31a3312b2124ff5c45cd4b83ee1a620e5b8bcf2c35ea7794bf9717a42049c6bf

Analysis

max time kernel
178s
max time network
173s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
16/06/2024, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5d2c6e657f5a55823277006287d36fb_JaffaCakes118.apk
Size 3.3MB
Sample240616-3thd8athkf
SHA256 31a3312b2124ff5c45cd4b83ee1a620e5b8bcf2c35ea7794bf9717a42049c6bf
MD5 b5d2c6e657f5a55823277006287d36fb
SHA1 35d587627c040d2d7d9f2d6ccbaa531bc525499a
SHA512 0c0b3b3f83998f5b55aa076366d5a31a0e7378db84a5b11c1a225ac6ffa1f8767e180e5084ef73934be79fe570846bd95808d1b6e0a093738309c198d222b9fd
SSDEEP 98304:xugfuWWFkFL7EBasOqFRl8Fr24J73DwpwOtywXN3XWiBj3g:xvLWOLpEcJpXJ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	goldenburger.creapp.com:Metrica
/system/bin/su	goldenburger.creapp.com:Metrica
/system/app/Superuser.apk	goldenburger.creapp.com:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	goldenburger.creapp.com
Framework service call	android.app.IActivityManager.getRunningAppProcesses	goldenburger.creapp.com:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	goldenburger.creapp.com

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	goldenburger.creapp.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	goldenburger.creapp.com
Framework service call	android.app.job.IJobScheduler.schedule	goldenburger.creapp.com:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	goldenburger.creapp.com
Framework API call	javax.crypto.Cipher.doFinal	goldenburger.creapp.com:Metrica

goldenburger.creapp.com
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4417

goldenburger.creapp.com:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4465

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/user/0/goldenburger.creapp.com/files/ZPkFS.log
Size 20KB
SHA256 477bd41c92d45d060b57856b501048725ba8cd344d54d65459d2f6a0d5c38e68
MD5 d01115ab3b3ab6cd76adfbc07994cd9a
SHA1 2e7e72949ae2c3c9fc3faef4ff50f29153ce10de
SHA512 bdf67bda728f6ba75d0f993d24b0feb954d5cbc369d522ea553400482ccb65ed6c9fb042608d7ecb2940bfae1df0e47a7cdb37409561581c8aa31a774334092d
SSDEEP 12:TLfwfcGtSBw8w2RmBEyPbP/hqVK+QBncQmThzoQV7PRQBncQm2zZjn:TL4fcQlNGSP/hAgncHVWncCh
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/user/0/goldenburger.creapp.com/no_backup/credentials.dat
Size 233B
SHA256 b3616328317888f90c77caa5982e683495e7bab6459a8045c2ee8eaf2b07a315
MD5 826e93ba6c539573c8e4fa53563c72f8
SHA1 844bfdcbbecd22bc406a442fd94366303b1270a6
SHA512 bbe8b4b9b11d69942600c1855fe5368b0be1323fe82212a082030ff65298a1d05458cbc002d19991348826753055ab7d8bea530ffa76e99b9632b386de100d51
MD5 SHA1 SHA512

Submit Download

db_metrica_goldenburger.creapp.com

Path /data/user/0/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com
Size 36KB
SHA256 ad3fdbe317cc2f100e4936ea8feabf5b234b9db56c617d5418f79811e7dc97cf
MD5 89ede5318d26ea2ec9e4f067e5fe9d39
SHA1 d98f5f6cab660e3e69635315135676167b165670
SHA512 da7d1bf8e470e487f3b688bec9279689b96d8587181f421aa70a511342508d025a138afdae1e4e6d3081bfaab8d6498fff2dee2c79f5ac0034c786e1950764f1
SSDEEP 48:TtE8WctFMkUe9kftcPSLkncRFHQk9CvpujmuyBNMIVpZIV+4RKtG39LPMoDnbzr+:xE8LtFNpkFcaLkncRFHIH14R7bn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/user/0/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 20KB
SHA256 3cdd5d3e923d40f83b32bcbceba26aa0e96ee3d54a7c7bf2ac14667319fef47c
MD5 798ee7cf9877ad5c0860fa1e1f6340f4
SHA1 1dcb830b38285c2a00394fa04b44d99f43cb4e1f
SHA512 e3c8a2e594fce166dd91ee76b85a5a5f8448e1d9387fa3395d8a994ec8c0bee35e286ade05303bb4a469bedc0a4d01dcc8fa8c2204cfd110806e738c72292482
SSDEEP 24:TLYfcQlNGSP//lykRM2CaqEKDgncZNL5yEMZF3ncCk:T8fcZSP//HKDgncZd+3ncl
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/user/0/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 8KB
SHA256 7dabac1aaeac70a35f5b80f364efed09be6393be9be68f5397e4cf8756c4190a
MD5 9a968892178181d9d4fe6bd550742b06
SHA1 94c61fdcaa6cd766b61562a52b3b455e36388ffc
SHA512 be754d001c341b7405635c858662103c7607b44b5806f9141c912c2b0c3ed42e723ce59a926dcb923e72084490c6761d683260792bcb5a328f8900d862345f49
SSDEEP 24:xF3HOWE+GDWKRDuDaE/pved/1bqLiuWpGS4:xNHOmOhR6aE/pCdbqZWsS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/user/0/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 8KB
SHA256 5c15d2e53d65cc6abd23e3a29ab09649974f9eaac0a9cc036a89fd3e8759e502
MD5 37ff5f9a1a3350a4986ec9fb2c78da32
SHA1 171f183990696c825df24bc341abffa279b8ec61
SHA512 0d6daa14e843234b566d7accb08f83abb062e321a06ba748af5a72e30515b29819781915399f0674dbe634b1b7bd54347d988ab09ad01fc92e084e2026cc6bec
SSDEEP 6:FpPDnkPzhgg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKInkt/tn:HDg9gqLJdeWRmBEyPbZk1t
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/user/0/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 12KB
SHA256 8ccd06171b68a8bfe54edd27484569430d12c6b4fe11fab219f7b70ede82301f
MD5 d24b7256ac471c6d98a8525db26d967f
SHA1 9a9a1972927e8455567994a7977a1d37953606f7
SHA512 6082c837f1e55a0abe703f250ee402f4528552806fda16af8e542a8ee031eba053544924ec637629146307a0f6ded03489154459ecb26b2dbf12b40ead14a717
SSDEEP 24:7+txEBs9qLOpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GS2:7MeoqNE8WctFMkUe9kftcPS2
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/user/0/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 12KB
SHA256 316563fea16a359b11fec8a5abde534861687b97757555da0d10a8c10c1b26a5
MD5 db9933c46716272ac3d0f63270fb06b0
SHA1 28ca99c613fdf0f5feea227b122a87047f7ed883
SHA512 956df2130f52503fad1ec46055dd75547f3ca569033cdd0e1b443fcef4edeb59de730e67e05b6f912ebc43a726f76d0ddc97200838f02b549bd58c6da6dda536
SSDEEP 24:7+tgE2fbipiSqLepOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSZ:7MX2fbipiSq9E8WctFMkUe9kftcPSZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com-journal

Path /data/user/0/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com-journal
Size 12KB
SHA256 31f94b7f9f20c3fa08ebc0dfaa52379cb550ede784aee2248ccbf530bab754c1
MD5 79835a88fdc0ca06188b920150ac45ef
SHA1 22c3f279fd2f66355ac53b6654829113721a7a03
SHA512 93c2db5a20d7bd33386a6f1e8f3dd5c0bae959916d98cfa2ba4f45a5c4e5433c21a21c38ad29a34b9be73b7bd18988bfc95121bd1c4384dda507d1969951cdd2
SSDEEP 48:7MYFbk90pujmuyBNMIVpZIV+L6RKtG+9LPMoDnbuqdE8WctFMkUe9kftcPSn:7LFL1+RsbuWE8LtFNpkFcan
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/user/0/goldenburger.creapp.com/no_backup/db_metrica_goldenburger.creapp.com_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 a1191e1123e553411f911cccc1e1d950d6e76fa487bb01fd7f5e555ed3410502
MD5 14793f3d2495f30d4f612e166d238617
SHA1 114f802f1b529563bbd6967ca6c8b7adde1d462a
SHA512 7e8cfe78481b2cc8a25ba402d7289e7bba8c1564005e827b63700a7bf1997eaa6d788b104a694a489ea9b947f31bf0847c6d63fe50952ebb05ca1086bebf2c16
SSDEEP 48:TNE8WctFMkUe9kftcPSB8UMHHWubKq7tjE1DfjO8lZ26If1oGe25VTpmGTsbzroL:RE8LtFNpkFcaWgubbjHLsbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download