31a3312b2124ff5c45cd4b83ee1a620e5b8bcf2c35ea7794bf9717a42049c6bf

Analysis

max time kernel
179s
max time network
178s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
16/06/2024, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5d2c6e657f5a55823277006287d36fb_JaffaCakes118.apk
Size 3.3MB
Sample240616-3thd8athkf
SHA256 31a3312b2124ff5c45cd4b83ee1a620e5b8bcf2c35ea7794bf9717a42049c6bf
MD5 b5d2c6e657f5a55823277006287d36fb
SHA1 35d587627c040d2d7d9f2d6ccbaa531bc525499a
SHA512 0c0b3b3f83998f5b55aa076366d5a31a0e7378db84a5b11c1a225ac6ffa1f8767e180e5084ef73934be79fe570846bd95808d1b6e0a093738309c198d222b9fd
SSDEEP 98304:xugfuWWFkFL7EBasOqFRl8Fr24J73DwpwOtywXN3XWiBj3g:xvLWOLpEcJpXJ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	goldenburger.creapp.com:Metrica
/sbin/su	goldenburger.creapp.com:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	goldenburger.creapp.com
Framework service call	android.app.IActivityManager.getRunningAppProcesses	goldenburger.creapp.com:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	goldenburger.creapp.com

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	goldenburger.creapp.com
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	goldenburger.creapp.com:Metrica

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	goldenburger.creapp.com

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	goldenburger.creapp.com:Metrica
Framework service call	android.app.job.IJobScheduler.schedule	goldenburger.creapp.com

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	goldenburger.creapp.com:Metrica
Framework API call	javax.crypto.Cipher.doFinal	goldenburger.creapp.com

goldenburger.creapp.com
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5072

goldenburger.creapp.com:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5124

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/data/goldenburger.creapp.com/files/ZPkFS.log
Size 12KB
SHA256 2143815f9ca844cbde4e9b5340a678ebc9b5fa53d62c0c491aaff875dca47aa1
MD5 412bea4fb52a48ecaba95b3b75082fe2
SHA1 15912ab4827a252db5791034d5a413999da55012
SHA512 25f2bcabbbef29e475ca51df9a5546ec4ced19d9acdd4efbf19c9826166a899591d747559613e8c450dee3dfd853ac9f23c603044c85d25e49a3663316840bfc
SSDEEP 24:7+t2WqLY0MxKyOmctlDWwwTRD5xs5cQlNGSa:7MxqEkDP6PRtxOcZSa
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/data/goldenburger.creapp.com/no_backup/credentials.dat
Size 234B
SHA256 2d61a9b78a6d41cb4ed7e902ed64e2885185e34bcbf68cb04e99b7123867f699
MD5 b41df7bdfefa2ef01521c25d1930c9a5
SHA1 9bb46324a65fbf072b5499032af5b3dfb1d0b052
SHA512 0ad740e287a6b59b1fb8e4dcbbbb955cf1620b8928c7fd30445f216253699bb06b948058f6769e14134411ec35de065530ac1a54875d6feb18601f8eb60a70d9
MD5 SHA1 SHA512

Submit Download

db_metrica_goldenburger.creapp.com

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com
Size 36KB
SHA256 6f5d405466908fa0a66e5d2df3ba256eccaf8727aa49b605cde8596319478aae
MD5 252a8d8079f1bc61145803a1342bde63
SHA1 6feacbd0cbfc261a6fc2ee9616245d78c056fb81
SHA512 216873e216d54fded3da29a2fa2e5db2ba8ea65c8a71935ae8e40c21d872038d75e4584c2136550bbe21a6941fe274679910282be274fb13cfcd890b19430f52
SSDEEP 48:T1E8WctFMkUe9kftcPSyoZncXk95EujgI83vpXIUuGIp4cRpOp+VGFuK4WbzroL:pE8LtFNpkFcayoZncY4sqjbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 20KB
SHA256 bbb4689e93fbdf1e2b295284fa8a44669ac9d3719597ad1b0c0d22ab6ba16081
MD5 cd303afb4ed7d47babce686e470bf44c
SHA1 86cb04cc146aae3228d5ea3ac500eff90595ea76
SHA512 6ad694949a2f3d402786a2328e5874acd92b3fb00fba1c20c69f74e7f030a45e0a7255f5779c649546f22290a95f089677c7cb3aa6a98f2dee231c6a11e23cd3
SSDEEP 24:TLQfcQlNGSP/Pch05MGEKDgncNTvxL5yEMPsncCEw:TUfcZSP/2HKDgncVxRnca
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 20KB
SHA256 25d11f8b4a4cda9a22a658f54632b797285b959c9e044a01e14649dd6a78b436
MD5 d18b37453222422412bbb8596417276b
SHA1 c369eafb1e5283606eda8e334fab1591e9b56ebe
SHA512 0d215b60b81a425317e9baa8e4d1760baa51d4e4f7183c82414e10af4822ef8590da5811f90767e72fac92e6c5d4a0de4d348a43724c3dbb896d7903b0fc2a9c
SSDEEP 24:TL61fcQlNGSP/2nqLiuWRGSmEZBfyh0SMKzEA6DgncNlSRvxqxEM8ncCEp:T21fcZSP/qqZWESPzkfQBDgncnU1ncD
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 8KB
SHA256 81e81b895bb1de133bfbf81a62d0158b81da89341791424aa9f85a96cb2915d8
MD5 2ca134ec9f8c33c0e9b18b7cd0d90071
SHA1 306a4d30ecd67649be9db89e122a0bdc583a9a00
SHA512 cfa68facefe38c4aff15a85f706e994a8ca8b06fe9a01e04cd75b713da7fb45a84a166e5fc3f0e049819808102d5438a84d2eeb9ed50c0b96d8eb3c92a12faee
SSDEEP 12:NUe3HW7lPTWRbeG0RZcGtESWFkPwJiCWU5uPD1cih4qLJdTRmBEyPb80qf:ue3HOWE+GDWFkPwDaGFqLJyGS80qf
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 12KB
SHA256 d4ba97dd33f1dcdeb3815e66d20eb6acd58018f6ca768090878550a517e994f4
MD5 976faf29b42a62cb619007b2f5a32c55
SHA1 5b4571a170f02134d3a735d95ef45f855012bae0
SHA512 b2dc6a891b4c0b5738600e2243da3d803c661d912e8e03e099e75f678647e23375f13f22db75ad930bce1eaeaefb0093d8ce587cc1f3deb9183b1f82767e3335
SSDEEP 24:n5aPKD7DnqLGpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSz:neKD7DnqVE8WctFMkUe9kftcPSz
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 12KB
SHA256 54768f5fe04e425f99f764de7d9f555ef601f209ef2a72a373ccf190c17dc450
MD5 f0f8eb140db1bce31d60a2b657cd97bf
SHA1 b191594ffb6dacd6e42ba4ce5a7507d7f6ac2099
SHA512 35b61078dfcaecb13af43ca8bcba74684026e09bcaaf3a1850b5b92f3e482f2f8fc330c8e335a56f48c80fc682126d72d5721b9a6305139fa631649cf9fa7545
SSDEEP 24:7+tNE2fbfi7qLZUpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSe:7My2fbfi7qtDE8WctFMkUe9kftcPSe
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 12KB
SHA256 a9b0cdf5a05c4fd88470544804a8ef7242f6c94d05d75cf120579f27f4b8f8b0
MD5 b99df2770c7dda0266fd2e537e569ac1
SHA1 e61bd37e4de7fbd02e70da50b2532df92d46a31e
SHA512 adafc27292d994a342fc73e18f9d48b143aa9b31fa05316b30ff2c4086750cd25dba54a82df8289fac5e4d5dd0c29cb777c1b779648b62fe90d543e615729d2a
SSDEEP 48:7MOk9DEujgI83vpXIUuGIpRcRpOp9VGFuK4WbkqFE8WctFMkUe9kftcPSU:7mRsvjbkuE8LtFNpkFcaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 34347b9a6463de57655addbba2e458f12b1d73abf03e39961ea85093d6f7ea90
MD5 f666d204a713238e5b8abcb52f2b2710
SHA1 b50b85279e3430a8477190c56c5cd83044d75c8b
SHA512 c3c2ae897f47bca0964ac24e986aa749629120b7d028411b1722e2b5ed58b79d8fafc04944207b88f2e99ab4f64d055cb4eca5766942856a0d437dafa91ff30b
SSDEEP 48:TFE8WctFMkUe9kftcPSB8UN6HJbCJw2EjErmfjSL3INC1odgo2b090liTsbzroL:5E8LtFNpkFcaWYcbCD5wkQsbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download