9080c078702ebefa16be66191eefb4e24b4fbb698b74d8f7b5059589f4b9c02e

Analysis

max time kernel
178s
max time network
149s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
16/06/2024, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2e0cae9907bfecd59a0c55a4d24b832_JaffaCakes118.apk
Size 4.3MB
Sample240616-lv61jayfjf
SHA256 9080c078702ebefa16be66191eefb4e24b4fbb698b74d8f7b5059589f4b9c02e
MD5 b2e0cae9907bfecd59a0c55a4d24b832
SHA1 8daa18ca5e22407154da64d7e6d9539da3179359
SHA512 8d38e0a06ee62878771bae9db92af01f731b641780fccaccf8d657943ee72355036e3821b1f2c212e33b8a4582f7aac09f77847c759e03d9f851a02962dd3cb4
SSDEEP 98304:Qq+g8MRjrWqr7jxZ2ocoY7SWqeosSjyUbWYJ/B0auvIUl6qeZaagTxsF:JEMBJzxjc32WHoDjyK5L7uAUMq8aaew
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	ru.dvfx.vilfoods:Metrica
/sbin/su	ru.dvfx.vilfoods:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ru.dvfx.vilfoods
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ru.dvfx.vilfoods:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ru.dvfx.vilfoods

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ru.dvfx.vilfoods:Metrica
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ru.dvfx.vilfoods

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ru.dvfx.vilfoods

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ru.dvfx.vilfoods:Metrica
Framework service call	android.app.job.IJobScheduler.schedule	ru.dvfx.vilfoods

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ru.dvfx.vilfoods:Metrica
Framework API call	javax.crypto.Cipher.doFinal	ru.dvfx.vilfoods

ru.dvfx.vilfoods
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5186

ru.dvfx.vilfoods:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5246

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/data/ru.dvfx.vilfoods/files/ZPkFS.log
Size 12KB
SHA256 2607a005112eee0379a614ca8fa03ad8bd0f041ca66f7180196bc9088097501e
MD5 11129ce0f6a21b0e635ac537595d34ac
SHA1 1395e1295201c9677d0abcf1d21062f35308e9e4
SHA512 1035b1a075e36fe5fc76e6721596a304cd00bc252c9ccfcdef6fa153126269fcd3c0ab4c7b30d2de1350eae4c6d44369d8aa48db9cca2dd7da88d5e57d39928f
SSDEEP 24:7+tsDrF3Hz0K34rablqLqi0BKyOmctlDWwwTRD5xs5cQlNGSq:7MsDrFjR34mblqmaDP6PRtxOcZSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZPkFS.log

Path /data/data/ru.dvfx.vilfoods/files/ZPkFS.log
Size 36KB
SHA256 5ba20d51f1b4493fbdfecb0d73f05f201f22c23a37b7a0b6cf0fe33982666b6a
MD5 74aaac75730467bb4aa36b52f30fdca2
SHA1 4ee2c1fb2b67419b00c8103a7ca38d2151b08a83
SHA512 b5c3fd5fbf5ffc9d76851150bb3e76c1082b0a3b69798e6d2a76c3ec7a43f107db52e40b7a12fe71cb4bf73b7d7bc0babd10eb6fc7010948a6d82805f62c6d63
SSDEEP 48:T1E8WctFMkUe9kftcPSMD6HitbCWK6HitbCKBk9cmfjDgX80IguIALTIkG45bwwp:pE8LtFNpkFcau7tbCWK7tbCKP464bj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZPkFS.log

Path /data/data/ru.dvfx.vilfoods/files/ZPkFS.log
Size 512B
SHA256 3bb804e7af69bbe0c4858f1ea061c5a2c37673ec491871ecedfaa059a4170b55
MD5 1856cf0b14abba1599971e51e0e3d828
SHA1 312054c6a9e956920b6b4c13ee710e7dab1fa6d3
SHA512 c64211b895b30dab2e8ff45776543f52945187317a5a81991422d609b53b478adfb90dcb481042e34356d108349749af63804043e5488bb0fcaf1ef2aa46bfd5
MD5 SHA1 SHA512

Submit Download

credentials.dat

Path /data/data/ru.dvfx.vilfoods/files/credentials.dat
Size 427B
SHA256 0061fa1e73c6c99db9ee127f5e4bcaaf751b6635fecd8b31ecdc9c1cee4f0275
MD5 d1c748a49c97ebfb92737154b7397225
SHA1 b50983e7a75a63af6f51acdc579ce3b55e5ea585
SHA512 2fe235e6a677671cc8dbdb35d775afbb0d9466f23cdde9fa9eabb64988a7f4b592c8fdd757a158e8fd9009c009c148dd08f503b6d3f7f0f98acc8c3eb8493e34
MD5 SHA1 SHA512

Submit Download

credentials.dat

Path /data/data/ru.dvfx.vilfoods/no_backup/credentials.dat
Size 234B
SHA256 cffa0abe1f0560acf73b8f2cad8c318518c3bf8bc2937fafa3ac6ab1a85722ec
MD5 d3d1554c80295080565cd8a0f3e66c78
SHA1 e3ea38253f3aa815f01445d0bb65646b07dd7ef1
SHA512 bc88a60425048ff5f9957f665281fceaf647ee56d476b4d48e38e5f77798877461bd81709ccf45ffaa1b4a0d9254b6a39713cdb7f93cd629f8371f3ba06cbca9
MD5 SHA1 SHA512

Submit Download

db_metrica_ru.dvfx.vilfoods-journal

Path /data/data/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods-journal
Size 12KB
SHA256 0aa877f3bd1bc9b9d2bd6d724ec43b7dcafb7f0fd681b1645175e48df0e5653b
MD5 e9c5479298ba9fa615da9a9028227c4e
SHA1 baf04644a6fc78e4c19eab44c99e605989768eb5
SHA512 cbacbbccf74ad8377a2074c8497fb4e2ad0acc0c2bc97e04cd5bb520d5f667114392e7f9a36b1eab53487da60d18a717bb9940e77442fdf871828c89900235f7
SSDEEP 24:7+tDh0wMx7bEHsd+gncPHGD3EMNdSzPn3ncCzqLQfcQlNGSQd:7Mlm4Hk+gnc/G/dav3ncsqUfcZSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ru.dvfx.vilfoods-journal

Path /data/data/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods-journal
Size 20KB
SHA256 4449b46e421a011425b6d7383161845372bc39a2167cea4ace47043a6bebed00
MD5 0dd3087cfef50f34251b7fd39c78f367
SHA1 9464ec02d361709f8cf7ee621b6fcccb60f19e67
SHA512 4d39a7c24bac60c249a48bc8857ed446f5e3298016f31433e668e909c89cd434da731c4bcfeca3ff6143f716bb0d1f4c9512bc4ceab268aa2fa3145944121e30
SSDEEP 24:TLAfcQlNGSP/kGSXTh0fMK7WnEoFd+gnc+DYEMbEoncCi:TEfcZSP/zSlmro3+gnc+4ncn
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ru.dvfx.vilfoods-journal

Path /data/data/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods-journal
Size 20KB
SHA256 6fe6725ccc328a59de0beca519fe13e9a2c69734b6e3b79ec4bd865825196a03
MD5 e996cf4606a6724a56407ebfc913d757
SHA1 a258284766bef4f1cd4ffab2c97e42c8312f64a8
SHA512 6e633057a0020be4e90607d674a57be38ad3219fd57ac5c9d2762eb6036fdc1fa5638ada8282c4cc87b02d77f62cbefee215116a609554abf43d2a9cc727102c
SSDEEP 48:TUfcZSP/4qVE8WctFMkUesm4Hk+gncZ/dav3nco:o0YPg+E8LtFNIm9fncZ/C3nco
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ru.dvfx.vilfoods-journal

Path /data/data/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods-journal
Size 20KB
SHA256 137295d9cf69051500a0657ebf6e9e5c99783ff8912ad603ae2ea7cfd6056a0a
MD5 c62a4b645039579b4a88eeb6f3649e4e
SHA1 1e0187c8040a483fd63afcf2e99e1341e2bee165
SHA512 3d1ff4dce0e664f91b5ed9a1bc0a7d910464b98a6bb688d8a77df719b0efdbd244c1f665bdc578b2ee33140b28ac071f1caa961c0a624046b1d27bd5f6e128c2
SSDEEP 48:T21fcZSP/vfbHi/qtDE8WctFMkUelFqbxJI5+gncgYnc9:i10YPfbC/MDE8LtFNbqbMfncgYnc9
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ru.dvfx.vilfoods-journal

Path /data/data/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods-journal
Size 12KB
SHA256 8f4d6f9bb299a48d3a6a984e0cb2b3886f99a32626a062a1c204be27f366a730
MD5 f7a0d611aacc9d9578d0c0fc53831690
SHA1 f4dc02cc59597b75843dc7100e175ced9452a679
SHA512 a66f9f896635c4933282c33c4f8aaafe656ee56094feb26384d40d60b9251ec6b945dd920d3c7560bba55065bbbb62ce5e86e85207f3d9853ff20f318d65fd09
SSDEEP 48:7Mfk9QmfjDgX80IguIALTIkGMg5bw/I+ejI7MotNboqGCE8WctFMkUe9kftcPS+:7MMgZ4boLCE8LtFNpkFca+
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ru.dvfx.vilfoods_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 42919f36eb6b2d76fbf2e5724a022e553a5d96e02c5834190dda3f5cd24713e3
MD5 2f12e82ec68a901af9901418b710134c
SHA1 81313f36b3d76e030cb4d0125617c4a9ada2ddc7
SHA512 bfa530bcd1ba349aa107e1b338f819c8824a7c8a0b5747a744c69e7eb0bc46a2918d992e00b5dd8e412b33474d630942822b8ce5f2b9159ad1e2f6aafc5b7bd1
SSDEEP 48:TVE8WctFMkUe9kftcPSB8UMK16HitbCmi6jEPZfjNZ8ESG2vIm1odgo2b0S/liTU:JE8LtFNpkFcaWq7tbCmGIwkssbj
MD5 SHA1 SHA512 SSDEEP

Submit Download