24ae3c4c672fa3c47ab6c8540e8523e21a8419fae818eeb9e6080a57df7766ce

Analysis

max time kernel
178s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
06/06/2024, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99dc786a3854b1f2fea66a4835ffd461_JaffaCakes118.apk
Size 3.3MB
Sample240606-dpby7sfd4t
SHA256 24ae3c4c672fa3c47ab6c8540e8523e21a8419fae818eeb9e6080a57df7766ce
MD5 99dc786a3854b1f2fea66a4835ffd461
SHA1 4f0cd17a9acd64dc1baa88ecde78b3759d256387
SHA512 2d350a493c4c455b8f4f154a1edf3b34d07742f1e810386503733a5e1a525ad2ebbfaf912079a6e9083a33cedb64b9d09db318430d0fc6364b63c5e9e48b675e
SSDEEP 98304:RohWAo3eZru6tvBsYrcnfRrxgzKnUTxWohL/BH2OtywXF3oyVAoVgIb:RogneZS6BBrcnfRrxgmnQzRZ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	ua.FoodSoul.DonetskSushiTaun:Metrica
/system/app/Superuser.apk	ua.FoodSoul.DonetskSushiTaun:Metrica
/sbin/su	ua.FoodSoul.DonetskSushiTaun:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ua.FoodSoul.DonetskSushiTaun:Metrica
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ua.FoodSoul.DonetskSushiTaun

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ua.FoodSoul.DonetskSushiTaun

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ua.FoodSoul.DonetskSushiTaun

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ua.FoodSoul.DonetskSushiTaun
Framework service call	android.app.job.IJobScheduler.schedule	ua.FoodSoul.DonetskSushiTaun:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ua.FoodSoul.DonetskSushiTaun:Metrica
Framework API call	javax.crypto.Cipher.doFinal	ua.FoodSoul.DonetskSushiTaun

ua.FoodSoul.DonetskSushiTaun
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4599

ua.FoodSoul.DonetskSushiTaun:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4649

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/user/0/ua.FoodSoul.DonetskSushiTaun/files/ZPkFS.log
Size 90B
SHA256 1dcfff30fb245dad8d68ae9a4d278db3a49d58ae9ea35f66fc8b17210d494ffd
MD5 09ce3caef8f1a5f998e46236e98db417
SHA1 f23b223d74f4f0e47a8fe390b39d45ec490264b8
SHA512 a267ed452a2a279dd016d867f748613a5db67c88900271a15539a14c2cef280afb046001beaab63c12c308867cb4322e4139f5e87b500afd531612216e4afcf4
MD5 SHA1 SHA512

Submit Download

credentials.dat

Path /data/user/0/ua.FoodSoul.DonetskSushiTaun/no_backup/credentials.dat
Size 234B
SHA256 da972f013562027519e058e510e945e525369ad32a4011f856ae474f05143f71
MD5 86066970390b0f801e0212cbaf512e17
SHA1 4bfc8a63cf3ed919b4a8b97096df9e540d157739
SHA512 41b7e7129a6a66a68e903426249f5d66a41a1640f85ee58ee25d40d18120e4d2fee84f6470540b1c1b17fafd95bb7c31c09454f6745be0b2f7d0ebacaa7e6781
MD5 SHA1 SHA512

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun

Path /data/user/0/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun
Size 36KB
SHA256 cea485b59f4285501f837e28f45347c4a67d20a93d5d7f97dd719cd6721ca24f
MD5 c0c5d3e87f9639e1a491abc9422d69f4
SHA1 8ca1f034ba1142c45c32a122f88395efc9cae6e3
SHA512 12b2edae2a502d982240bf67ebcc3bbc0bf01f8d2d6f15e4e84c5c0c5e3257a1ce670b9174d8cbf136c3d931ac11456d59a6900fa559aadba4100adbcc303f11
SSDEEP 96:y6E8LtFNpkFcaPq5Mnc7ncVLd3pbb6bbtXznApQc4+:/rNpkFcGquAiLd3O8pp4+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/user/0/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 20KB
SHA256 cbe292cd87aacc5d1489f56f7a2bf62f2b4994d5040aacc4241afddb83e28137
MD5 8f517fd77cc332b4ccdfd67aebd70407
SHA1 31e914d4ce1a8cf175c06c44d3d9d4c15d3fc152
SHA512 efedcacd67fb687871db26c9579ae9a364de0460b66df1b8204cd156950f53ab489c3c6f60c4b7a4735f65c6e3e8b64ccf702b3a10341fd1ed3b4cf4523a600b
SSDEEP 24:TLYfcQlNGSP/VbwRWMaLbJqEHsVgncN53EMNFnncCEzn:T8fcZSP/ZL1hH0gncndncZn
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/user/0/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 20KB
SHA256 036f3b611a612af0b39114db47125a0c6437d919250c3759bb2c115ab656ca49
MD5 d7fc46f7f24bdcdae66731df03f7a500
SHA1 9f325c38534865d2dac153dd498d70609749657f
SHA512 25541b6d6471e5a03b7dbee0201bb091ae5cf353b410f953731a46a581b3b5e3753fef57f2ab42807375c4ed199020db3de6279a14c6878ca8eef3c89bc78770
SSDEEP 24:TL4fcQlNGSP/zfqLiuWpGShwRaMazJnuEYgVgncN5jLEMmofvncCEq:TcfcZSP/bqZWsSFdn1YQgncTYGncA
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/user/0/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 8KB
SHA256 dffee892767eccb093133e62efb7fc168d115d3319b79ce8f0cf2d1fe3bd09ad
MD5 47451f833533bedab36bc7b889c929e2
SHA1 3642c6cc4c1450dcd63398768ff55f5226e18db9
SHA512 870d4eafe0d3d60ca380494c167d722232d1d06761b33a39135d7c0bed6ae65a427d2e7e58bdbecaef5a683259016843433dbb508b1af3f786a6c31d6f6bc332
SSDEEP 12:xVc3HW7lPTWRbeK6NGN/HjzDeoaA1krIkzmFfqLJdeWRmBEyPbB90v:g3HOWH6NGxXL1fqLJKGS8v
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/user/0/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 12KB
SHA256 697e77c40cc96a315a9fe8bf095fba95a873a02e97a098aba21073bb0d8936e5
MD5 44e25bfed1e57102ce6395251b4e96bb
SHA1 ba655a633e7449ac61ffddf6ae04cd734761023b
SHA512 2d228c38945c4cfd5f818db104bafb0ee3b725549930264d10c748fa0276e2e6d6e6e1a10b87773944f05e8cd597f7c5f5c0db705ff7c0c5bea55dd5320534c4
SSDEEP 24:RaP7CtpqLOpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSs:GYqNE8WctFMkUe9kftcPSs
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/user/0/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 8KB
SHA256 b2b8e281165b8b11a0a345b51efe32d2246f234d3f9981c7e2bbf9ac28c1b93b
MD5 50c8e83a732cb693a2f99097a565e923
SHA1 cc363407a520d96d483cb62951694eac66c1211a
SHA512 2e3ab6435ba84e93908e49f69d0d9ea633e8a6a71db44889d0f14453188ae8af5c9d1ef9f60c496e1cc36eef85194f4030677ba2a2edecd28bf641f55fad5114
SSDEEP 24:7+t/oqLepOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSf:7MAq9E8WctFMkUe9kftcPSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun-journal

Path /data/user/0/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun-journal
Size 12KB
SHA256 430ba79af0ed5ea9ae5911a574bfdf2507a87e6fb73a1cd77b2c026638253849
MD5 069f5ab10e0b5563f5119a89c369444f
SHA1 afeede826c6c119e484f5d286d60cd341eb9ee10
SHA512 cb8986ecb354477f608358af263b671953a8ff7e67a8150b9f7bd77a6d7fe5bb41d33e4aff7f6ce8d838dd9683e7c26c7c2c07b8823d0f3c16785f4ccdb7dc56
SSDEEP 48:7MPOhk9+DNfjEl4I8/ALAI8ZIGcucVwbvWmI+SI7MoBQ/EBqNE8WctFMkUe9kftU:7aGZnayQcBmE8LtFNpkFcae
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ua.FoodSoul.DonetskSushiTaun_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/user/0/ua.FoodSoul.DonetskSushiTaun/no_backup/db_metrica_ua.FoodSoul.DonetskSushiTaun_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 8b8303c23a41e4a9deb085ff2ea245d9fb3d5c9d5bdf93f04c38e2de65c0d748
MD5 741e451826a91e47681c48baed13fd86
SHA1 7b0f4822f5b4e4ebb3522c646bd29d13c8ffa4d9
SHA512 bca6a7f6fe3a347b3120f2241577cbb8a61d15e83bf96788a11675823ac4130f445763afc7f2f25966f903b0bc18c9811608e33456a608ebd332781355e93af2
SSDEEP 48:T9E8WctFMkUe9kftcPSu8U70HUmbKqEyjEnQfjO86b26If1oG32OV4pcTsbzroL:BE8LtFNpkFca9nbbtHhsbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download