7229c81bb0d813ccb78e8cf86da2312a30aab03cfd7d4e39a05052cb6afbd315

Analysis

max time kernel
179s
max time network
150s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
05/06/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9703df15c393d2b9a96681d170316654_JaffaCakes118.apk
Size 3.3MB
Sample240605-c3bd6abh31
SHA256 7229c81bb0d813ccb78e8cf86da2312a30aab03cfd7d4e39a05052cb6afbd315
MD5 9703df15c393d2b9a96681d170316654
SHA1 31e3fd3745c12065146ce1cb7277777dad7a9ac9
SHA512 26967f80fb8f90f7c4f466f9bc16a4ef12d339ef60e06c323e49200ee8d64de5e530815c8455ea46df031976a438d3258bdb12b32bf456c3ba3b121d4d612517
SSDEEP 98304:5JFZgJqF2uERrun4GZXpnvHb+VblZl/xcAOtywXN3TdG7EKvJXDb0WooI3ZSJH:FZgoouFLZpv7qZl/xc3GZMWoe
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	supracomidas.restaurant_owner:Metrica
/sbin/su	supracomidas.restaurant_owner:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	supracomidas.restaurant_owner
Framework service call	android.app.IActivityManager.getRunningAppProcesses	supracomidas.restaurant_owner:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	supracomidas.restaurant_owner

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	supracomidas.restaurant_owner
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	supracomidas.restaurant_owner:Metrica

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	supracomidas.restaurant_owner

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	supracomidas.restaurant_owner
Framework service call	android.app.job.IJobScheduler.schedule	supracomidas.restaurant_owner:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	supracomidas.restaurant_owner
Framework API call	javax.crypto.Cipher.doFinal	supracomidas.restaurant_owner:Metrica

supracomidas.restaurant_owner
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5043

supracomidas.restaurant_owner:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5094

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/data/supracomidas.restaurant_owner/files/ZPkFS.log
Size 12KB
SHA256 c5b203abf11e99540040f5bf81e41e76cb94c9489ded6d403dcaef81b1fcf7bc
MD5 3292725e07d86af512f9e0f64b6725a5
SHA1 2510b046fe8f59e3b932cbee36422134569ba759
SHA512 34449ec9b716ae2cf1dd8e180cc4516dc31a3c24296960529b30143ee736d60d7e2e1752b5c6dae3999de32ca3e95ae75c0ec6a5460b4e663bf7f916dca8aa72
SSDEEP 24:7+tylbtv2tnqLY0MxKyOmctlDWwwTRD5xs5cQlNGSE:7MynGqEkDP6PRtxOcZSE
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/data/supracomidas.restaurant_owner/no_backup/credentials.dat
Size 233B
SHA256 b787d1530af4b2b99cfced9b11e5177ffed6ca1d81eef88045bd2169847627e3
MD5 4edfe3e02eb957190b9039d810c66571
SHA1 e040667a6ce0cd9be577574c3d4ae3b218b76a30
SHA512 a39d357a64fb2bf5fddbcdc5826ac9e9914e51c86b7aafebfba6036e7c70831784371aecf1c4eab7076703bee3bfcb3a2bfe8295140f7c72d184478166aa6456
MD5 SHA1 SHA512

Submit Download

db_metrica_supracomidas.restaurant_owner

Path /data/data/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner
Size 36KB
SHA256 b8cfc0800d66f3fbbf9b74325e38744ca893b743b1e1a3cf5591e3215ab266b8
MD5 ea012c7318ff4468478e4cef18f2bfbc
SHA1 6acf9d41b3a85706ed6a6bfdb7474ac2760af0ad
SHA512 c29fc18a2847a786892f56df5b53fa6e21f94595d9525e8bce40db378b8425e9eebdf81a138868c35ee1781b086d1aa7de202a1886f9c4482d321db71833d9c6
SSDEEP 48:TlE8WctFMkUe9kftcPSQncrCk9JWuj6IGWTSuIQIGeueNIPS9wLIefQ/EsroL:ZE8LtFNpkFcaQncrH5Qcy+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/data/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 20KB
SHA256 24138e258deb150a368f0dda744114460b61a4c465f9fe9a1a4285713f071814
MD5 f93afefb17aaafc7792938a3b9df9b81
SHA1 0282349e987a46f090cd1096891ec169440a504f
SHA512 f631a92ee9f7ea4a0c3f41e91ddc4587278529d43194abb1196264f79c9ed7ccb984047da9ee2b521c00503c7a685a88ce3ad0e177d48fafcd939850536aaf88
SSDEEP 24:TLQfcQlNGSP//yMYMEetRAL+igncVlEM/KRbncCg:TUfcZSP//c3etOFgncVSncR
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/data/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 8KB
SHA256 841a584eded341c7397ddbc59cf528febc8e9ae9ac48fa576cc98027e6860ae4
MD5 0ca9076aa5a308de08720eafea5c4db7
SHA1 29c48044e34009b9f0a0bd87ad4dc9acfb10a32a
SHA512 c40effca1926997d2305472c00272259b62bbc1ea218890033f14ec772dff973a87d09798d211f8cefa87be1808a8bb82cc9cb3c1d189ac7a8a25ffb5bf3cfc5
SSDEEP 12:xJ33HW7lPTWRbeHku12XTYxxIOO7O8olIi4g3AsRqLiuWdwRmBEyPbXn:733HOWq377OjolP4gfRqLiuWRGSXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/data/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 8KB
SHA256 c67f3918c0f832d58dc5f7b622be62557ec51b106b02a752d73547aafd23d21d
MD5 6dba8bb31550ce04d8f3540aebf17fd6
SHA1 05305d2fae2571d861299843d7390ad83d49f08c
SHA512 20a886f8934ad83dc3b3ca233dc19a86f32c94f3ef3ec616e004d0f04a5a7dfbd4ce03c6483342443bf7c6cf9830e87144ee1abc266148db5b8883e8a5adf0f3
SSDEEP 6:xJyVbPDnkPzhgg9bNFlLdrlOERX4PBX4ogLugMBX4suuKkBM/ui:xJ0Dg9gqLJdTRmBEyPbH2t
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/data/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 12KB
SHA256 ac5ab0d42b04cf3413b5ab70c2a84553626a4454b3775e6f278788662cac5b43
MD5 b4b8e9056de6345e099f7615dd51371f
SHA1 8de487ec5c8b117dd4542f361b4bd8dd678ff442
SHA512 9f4513ab3b857ccc2c7fea1390274f154e0d09ae3c182b169cc2c44c8fea2c50223488be8540e06ac33bff586c7aab49bcfa818fa43af9732534c87a01200ed4
SSDEEP 24:7+tveHE5WqLGpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSg:7MH5WqVE8WctFMkUe9kftcPSg
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/data/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 8KB
SHA256 75cd6301969a08e6639a8a48f781c65a973e40876bfc9d829a1554a9f838a139
MD5 c1ec9880e7644d22a8d656238604ff00
SHA1 e22f989827e06a7d44f50c9ea26c5909db2aebc2
SHA512 52cf7e0f0ba62b0226917510f96e45c064ae468246e1d9215905bfce7cac43b9db5ba31b1d4b1d2048ef0c106c82e1ca4190c130e6e14bc2d91c06fe4cca0bbd
SSDEEP 24:7+t+I+jqLZUpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSS:7McqtDE8WctFMkUe9kftcPSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/data/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 12KB
SHA256 a3c3d3e11f0d621754e5ad18a3724b59dbff637ad78ee075460b1a8814b97596
MD5 08be07d03fa59ec7252d8d9155e3c5fd
SHA1 e9917c3fc4d4e4f7e38de425cd6f41c0afc4badb
SHA512 49c69dd67be0da0bf84b137b141a7379fbcdec72a72b14ce2ede66993137290ce6563f0986ac38897c24250f1ddf9f82899fb054414103c9737dde7b9a0ddfa4
SSDEEP 48:7McwQk9wIWuj6IGWTSuIQIGeuMNTPS9wLIefQ/Ezq1E8WctFMkUe9kftcPSS:7pwXiQcz+E8LtFNpkFcaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 5ca6cfacf86da6cc0686c4c494f113535930e67240c2560746ddf851342103c4
MD5 a34fa405b03f049ac2641de5cdd8dbdd
SHA1 06486c605f106b5958979ff9e0150f85a26952ab
SHA512 fe3f02f74772d4890e5d67cda3989cb342b1bb48a65f19182ed91495ea65145d0d759797cf921e84ae6e5c59ade8d4c37f1d00322781a6e7fe135c03d41f2498
SSDEEP 48:TlE8WctFMkUe9kftcPSB8USH5bCvWjEfWfjNZ8ESG2vIOBKlo0go2b0S/lGQEV2K:ZE8LtFNpkFcaWHbCvE+BMkMQsQ+
MD5 SHA1 SHA512 SSDEEP

Submit Download