130bce75bf29b75fb6a50f24006ae103dcf3447af3f0fbf2d3226460f2416dc0

Analysis

max time kernel
162s
max time network
130s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
14/06/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa6121749c8048c28459a2ef994e16ff_JaffaCakes118.apk
Size 4.1MB
Sample240614-snwpjszdpq
SHA256 130bce75bf29b75fb6a50f24006ae103dcf3447af3f0fbf2d3226460f2416dc0
MD5 aa6121749c8048c28459a2ef994e16ff
SHA1 54c426eff296cf431f5ade3d1f81f09aaa490a73
SHA512 29411f1bb1797edadd9ce07b158685999427f5f000404a823a0a4db6ffe9457eb70fba40a9ad7cdb269a062cfa8feb217de2632037f203b6a97790df3962090c
SSDEEP 98304:bLfcSvFZqc2yob2xi7E9qXgPDMJZexIbumLt18EsdJqbaljM2MbTvvbFGJTjNi:3P2vJyxi7E9mOMmxUCdcP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.pantrylabs.watchdog
/system/xbin/su	com.pantrylabs.watchdog

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.pantrylabs.watchdog

Checks the presence of a debugger
evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pantrylabs.watchdog

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pantrylabs.watchdog

com.pantrylabs.watchdog
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4452

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

666C5F050347-0001-1164-1FAAE980496DBeginSession.cls_temp

Path /data/user/0/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666C5F050347-0001-1164-1FAAE980496DBeginSession.cls_temp
Size 77B
SHA256 4c8f40d7b62b1b3251f590b0e7a05e88ce6b5f3b0dac06867fc56607d3b16220
MD5 b0543258513c853cc0f03e1cf3477068
SHA1 253a581f4203f260041247860b23b562eb153eb4
SHA512 d7f62f9f6a28ecf3707e4cc6c9d21e81f004fb7635a2b4b238478e785f79e205fa1bbcaadaced2e38873b51049e90400561e5a828ca6eebef5f51938043184ca
MD5 SHA1 SHA512

Submit Download

666C5F050347-0001-1164-1FAAE980496DSessionApp.cls_temp

Path /data/user/0/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666C5F050347-0001-1164-1FAAE980496DSessionApp.cls_temp
Size 117B
SHA256 95512feca8f133e56f4d71fe0ec5396b80877c05c1e1a57a4bdc785a166bd30f
MD5 05e9e13894d85f34a0b04db0432919f5
SHA1 50f91258da7353542f4744eabaae10cd8931cbd6
SHA512 8eb0d7825e23e44401622625222b3e0b2529c3873b1473c34f92ea80dd76520a55fd50e1715dca362f0721432459d9a06866d5e1b96db8fe80c927b2640e801a
MD5 SHA1 SHA512

Submit Download

666C5F050347-0001-1164-1FAAE980496DSessionDevice.cls_temp

Path /data/user/0/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666C5F050347-0001-1164-1FAAE980496DSessionDevice.cls_temp
Size 144B
SHA256 f78c8ae38c6f44baaada9255db6cac90fe67b2eb9a5381fc342de4e60228766a
MD5 afe14957fcf73d4f6a29dc7fbfd7d95f
SHA1 dcc8f111e11c2ff8c6e9c1485e16067e0cdaef31
SHA512 b5d6e1e59332d6c49ae3d2001c2811e36b3d003a023b49a8edba3776da3e7c887248350dea0f168c0e78f34bb4aa11cded1a0a1bfe07c650d1490b98aea68647
MD5 SHA1 SHA512

Submit Download

666C5F050347-0001-1164-1FAAE980496DSessionOS.cls_temp

Path /data/user/0/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666C5F050347-0001-1164-1FAAE980496DSessionOS.cls_temp
Size 15B
SHA256 1ead5b213c87f182ffce484c34f7d9f140ad3425c0f303f460492efe8a26c56d
MD5 b3d9541cc92a9153d14e5160f8d8c008
SHA1 2e1ac80eb381dd82a03795b682f92020348c0113
SHA512 78074409135a210ba4e1407ad9b3f784f5683e83aac4ce3482d4e8135425cf2b30db1ff5dd0041901c490a551a477237c6d255671c7b1fad74090980dcf3334f
MD5 SHA1 SHA512

Submit Download

crashlytics-userlog-666C5F050347-0001-1164-1FAAE980496D.temp

Path /data/user/0/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/log-files/crashlytics-userlog-666C5F050347-0001-1164-1FAAE980496D.temp
Size 874B
SHA256 2eb0e26b94e8049f6735794a6faaad87bf5825830946875e1e44aed5809724f4
MD5 d79ea8b51a3aba8ad46249cfe05ddf14
SHA1 7c6882297debb91cd6247b39f427637fd1df124f
SHA512 89cdc14d648e43f93fe686167b9a96c49167b4803e909192b3d7c5b88b107539dad7efdb765bd5da99077f045ff7a04ac283660e183c9bf8fe143da177486384
MD5 SHA1 SHA512

Submit Download

session_analytics.tap

Path /data/user/0/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Size 1KB
SHA256 0ea041f6b3ad50a71da11147551003f94dc8c682efd44cd9d7196bf0c9be0e99
MD5 7336a75580fbdadfe9f0d61d81cd17db
SHA1 e0e9db7955a8aadb6141224c08b9f0254cfce5c8
SHA512 4454a02164914d208b4495626113054c35e6f8bc840d13ec116cf8fdc5f72848dde7ea0fc7e33b441c064ed1704968f2bc21a91f9945909ac087e5733d55148c
MD5 SHA1 SHA512

Submit Download

session_analytics.tap

Path /data/user/0/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Size 540B
SHA256 a016a7ce52fda5cfface39a47811805a7fa7838b0aeb4b80c0ae2f1f4de6472d
MD5 c9149d0229ec5a962ef8a62d57846472
SHA1 e376316ef8af0f3bd558c5af2daf3ab6cb6c21ec
SHA512 c8de2a2e36e93d9bd5728e4153f7f990a4f708772aace7b6ff5fc4ded977dd8d505b29377b948431ee92147d5b739eb564883de7b99d4f04698b2a7bf7f3538d
MD5 SHA1 SHA512

Submit Download

session_analytics.tap.tmp

Path /data/user/0/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
Size 16B
SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
MD5 c33583fae4e0b61cde1c5b9227963237
SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
MD5 SHA1 SHA512

Submit Download

sa_5b4af36c-0d1b-4771-a80f-f759e869a623_1718378246801.tap

Path /data/user/0/com.pantrylabs.watchdog/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_5b4af36c-0d1b-4771-a80f-f759e869a623_1718378246801.tap
Size 411B
SHA256 5ef452263b167c34ce2f14db1b9704945b927ae66110915f60b9c95d50d43a8e
MD5 5536f2d549761de19a5db329765f7434
SHA1 8741ae7adf3ec791a92e31790f50f9b70c7d90e9
SHA512 6892e374b63ef4f65968cfca2b22a8c8ea4c388ad5e9eef883d96e831a9d97addb127527fd703902d2bffe87b46c1ec9fd971f0437a9f932b6f5fd6964d07da2
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads