81f4ef0f946f0f83b166102b379d87732b0f1cb3f6d92e4a6294bb0de1cf9c4a

Analysis

max time kernel
178s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
05/06/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97095d2e490427895dd701d471c86632_JaffaCakes118.apk
Size 3.3MB
Sample240605-db1emsch56
SHA256 81f4ef0f946f0f83b166102b379d87732b0f1cb3f6d92e4a6294bb0de1cf9c4a
MD5 97095d2e490427895dd701d471c86632
SHA1 a41d04fc36b2638428a7378a17ebc247db9f7bc6
SHA512 222f517a839f2cdc8f741bff7b866236db5e37dadb29281055ca8befe7d068a4eafb48f35b5133b8548093bb4a0168d22b455ff9ae961a515c91991dfb636d1a
SSDEEP 98304:xugfuWWFkFL7EBasOqFRl8Fr24J73DwpwOtywXN3XWiBj36:xvLWOLpEcJpXn
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	goldenburger.creapp.com:Metrica
/sbin/su	goldenburger.creapp.com:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	goldenburger.creapp.com
Framework service call	android.app.IActivityManager.getRunningAppProcesses	goldenburger.creapp.com:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	goldenburger.creapp.com

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	goldenburger.creapp.com
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	goldenburger.creapp.com:Metrica

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	goldenburger.creapp.com

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	goldenburger.creapp.com:Metrica
Framework service call	android.app.job.IJobScheduler.schedule	goldenburger.creapp.com

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	goldenburger.creapp.com
Framework API call	javax.crypto.Cipher.doFinal	goldenburger.creapp.com:Metrica

goldenburger.creapp.com
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4224

goldenburger.creapp.com:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4257

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

credentials.dat

Path /data/data/goldenburger.creapp.com/no_backup/credentials.dat
Size 234B
SHA256 67bbf1de2f29c433d0293e895e438ffae921c9f4df0fcb5946e78b37e4857cae
MD5 140e3816c806ab75023ba649336f7310
SHA1 66abc53bad7c225ff82c4a408ff75c698d85dc15
SHA512 ea6b558f57003e754634c7c776d80b4ffaa2047fde15ccfafef324fcdf3d31546aa7ab2d520bda8e42249eabf728292e62f9670f7295ff7ab972458b5f5fbe4d
MD5 SHA1 SHA512

Submit Download

db_metrica_goldenburger.creapp.com

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com
Size 36KB
SHA256 99a8841fd67f01146258d07ab1196169e1ec2a638b953599bf1a00da0504fc0f
MD5 52b40df792316b8fe5b10bd367f5abcd
SHA1 927252f0cd4f05d216208d92db90f86e0b478718
SHA512 9b619206dc3a1771bc481b6b4e037e95a71356fdcbd1b9cc61fb744f9a4712a8e711de7cd95a24dc3f73c722d59e9be77ba206fbbb6d2cc6114fce7f69fe33a5
SSDEEP 48:T7E8WctFMkUe9kftcPSG0HzrbZ3I0HzrbZ3lihkk9jiuj6IGW9FIDItuu4tzvA7/:fE8LtFNpkFca/rbFlrbFchV4tfbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 8KB
SHA256 cf011b64b5fc5679b9788ee74013444e430e5aebe2acdd0b3b10c8d0777dd9e7
MD5 10a0cba628cb7e03b197522c14f6b034
SHA1 5ef4c672da79aedb6b95ab389c0bb1c2ae003270
SHA512 41d6e0c863a4d74e1c146a4e86aab80317dee9bf1149ad2d998627b14f466655466d5b26610392a23680ac74629847968a1cb2d2e5f8ab86327fb203a2b7d9b8
SSDEEP 24:K5DL6IMzTrfEHs+agncPOD3EMNdSzPn3ncC5:0CcH0gncG/dav3nco
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-shm

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-shm
Size 32KB
SHA256 1590041aa6f27a672192a40c4ffaf9a02d36af33c7cc076f9a57e4bf88bcb87b
MD5 cce662bfdeecddafaf0c8b50dfa1ffe9
SHA1 b614ebacca86e585a11520c02b09465692ec919e
SHA512 c7d44bbdf2f328044d8a99a7efd959273aded347c35c41d536ee2327197da5c19d1be23035ff7841a2b2e36824182ea00a2b34174de4924de80d315986f2c513
SSDEEP 12:xB3HW7lPTWRbeE1+ycGtESW7UTlhgNppQHig3/Dq3trX:H3HOWSDGDWghIpQRexX
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-wal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-wal
Size 406KB
SHA256 7256a12980c159e6d03262d42d02e3898163e07313379a71b1b9350da5869321
MD5 551a017b0ebb7b0f6f8c99f3aad9db06
SHA1 5e6b2b51e416dda900f9958554e29e26bfcd7844
SHA512 83c66877babb660ee16a3ea078dfbb10ff20e39cd9bab95d33a21b8ca9a322c2a05acfe2a789c089217bc0ef740b078f9505eb5a15c61b6001c9802602d6f8ce
SSDEEP 768:ICmlU4yAkRvVNg1X7DSIUwh34QOX8d+ot8Cmm2EbT:K20
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180
Size 4KB
SHA256 45aa1c32073faccbc21cf96b4f10b8120bd0660401babf3da740022c14a9c9b9
MD5 491269696355fd91a392ab23fc9c61d8
SHA1 f7ee198cc5d3dd4f086798d50e49cd9813e9f3df
SHA512 d94ab0973439d306fd2ccd808e53833e5db6374f768430894958f36d9cc0e468a63cf49b1833e4e5d0e667bcb41887c5ea1f74fd3e9f1ca6fdf905e80a9e7cf1
MD5 SHA1 SHA512

Submit Download

db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180-journal
Size 512B
SHA256 808c645162512ac1f2e6c406c052735fc29ad8e471cc67032f028097725dc39d
MD5 40d5e5d0de784a838b10df1b79400544
SHA1 c86faab7cb5d7d4c77d4f8d0b3f4a0ef2bfff9d0
SHA512 55d50d13142939532dee48d0ea5207b3d62cbd53decc9a85654d1739d6d49ec956cae97e4c9edbe684037b305031bc2f36d65249c627ac94e4900b3b1b8f9f6d
MD5 SHA1 SHA512

Submit Download

db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180-wal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180-wal
Size 148KB
SHA256 bb90e7fb3c8ad72cdcdd69f4e64f59d009537ca0e478a82879e44f628408ecf4
MD5 381a9eb55f9ed1254c69fc515c6da84c
SHA1 8d5cccafb2f2ffcb7a76d4067801d4434a2a9d21
SHA512 bd1897fb0d17776f0f03a367376d4e29194001cd14bb3e029e511814e2c713b59ffb8a45ea681c86a5f7529e03c0195ff1771543c6a5243f9e80d8a8ffcc630d
SSDEEP 192:GaBrNpkFcGknTsR4I+v3+8diFctq0Dk0k0k:GE7VsRH+v3+8diFcttDk0nk
MD5 SHA1 SHA512 SSDEEP

Submit Download

metrica_client_data.db

Path /data/data/goldenburger.creapp.com/no_backup/metrica_client_data.db
Size 20KB
SHA256 6b4143ea844d88a64b368a765a8ba4c14f5204ae7f24c33188760d2adefaf95f
MD5 26d3ce9bb008af4f20e6ea9eda64001a
SHA1 4ea069e02a11cf41c7b3def235c1c12088fa08e7
SHA512 80c70b6edbb4f0ecbffe7a38cbd600e2f4438a2de424dbcfcabde126a6d9513c93972bc48bcedb4914a161310db8688efd547131bc7fd31d6bef8f58495357b6
SSDEEP 24:KLDL6HMzE6nEoF+agncNDYEMbEoncC4AgncHVWncCh:KmXozgncN4ncrAgncHVWncQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

metrica_client_data.db

Path /data/data/goldenburger.creapp.com/no_backup/metrica_client_data.db
Size 20KB
SHA256 4b8eff214cae08877967538131d30e7c83e64c2af67850037d03278664a62508
MD5 52a818f1beab7a735607a8e12e0842c9
SHA1 4656579802cbbe236e1a46c752c00e29f06f9500
SHA512 86b536e66a267791b5d72eb29e66367fab1a76bf153eb2c29abc049b0e9eb76154414ce428c861000952461b132dbd5a0f9624bc65c34826c7f41f466e0cb6ee
SSDEEP 6:7+/l/nLtaScuGsGFLuuQ7GjBU38wsGTV+GNERX4PBX4ogLugMBX4suuKfpqiOw:7+t/LtzcGtSBw8w2RmBEyPbAVOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

metrica_client_data.db

Path /data/data/goldenburger.creapp.com/no_backup/metrica_client_data.db
Size 20KB
SHA256 882faff2a0f007164d5dbda7bd7f803306423b5eb48a88b1bb72bde65b77e50a
MD5 44def4f6e42c3ec63f229d23af8c804a
SHA1 f5956d9295778b539bced03215343fd3cf7a9dd8
SHA512 a14770398044635a8a8fc0d59dc95af3a97ae78146a9ace3795d600a44098a5ff7099aa3d0ac40442f8ff8c5d3b5ceecb4b360bf47f3e8c7c902879e2e76228d
SSDEEP 3:pqRqRHvYpdlsqitXl6Mpn:pqRQHvE70l6on
MD5 SHA1 SHA512 SSDEEP

Submit Download

metrica_client_data.db

Path /data/data/goldenburger.creapp.com/no_backup/metrica_client_data.db
Size 20KB
SHA256 f8848f35e813088b2caf5f34ef93de47c32a2a93f8477cb754207d1dbaafdf87
MD5 4794f56903bd89c255da5192e9993c0e
SHA1 89254ca2ec6a12f5a9e74807fcc8f2090ea96af7
SHA512 afdeaec13a7400da5edaea63e463e2ea0f22d3302b621d4f220dcf5a5ae3924e1a2e59f96926396ab591e4d7a22e2a101fa8be66137009e89b31839c88e99060
SSDEEP 12:KruqVK+QBncQmThzoQVru0xRQBncQm2zZjrqVKHXD+QBncQmtV7PRQBncQm2zZZr:KaqJgncHMQWncCdtXagncnWncCdd
MD5 SHA1 SHA512 SSDEEP

Submit Download

metrica_client_data.db-journal

Path /data/data/goldenburger.creapp.com/no_backup/metrica_client_data.db-journal
Size 406KB
SHA256 146e98ffa5d9e2bcab865910ae5197a891e568e5f14742a861bbeb7a24a4a7c1
MD5 4b392af8c241f2938348f428686fecf9
SHA1 24444dc78db200ce392c871cc165a5d9a7b8d1af
SHA512 13177c0276b2b81ac3a2e8aa875942a63a8b5f8dcb628f3ece1b2404826eb70740a499bacd5d21ba8748bc28824dc6b1b6af945a34fab98214c5985bfe6d4464
SSDEEP 192:5d7snPnmkxUwRzH8Ko10kFt+9/XqyiJBNtVDQGPDgFGPDwc6IwnW978JHISLFiMr:1GCXPBPlcl7LjVdLF
MD5 SHA1 SHA512 SSDEEP

Submit Download

metrica_client_data.db-shm

Path /data/data/goldenburger.creapp.com/no_backup/metrica_client_data.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

metrica_client_data.db-wal

Path /data/data/goldenburger.creapp.com/no_backup/metrica_client_data.db-wal
Size 32KB
SHA256 98d5787a41102e05868c26995adba11326a57f946ea4a4bbd841220c0421cc74
MD5 4cad8b26f786b27ca5572cd16272cdfe
SHA1 e16d3f6e59f83b40f0347a30acd20def2aeffc5a
SHA512 94f489d3e4cfb53adae04688f76253fd80f27c22e6455d86fbb4b2f5262a3117c48d2be5eb2a1645debb403f3db608c5a200eabfc4ee64494301eb765c4d326b
SSDEEP 48:l9To9BzjSP/y9yZ9wkZ9q9lGfcGSP/y9h9Hp9:l1oXGPqMZHZsy0jPq3z
MD5 SHA1 SHA512 SSDEEP

Submit Download

metrica_client_data.db-wal

Path /data/data/goldenburger.creapp.com/no_backup/metrica_client_data.db-wal
Size 8KB
SHA256 351b524d0217892e21597ed9e6d2bfc4484fe9577aa9fa188741b8f31f0f031a
MD5 2c120e126c655cd0ed5a3ea9772ad4f2
SHA1 717af1ce056863c40708b6a89305882c25b5a553
SHA512 b8cf659b815e0b20fbe3185cbae290d194d33a4a1abee5dd52769f6f56707a775e8a86136f19782c6908e3cc182e636aaf515862689f77e18ac7001db959089f
SSDEEP 3:OlH/l2UCsAWVdlr2XkCsQjC7qRHvYpdXlgl7Z4hgmtXl6Mpn:Kk4VdliXXkQHvEJlg7Z6gUl6on
MD5 SHA1 SHA512 SSDEEP

Submit Download

metrica_client_data.db-wal

Path /data/data/goldenburger.creapp.com/no_backup/metrica_client_data.db-wal
Size 32KB
SHA256 ad1f11ad1f26cae62cd116f4f9907cb5b81f633e92174fd08bf9ef8eb425e520
MD5 d426453845bafa651f30da4784a31f3c
SHA1 bc439bb965e0ff2e75eaf46eb90e5ff58e7c0b4e
SHA512 a0414beb56c73867a57393b675d907bf31b2c466c95cb100474bf0a0cc190c300e49bd0be9e6bbf47e8c3449f249fa8a801d1d3a0a958154e8bab18a06c48849
SSDEEP 12:KMQBpKHXD+QBncQmEVrJRQBncQm2zZZHFd:KMoSXagnckWncCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

metrica_data.db

Path /data/data/goldenburger.creapp.com/no_backup/metrica_data.db
Size 44KB
SHA256 fe0df25fdd91e9cec2e77f5414deaf3b0fabad800acff14cf656340ebb094fa0
MD5 305a9780a7b57d27adb38d2d80b63630
SHA1 e062e2dfaa11ea4ccacbeff17e46a26b0cee71ef
SHA512 f19274c48f24573f50a39da482b40e19d7468a30ea6555ae0b5c5f2ea58779a2063135d0df1b8c5533c1eec554304f2104251e19a67f201f93b9be14fc84350d
SSDEEP 96:HDP6PRbYz8akybuX70A1FGPLH7LkXXWkk:HT65lyyL/1FGPDr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads