81f4ef0f946f0f83b166102b379d87732b0f1cb3f6d92e4a6294bb0de1cf9c4a

Analysis

max time kernel
178s
max time network
180s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
05/06/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97095d2e490427895dd701d471c86632_JaffaCakes118.apk
Size 3.3MB
Sample240605-db1emsch56
SHA256 81f4ef0f946f0f83b166102b379d87732b0f1cb3f6d92e4a6294bb0de1cf9c4a
MD5 97095d2e490427895dd701d471c86632
SHA1 a41d04fc36b2638428a7378a17ebc247db9f7bc6
SHA512 222f517a839f2cdc8f741bff7b866236db5e37dadb29281055ca8befe7d068a4eafb48f35b5133b8548093bb4a0168d22b455ff9ae961a515c91991dfb636d1a
SSDEEP 98304:xugfuWWFkFL7EBasOqFRl8Fr24J73DwpwOtywXN3XWiBj36:xvLWOLpEcJpXn
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	goldenburger.creapp.com:Metrica
/sbin/su	goldenburger.creapp.com:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	goldenburger.creapp.com
Framework service call	android.app.IActivityManager.getRunningAppProcesses	goldenburger.creapp.com:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	goldenburger.creapp.com

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	goldenburger.creapp.com
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	goldenburger.creapp.com:Metrica

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	goldenburger.creapp.com

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	goldenburger.creapp.com
Framework service call	android.app.job.IJobScheduler.schedule	goldenburger.creapp.com:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	goldenburger.creapp.com:Metrica
Framework API call	javax.crypto.Cipher.doFinal	goldenburger.creapp.com

goldenburger.creapp.com
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5128

goldenburger.creapp.com:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5175

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/data/goldenburger.creapp.com/files/ZPkFS.log
Size 12KB
SHA256 7e72fa05027fb211efdfab4175420641c3f9b24b4046f59ad926613ebc483f1b
MD5 e98f7d21f46386b894efd8e4894a3c04
SHA1 d7906fec82ce7ac664655a22474c9d17384e42b1
SHA512 2940e87f03dea74e1276607ddd7d6ca78b5bd9b262c27fa90c1630a87679982e29d9d71ff37e8ca7abab85aed4a5d22b0ed14d647c526ee5ffd9e7f671047ffe
SSDEEP 24:7+trlzqLY0MxKyOmctlDWwwTRD5xs5cQlNGS2:7MJqEkDP6PRtxOcZS2
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/data/goldenburger.creapp.com/no_backup/credentials.dat
Size 233B
SHA256 9e82d36ef02e95936fb64c575eb50dc32261678ce3b54950b822752edf17b287
MD5 48dbbed3f31e0738220ea5096bffb154
SHA1 975d66616f7c842d2503bdec5cefcf2de7ba4862
SHA512 f0304540db2dfce5f94c2abc8ab7ddcf23686fa0648d544864630277cfefa104b4ab5f391317c9a4abca34a89376c5e31f3e7820116a41704a6b37374f2959b8
MD5 SHA1 SHA512

Submit Download

db_metrica_goldenburger.creapp.com

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com
Size 36KB
SHA256 db27715a9e560f4d370bbf4f02025273cf083efd1f3249f5b0a1a1775c75a8e7
MD5 4adff83c7aa637d999ed889d62dc5d6d
SHA1 9712fde0371c7d288471e7dd51bdf99c8fcc3f88
SHA512 afca9440bdd9d53dd5ec61c6f496029e3259a2d452673180ce97eb2834acbb36ca2d0f8460f334aa3b9ffbf4255b9bb72826b5d3724a348cd4f5769a168f270b
SSDEEP 48:TVE8WctFMkUe9kftcPSSincajQk9uBDujgK+5syI/jIfuu4JepJkc1jUFuKCsbzK:JE8LtFNpkFca3nce474whwfbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 20KB
SHA256 26fde1c3a11f9cfd04633eacdc79504b6dd4b906af077b5630c54692a31ce5ab
MD5 b89e264aa96466b9c40133e43553d382
SHA1 0c7dbd8999b926f2dd8df9bc77ab55cda703c9b4
SHA512 916dccd202af768bed915b3f5632546d08f0ca1514b430e6699b70eea6859be09eed793ac4ed4247d99a2c123baeeb297517028768358469118b91c59c0e0c0b
SSDEEP 24:TLQfcQlNGSP//A1kuErwMdyBMYp/gncVjD/X4DEMnncC1:TUfcZSP//A1WrJdep/gncV7mncU
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 8KB
SHA256 88e0a2395c11f83b2154c9c2563598cf87d5871133c620077ef3483a263160bc
MD5 3fb5ac4d2ce2282ba4191143c1feb685
SHA1 7ef6f71f00490d619bbaff4b149fc5186292476c
SHA512 f9adf6f6f173a187647502888051944e21725b5fad1b836cb4defe975ee6e436e5159c1b79ad8e84fbb7030fc97be00a111731a0ceceb1536c89df1e774dfea9
SSDEEP 12:x03HW7lPTWRbeE1+ycGtESWC5dmtO7OzzsWn53ki4g3sEwEIvbqLiuWdwRmBEyPA:23HOWSDGDWC5dEOcbpL4gmdqLiuWRGSk
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 8KB
SHA256 6254458dd82a32fe2c79a24b2b7ad330010b247605b84613719f891cf781d0db
MD5 e44fbdb5d61b2017e58523aac2427556
SHA1 d86c15987787dd243ef5a24483e33fb8eb5e1ca3
SHA512 2f1442096773e74015623428ef1963e69a47d244bdb372af5bf9ffb63fad4f8cf86df971924a12069a9afd4aa6527c14e6ca9b6dd90c3fc75938c8d3ad610aeb
SSDEEP 6:x4QbPDnkPzhgg9bNFlLdrlOERX4PBX4ogLugMBX4suuKoC/d:x4IDg9gqLJdTRmBEyPbmd
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 12KB
SHA256 e7a2f949c71fd27fad0b33f65b856a777bc34c21d128a45e977adc0e2c8f7d1f
MD5 d579b36905e38588b7829b8be8b18f05
SHA1 e6e4595a64cf02d94c5572c85e36874589478c33
SHA512 981b8946e6725455fbfc5d3345f5610f76efaaedb07adeaf2ae73135ebcb230f48eb69248184541d613b387a1c408f703d108b975db4f4ded93ce49135281245
SSDEEP 24:7+tOEQqLGpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSL:7MlQqVE8WctFMkUe9kftcPSL
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 8KB
SHA256 7d9c7e72cdd859387ebf6aec1c7d743e5798bde9765a29cb93f1597705f98efb
MD5 e64080d711d9f11d784f8412ae674b3e
SHA1 bcf0c1b0d3be744340dc2e507229a091d56cf917
SHA512 71cfccbff2ecddcdc31a242720bed4cfde2289aaa16a0c63207e1149a151aa38802e83dd31edbdf0eaf352e8fd2c23d1f29a65d2fe6692b3ce3389339a9a8b62
SSDEEP 24:7+tE8iqLZUpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSt:7MENqtDE8WctFMkUe9kftcPSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 12KB
SHA256 8da90e4de8577858856b4993d40c49c4aeba9825046e3a998d8e0d53f072e010
MD5 9cc8a3d7974725d1d88055f455f969c6
SHA1 77f4203266c5f54e3807e2b696bef3bfde2e7568
SHA512 994397faf4f8773417e301709c2a64298da4d5e633fa7438e7ebb3346ab6a36875df26dc0b1f6640cd9faa6972e104df61bfd7ae7e38041275448510daf917d1
SSDEEP 48:7M1/k97BDujgK+5syI/jIfuuCJepJzc1jUFuKCsbLqlE8WctFMkUe9kftcPSK:7r7CwWwfbLOE8LtFNpkFcaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 5ed799d57496a632c55f5eb68d2c958390ba94254afc85f0e0cc5521a939a7aa
MD5 3ec7ac60d1bc7144173c6fa80ac88e14
SHA1 8901d41fcd0a7bcdfef6dcef5275e88960cf5784
SHA512 11a448d0bd2dd09d7a95ed45663679a8c3c3c2da7a487025773eb5748b2cdd6c6d601275babfa5c43daab55c3b275ba22f5e0e0dbe3e85f31a3d1148cf79a837
SSDEEP 48:TVE8WctFMkUe9kftcPSB8UMsHvbCmiJjElqIfjNZ8ES/2vIm1ode2b0S/lfTsbzK:JE8LtFNpkFcaW2bCmjLwDRsbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download