7229c81bb0d813ccb78e8cf86da2312a30aab03cfd7d4e39a05052cb6afbd315

Analysis

max time kernel
178s
max time network
137s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
05/06/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9703df15c393d2b9a96681d170316654_JaffaCakes118.apk
Size 3.3MB
Sample240605-c3bd6abh31
SHA256 7229c81bb0d813ccb78e8cf86da2312a30aab03cfd7d4e39a05052cb6afbd315
MD5 9703df15c393d2b9a96681d170316654
SHA1 31e3fd3745c12065146ce1cb7277777dad7a9ac9
SHA512 26967f80fb8f90f7c4f466f9bc16a4ef12d339ef60e06c323e49200ee8d64de5e530815c8455ea46df031976a438d3258bdb12b32bf456c3ba3b121d4d612517
SSDEEP 98304:5JFZgJqF2uERrun4GZXpnvHb+VblZl/xcAOtywXN3TdG7EKvJXDb0WooI3ZSJH:FZgoouFLZpv7qZl/xc3GZMWoe
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	supracomidas.restaurant_owner:Metrica
/system/app/Superuser.apk	supracomidas.restaurant_owner:Metrica
/sbin/su	supracomidas.restaurant_owner:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	supracomidas.restaurant_owner
Framework service call	android.app.IActivityManager.getRunningAppProcesses	supracomidas.restaurant_owner:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	supracomidas.restaurant_owner

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	supracomidas.restaurant_owner

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	supracomidas.restaurant_owner
Framework service call	android.app.job.IJobScheduler.schedule	supracomidas.restaurant_owner:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	supracomidas.restaurant_owner
Framework API call	javax.crypto.Cipher.doFinal	supracomidas.restaurant_owner:Metrica

supracomidas.restaurant_owner
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4499

supracomidas.restaurant_owner:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4547

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/user/0/supracomidas.restaurant_owner/files/ZPkFS.log
Size 12KB
SHA256 fd6154b7c9269a459c903b72915e06635d9d73172fca5958b96d66199856d224
MD5 ad937dfe50f9f8acd1bf49bfb597bb7d
SHA1 566167d676a1ab3eff07ef3691f6e11410f6772a
SHA512 9767e16a26f5bd58215378374d126f1e807bda154da66f22be7a52d5aaef3265ae212250dd78ac2a0918ddeab2e0f3151779e0a31c64d9183a8defb0efeef6f9
SSDEEP 12:7+tOyrETQBncQmsqwEKgGQBncQmABMqLyKwfcGtSBw8w2RmBEyPbz:7+tN0gncpqgnchqLyVfcQlNGSz
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/user/0/supracomidas.restaurant_owner/no_backup/credentials.dat
Size 234B
SHA256 f22318adbd4bf24dfa9846a385372128f073cc66c1c6dcfdad4b01598f09b76c
MD5 f9efa28e22482558c807a99ced8d8974
SHA1 5d55328ba06b32c386524821a853f449fdf86259
SHA512 2c6aa247df4969765797263f56c5f93b570f1af86a1ff04b43230bebc5170cdf96a865299e816f8082324a7c7132087e7eedb6691b985172241863b203f43360
MD5 SHA1 SHA512

Submit Download

db_metrica_supracomidas.restaurant_owner

Path /data/user/0/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner
Size 36KB
SHA256 b49a0cf7dece6114571ac668cd8a1fc0b97f1ebce1f9d5464c3a54d527633467
MD5 22872128019b1077691b83cf84187023
SHA1 cb741ef97ea7c8fa4c4c23fefe4e55b83cedc92b
SHA512 45a1ab89893e4716f76773f6f8e73730687289263f24a483960a7cdca5b9108eb9d7d21375f193c70235cf5fcc1b3276c3089227ce70e49771ecb89d9132a94d
SSDEEP 48:TtE8WctFMkUe9kftcPSlK7nchGOTk9Jduj6dG1IATSlSuQIwYNIPSSwLIefQ/EsK:xE8LtFNpkFcalK7nchGisQcy+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/user/0/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 512B
SHA256 e2f8ceeac333acbe6168c4b9971a1f56b03846a144dd3228fc702ef7ec124963
MD5 141eafcf728ecfe2d9e1f86b4b4c30cd
SHA1 07d7f6d799187e6398c202aac804e872e838e162
SHA512 ac45846d79b0825b4f4c713f14084e5c69ab260fed24138f45506d4af42a988d90aa8b78f83d647d350a3ef50319bf7ec8dbb388e8d7c46769a88ea229de6551
MD5 SHA1 SHA512

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/user/0/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 8KB
SHA256 1561db40487c1180c1fb5954b759c06dc5fd3c8e339e8a40dcfc7edbf27c72c8
MD5 f4ca1a0af324f16e094511b5fcc8f3a5
SHA1 42d28b89a8fd91ff2eccca346a7d1639ceb6e5af
SHA512 30aeaf911e93410ca5eaf3ba3d207d7ec01da02364ab7f3a99371f9f03dad431b28471e9130b32052ca750a5a76b140abac21fa7996626bdc43ed977e08139d4
SSDEEP 6:xJPFfAPDnkPzh81MWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKc:xJPJwDg9GqLiuWdYRmBEyPbr
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/user/0/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 8KB
SHA256 78ddc73dea5016c4b783f2db14e4afe02437723a0f110f22a4193e678182e6a0
MD5 a0e5ab0795daeeec767041d515a455f7
SHA1 fc71a0eccda4d05d76c3ded73782f63303e145f5
SHA512 d5f0cd9b15e803e6f1ad46700470b9963d82479f7e0ae271b11c40437dcdb30582543168033480842fc9dd724d0d6fc466cb53bfe1a045aa1381e4a1a6680c60
SSDEEP 6:7+/l9Q8FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKAtt/Yn:7+tHBqLJdeWRmBEyPbnHY
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/user/0/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 12KB
SHA256 4b2f42702a61a4a01861404f6131321d7ebefa92f546a4bdee569b7ecb81f46e
MD5 e010ad73ffa9b46e9ff068a24f49a67c
SHA1 f9d216839c65f277bfb0be6633f3bfc8bd3eede0
SHA512 a62d1b6cd0cd050155fd74b0469d27fcb9a9ca4896ad7b3c568f1d012ed0dfdc273374de6b8d50967c9a021c893f57514aa25c1de9ec90ef29fb96a0a8a84178
SSDEEP 24:7+tXEsqLOpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GS+:7MUsqNE8WctFMkUe9kftcPS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/user/0/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 8KB
SHA256 41ff9588493b04927a91f4ba43e71dec5d5e89dd26e8891f937c4f048b3a7500
MD5 e54bd95b48668c8e0051c778cccd2035
SHA1 0335fe1ddf12c4a402539af262d3939b569be910
SHA512 fe24d2106435427bf89cbf90621396f7f7a4505c30a6f0eea15484da57e41b741d77e18b867dba7481a6f6a8b6b9a3d8a6008ed86033ef9293d05b1d9a3ae51d
SSDEEP 24:7+txWqLepOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSH5:7MQq9E8WctFMkUe9kftcPSH5
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner-journal

Path /data/user/0/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner-journal
Size 12KB
SHA256 3b52110705bcaca4b683f0396beb309a67a52de0e6d34ee35580d635542c5b5e
MD5 770177693340f11231e8c78db63d4cd0
SHA1 6042f79f0f0eb32abbb4d75b514904466d5321c6
SHA512 92698fee80e15ed5c44f1ce92f9418652662218ae6a5bcb2156e1e75ea6caf9ffab5d5d4e46e8b6ef067f473c5b049b2d3a58178c34a76cc68a4c419760e954f
SSDEEP 48:7M5Qk9wIduj6dG1IATSlSuQIwZNTPSSwLIefQ/EwqdE8WctFMkUe9kftcPSm:7mesQcwWE8LtFNpkFcam
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_supracomidas.restaurant_owner_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/user/0/supracomidas.restaurant_owner/no_backup/db_metrica_supracomidas.restaurant_owner_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 21a4cad4083dc9302f964cd476ea8c2619864b2ea324549d75ac76c1f7481617
MD5 5e351e78472dd9576b58f93f9704ae32
SHA1 328f9faec24b21478300d283d41533a4c4002d24
SHA512 10c97ea784d014286e519433bc011466a38967eaff82c1a5713b66fb667b90936f876d75c930173678031d9cc9c247800ee2983ff56a57116f1a02b6ea481cc4
SSDEEP 48:TNE8WctFMkUe9kftcPSB8UMUHWLbKqmi6jEgRfjNZ8ESG2vIm1odgo2b0S/liTsC:RE8LtFNpkFcaWHbbm5Iwkssbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download