24ae3c4c672fa3c47ab6c8540e8523e21a8419fae818eeb9e6080a57df7766ce

Analysis

max time kernel
179s
max time network
151s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
06/06/2024, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99dc786a3854b1f2fea66a4835ffd461_JaffaCakes118.apk
Size 3.3MB
Sample240606-dpby7sfd4t
SHA256 24ae3c4c672fa3c47ab6c8540e8523e21a8419fae818eeb9e6080a57df7766ce
MD5 99dc786a3854b1f2fea66a4835ffd461
SHA1 4f0cd17a9acd64dc1baa88ecde78b3759d256387
SHA512 2d350a493c4c455b8f4f154a1edf3b34d07742f1e810386503733a5e1a525ad2ebbfaf912079a6e9083a33cedb64b9d09db318430d0fc6364b63c5e9e48b675e
SSDEEP 98304:RohWAo3eZru6tvBsYrcnfRrxgzKnUTxWohL/BH2OtywXF3oyVAoVgIb:RogneZS6BBrcnfRrxgmnQzRZ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	ua.FoodSoul.DonetskSushiTaun:Metrica
/sbin/su	ua.FoodSoul.DonetskSushiTaun:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ua.FoodSoul.DonetskSushiTaun
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ua.FoodSoul.DonetskSushiTaun:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ua.FoodSoul.DonetskSushiTaun

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ua.FoodSoul.DonetskSushiTaun
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ua.FoodSoul.DonetskSushiTaun:Metrica

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ua.FoodSoul.DonetskSushiTaun

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ua.FoodSoul.DonetskSushiTaun
Framework service call	android.app.job.IJobScheduler.schedule	ua.FoodSoul.DonetskSushiTaun:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ua.FoodSoul.DonetskSushiTaun:Metrica
Framework API call	javax.crypto.Cipher.doFinal	ua.FoodSoul.DonetskSushiTaun

ua.FoodSoul.DonetskSushiTaun
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5040

ua.FoodSoul.DonetskSushiTaun:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5091

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/data/ua.FoodSoul.DonetskSushiTaun/files/ZPkFS.log
Size 20KB
SHA256 ddcb0e1970efc2dcb42a4dd328ef8c10f3512b39a47277d5b075fd3b92dfc3a7
MD5 ea9c2dc01d788f2ed7ad6a455e32335a
SHA1 3da6ee06226734e9a402c3ef2b542af3b509b6af
SHA512 5b834f25f6f8afea98eec78cf8e148671ceca48aee8019e09308389c1f336e47e55666fedf66e09c97e827c375ade0fad635b98686ebd2f72240108670d25e76
SSDEEP 12:TLnwfcGtSBw8w2RmBEyPbP/hqVK+QBncQmThzoQV7PRQBncQm2zZjn:TLwfcQlNGSP/hAgncHVWncCh
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/data/ua.FoodSoul.DonetskSushiTaun/no_backup/credentials.dat
Size 233B
SHA256 60d5d34ed309353a3821b85a7bf9de46feb65c374fc08517d292635ac949eddc
MD5 e163088a399c375321ea62f90c85f627
SHA1 f214d9ed10f12b62df23cd75ae90b7cc04d22846
SHA512 fa345d3cf84e8580977548ccee728d026a8152e43f8ccb454c14ac6acdef52193e599b3f973a5324ba0a7aa976c7f771e82a2a3f2a46cab2a74f9fc5e6a7c80d
MD5 SHA1 SHA512

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun

Path /data/data/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun
Size 36KB
SHA256 9921d07764ee28b53a6c6017a45b3192fb14bfe8edb25330cf9a9824202db9bf
MD5 575694aa0381176e568d0b9dd0200a50
SHA1 ecce4ffb90c2d80ddc2ea42c07b1667a27612075
SHA512 4b8cb47de7ff3411237d8d23e7a4aa3d250dfc19699d056812c5d692ebd2908ad827e7032d362c7d26a6e407a6141b1ee3d164361fead8c061e2cb1baacf5adc
SSDEEP 48:TlE8WctFMkUe9kftcPSLkncDk9u3uj6dG1IATSlSuQIb4tKNVSSwLICKbzroL:ZE8LtFNpkFcaLkncz4t0bn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/data/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 20KB
SHA256 71cbcfbaff67654ba6f1460e939e4ceeddd9e1a817184925ebf0e7bb3e582bae
MD5 aa8b7c83b90b002791040e464ce0e80d
SHA1 7f9fd73a6f51427a53b05896e0f6e24dc2129370
SHA512 c2485504493a0f9c2686d21cc745d4e31fa11a1a5fa860967d810dd143e67eb739384765d59308d8e69f17d82887c3da0f1029ec9f72f0695be18b3bc06cc0bc
SSDEEP 24:TLQfcQlNGSP//l1YMYLnEKDgncINL5yEMZF3ncCk:TUfcZSP//egKDgncId+3ncl
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/data/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 8KB
SHA256 b557d182fa0a90e7b196b4aa1f1930657e98b8250d2a2502820c43a8aa23d203
MD5 12779783d1e1d75227cf98c3863f6a12
SHA1 a3db2c0aeb91da3146503d11b9d3a4833a6f7d80
SHA512 287dacc4da4ec5313160da1f2606ebba90a4abdcbb58bfdc38e2ff6bdc079ab0ab56f936d746359c40e810570757ec54342d1489d0486ca7d36119307b480e76
SSDEEP 12:xV53HW7lPTWRbeK65vbtmGHJO7Omqcoi4g3sEwEIvhWqLiuWdwRmBEyPbh:V3HOWH6VMSOF4gmiqLiuWRGSh
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/data/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 8KB
SHA256 bf1ec7e51893a949a6d01e34f53faa5290b40c3a4e6a8f09d93d08e01b9d7fbc
MD5 ae8b564a751ca1202b729183e768f06c
SHA1 1bf7f55c62a762a8c511e197f7d16967140b2c51
SHA512 1020f1dd9b522b1c19b79fbe0d7b014ebe2614691bf6c40248510553804f992f0b0b6a0325713a1605c3cf646400735842f83152811513ebd86ec47f77513921
SSDEEP 6:xThkOPDnkPzhgg9bNFlLdrlOERX4PBX4ogLugMBX4suuKh/h:xVkODg9gqLJdTRmBEyPbyh
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/data/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 12KB
SHA256 c5c60836c3f8ce0817808652438aa967d2667c3ce8f6cf31d1e752899abb734e
MD5 ac572b87be596489f4d764fe144b0118
SHA1 2e43d707e7d9b541097d66000d7b6c897b1679f2
SHA512 bd647ac363e6aae7ca0bb85e7b91fa51612c61a2464df4d3293dd37451f55864894f67ce6c8a20613af502f4714abafb3f8ec77e6bfa27802848987a08a3927b
SSDEEP 24:7+tFHE1WqLGpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSy:7MFkUqVE8WctFMkUe9kftcPSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/data/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 12KB
SHA256 f9be11d3cd0e2306b7e92bb0122040571527ad21374c8d5a610c4bfffbe9a294
MD5 2c7e2a2e7d8fbb355c569128d65f5339
SHA1 18ceb0c378b7ce28e02e15d4b093892d1906923b
SHA512 6bb6a2514cf3402345330316a6ede9ea432cf3530785e2160e37534c0b62343d93eba53729cf46121681ec45eb0d1b2c368ccadea49113375dd9565577183b79
SSDEEP 24:7+t7E2fbBidqLZUpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GS4:7MQ2fbBidqtDE8WctFMkUe9kftcPS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/data/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 12KB
SHA256 aed3deacf41d2ef47e5896d365fd80b7dc519e959664c3436a161c8095e63493
MD5 72278a57573f0304c650fa09665ae0fa
SHA1 74c06e8e65a1be05b6a77f44ef5eba4d039a0381
SHA512 cb01f00c9dd5db06e8e4bd7385ca233caea1b709f28abbd44c1079125933dff176dc6e19483528654288dab719bbb9bd02a16aab4dd3943d8a503b54a55d1d01
SSDEEP 48:7MlQk973uj6dG1IATSlSuQIbgtKNkSSwLICKbFq1E8WctFMkUe9kftcPSk:76DgtXbF+E8LtFNpkFcak
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 de3d5c4d0087b4432d718a9d4d1426b2843f8579ad916b73534516b4e7d9735f
MD5 3d6839885d8b4e9de1d4f619102c77e4
SHA1 8fd17db156508eb034e93b49b56d949314c84ac0
SHA512 50df03192747a50483f102093829975228a2a39ed101d9131d567f07226a6cacb4778fb5ff31c8c539833a723c1ee43848db160c8e7860d3a5f91c1eb5cf94cc
SSDEEP 48:TVE8WctFMkUe9kftcPSB8U6HHoxbCkJPjEWgDfjO8ie2vI41ode2b09/ufTsbzr+:JE8LtFNpkFcaWUxbCv+wDJsbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download