130bce75bf29b75fb6a50f24006ae103dcf3447af3f0fbf2d3226460f2416dc0

Analysis

max time kernel
163s
max time network
147s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
14/06/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa6121749c8048c28459a2ef994e16ff_JaffaCakes118.apk
Size 4.1MB
Sample240614-snwpjszdpq
SHA256 130bce75bf29b75fb6a50f24006ae103dcf3447af3f0fbf2d3226460f2416dc0
MD5 aa6121749c8048c28459a2ef994e16ff
SHA1 54c426eff296cf431f5ade3d1f81f09aaa490a73
SHA512 29411f1bb1797edadd9ce07b158685999427f5f000404a823a0a4db6ffe9457eb70fba40a9ad7cdb269a062cfa8feb217de2632037f203b6a97790df3962090c
SSDEEP 98304:bLfcSvFZqc2yob2xi7E9qXgPDMJZexIbumLt18EsdJqbaljM2MbTvvbFGJTjNi:3P2vJyxi7E9mOMmxUCdcP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.pantrylabs.watchdog
/system/app/Superuser.apk	com.pantrylabs.watchdog

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.pantrylabs.watchdog

Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pantrylabs.watchdog

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pantrylabs.watchdog

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pantrylabs.watchdog

com.pantrylabs.watchdog
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5198

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

666C5EEE0302-0001-144E-F8DB0209D4BBBeginSession.cls_temp

Path /data/data/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666C5EEE0302-0001-144E-F8DB0209D4BBBeginSession.cls_temp
Size 77B
SHA256 8292a234b4db73658204b326d9f8d8cfa8480225530f9c68981c0b41361386ce
MD5 8e94c1860b209572a2b9d831e15bc7bb
SHA1 fd0635e3cad9c766bfa27cde1f2511478a1169c7
SHA512 dcded3a5bff0c5cd95a7e2ae9e8218bcea6635bc49b9643b3051b7f96d225e1cf02d5783665ab35301efb3adb5ed8108da664b121109b07a77e3ac3f14cfce61
MD5 SHA1 SHA512

Submit Download

666C5EEE0302-0001-144E-F8DB0209D4BBSessionApp.cls_temp

Path /data/data/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666C5EEE0302-0001-144E-F8DB0209D4BBSessionApp.cls_temp
Size 117B
SHA256 449088e04b01f72b367a4459f699b9c34441afd1345d3b4f31838bb99ad497db
MD5 91d60e23a0885bcda27c73866503306b
SHA1 12bcba275b5e4088db77520125883848d3c67552
SHA512 661f66bfb3de37515d9ab336924657a80355c9a7748ef4eb83a1d1e4ce3fc128dc5bb9729c82b50098808bff0ecff466ac5820d9dbae8323fcc5f2f949db088a
MD5 SHA1 SHA512

Submit Download

666C5EEE0302-0001-144E-F8DB0209D4BBSessionDevice.cls_temp

Path /data/data/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666C5EEE0302-0001-144E-F8DB0209D4BBSessionDevice.cls_temp
Size 144B
SHA256 347c22b16d61658b0d036946b43955461e7c5245b3f40f80915d83422077ecaa
MD5 ddbdee4fdb5f7adec8fab6b53374e8f5
SHA1 5728be9cb6643852cce2385333f37468ac72e2d7
SHA512 c834a1af99a165484a1aefb76716efd2b3b4d6a5744856a78aa5f44bb5b44663668756aeb2ac586a42adca55fce67e98df7361d28bfb77c895c565eeddb4bbfa
MD5 SHA1 SHA512

Submit Download

666C5EEE0302-0001-144E-F8DB0209D4BBSessionOS.cls_temp

Path /data/data/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666C5EEE0302-0001-144E-F8DB0209D4BBSessionOS.cls_temp
Size 15B
SHA256 5acdb54ddba2e264f6822fbdbc4e9b5158f57d43785c2f01d981956b18f7a90a
MD5 2566d27ce8c28d8961f082c375d7535e
SHA1 92fe585b1a2c9c523d2fa1f65ab5c1b6a1a6edaf
SHA512 1c70679bbd25a57f9ac02083d5af0fe72b1417cf3070a195497f03d6f492e87b1ed3f570de7ea7c814c995a1530e32610d9570f31a480648f4062e8d3287be8f
MD5 SHA1 SHA512

Submit Download

crashlytics-userlog-666C5EEE0302-0001-144E-F8DB0209D4BB.temp

Path /data/data/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/log-files/crashlytics-userlog-666C5EEE0302-0001-144E-F8DB0209D4BB.temp
Size 875B
SHA256 531fb22a3e88c34df137be113b7d85a82a2d21b82a64f7cf04ba8de27aca7912
MD5 58cfa483afa9692163386081eee79701
SHA1 7bfe5af4a5aa8246782d36107d2fd7c802430329
SHA512 a79544419f3dc4190ba9eee2b7377a13634653ab7b15985dfdfdbd82173edb1b5e763d4ed3a432b5d87859d9ba27ffe1084317fddf226abc448b492fefaebd36
MD5 SHA1 SHA512

Submit Download

session_analytics.tap

Path /data/data/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Size 1KB
SHA256 55db21460c935a07a4e33f5cbc47ded9a44c94a937fc6956bec84c2e88b3b3cc
MD5 c00add096abe5c149a43025f017e74bb
SHA1 d7ccb066dbc56f54533b3e492a98d420aa43e596
SHA512 a62bb299df0181b5346c09e75b2d2f44c916a1a2be5769ee08f60847542391cdfc12f4a3d049ee2472fc7d6de3c245bba74c3728007d7c3ef7b474a9e17f4587
MD5 SHA1 SHA512

Submit Download

session_analytics.tap

Path /data/data/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Size 540B
SHA256 dc1926ce1e28967b232ccb93441a915afa49ec8618d56fca009e739a8cf320e2
MD5 721c8186e5061c90a7ba984faf03ddc1
SHA1 4a681a2a77c3f5deb15285ef285ab841b3904fb6
SHA512 cca59c191f95a98305984eb34f59024a70b0deb646f9ac0d9dcc3881354e803a8b092ca1fa5a5b51a69bc14e8dc77ac4e227ed04298976a2fd97dac817443c38
MD5 SHA1 SHA512

Submit Download

session_analytics.tap.tmp

Path /data/data/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
Size 16B
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
MD5 SHA1 SHA512

Submit Download

sa_5c9b9f3c-4f56-4883-be81-aa51b21f3bb8_1718378223791.tap

Path /data/data/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_5c9b9f3c-4f56-4883-be81-aa51b21f3bb8_1718378223791.tap
Size 411B
SHA256 0279dffb0a6b571a9531805f53ed3ae42b9bac59fdd0dfa882e47543e68d1f79
MD5 e27fe85ad27921e4c779a4d686f41311
SHA1 e92293a5e4ecfac17595aef3db86e0c3198b2d3c
SHA512 21c3f67c6e36b03ab9b049e7867a1be0e1c921179a061748186dac1330411d0b919b3611fb1fa0fc51876a7074f42d1de7df18951ddc0e6b16359cd25748151c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads