ee403359c8144f4b6d96d3790f56a27a1fd54b1bbd1d8041d6abd0fc4508
SSDEEP 24:Xu7+aPsqLGpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSK:XYsqVE8WctFMkUe9kftcPSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 12KB
SHA256 41642b78064359655590a9dbcdd01ae1453795b33c26f6e8ad8c406dc8c6ed58
MD5 94128ba944623e3d6e7d9a7859dc1416
SHA1 e210d20050910f7764dfb9f6b78ed6bc3e048ca3
SHA512 392896209b88f84f60d56e550d318fd5e3ec202c20fa2deca76f3a16fa46e622830614d1fa31256e0dcc9fdb068146fb15d89a496fcc567185329d44b7322525
SSDEEP 24:7+t+E2fbQiQqLZUpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSJ:7M12fbQiQqtDE8WctFMkUe9kftcPSJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 12KB
SHA256 400fe966661ecaa931aac9fcb134b3638a9dc14442dc18241ae0c39da9020c5b
MD5 3e05e1f91d6eba0c0dedeef127ef600e
SHA1 04c9149e6cf699897da9fab136e24691a4d96ce9
SHA512 06d9dedb5c6a964fc274016737845f097ccbc046d6183ebb580a4fa51835bdd16763da85ac60888ffc07322da58cce4c48eb1f3d447b7047909b6203b0b5732a
SSDEEP 48:7M3k96cfjDgX80IguFALTI91Gny5+wWI+ej17MotNbTqVE8WctFMkUe9kftcPSl:7zgy9XbTeE8LtFNpkFcal
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 c5cf8324805ad893a8ecc9d8dbeb416d6c103a2ae9708f89b47bebd1de767d0f
MD5 3964109ddeb9657618438bdaca3c0612
SHA1 03c5b6384d194745245317c29aa6451f351ccd66
SHA512 9d36daf87e79d691735b8d34996d687ebca2d29b17cf47ccb5bcb655e78804ab483bfe9e20fc46f7ddbbc1c0c1276601ae70514854957ec6554236e34faa3d86
SSDEEP 48:TVE8WctFMkUe9kftcPSB8UxYHEbCvi6jEuNfjNZ8ESG2vIm1odgo2b0S/liTsbzT:JE8LtFNpkFcaWsNbCvXIwkssbH
MD5 SHA1 SHA512 SSDEEP

Submit Download