9080c078702ebefa16be66191eefb4e24b4fbb698b74d8f7b5059589f4b9c02e

Analysis

max time kernel
178s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
16/06/2024, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2e0cae9907bfecd59a0c55a4d24b832_JaffaCakes118.apk
Size 4.3MB
Sample240616-lv61jayfjf
SHA256 9080c078702ebefa16be66191eefb4e24b4fbb698b74d8f7b5059589f4b9c02e
MD5 b2e0cae9907bfecd59a0c55a4d24b832
SHA1 8daa18ca5e22407154da64d7e6d9539da3179359
SHA512 8d38e0a06ee62878771bae9db92af01f731b641780fccaccf8d657943ee72355036e3821b1f2c212e33b8a4582f7aac09f77847c759e03d9f851a02962dd3cb4
SSDEEP 98304:Qq+g8MRjrWqr7jxZ2ocoY7SWqeosSjyUbWYJ/B0auvIUl6qeZaagTxsF:JEMBJzxjc32WHoDjyK5L7uAUMq8aaew
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	ru.dvfx.vilfoods:Metrica
/sbin/su	ru.dvfx.vilfoods:Metrica
/system/bin/su	ru.dvfx.vilfoods:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ru.dvfx.vilfoods
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ru.dvfx.vilfoods:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ru.dvfx.vilfoods

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ru.dvfx.vilfoods

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ru.dvfx.vilfoods
Framework service call	android.app.job.IJobScheduler.schedule	ru.dvfx.vilfoods:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ru.dvfx.vilfoods
Framework API call	javax.crypto.Cipher.doFinal	ru.dvfx.vilfoods:Metrica

ru.dvfx.vilfoods
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4492

ru.dvfx.vilfoods:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4551

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/user/0/ru.dvfx.vilfoods/files/ZPkFS.log
Size 12KB
SHA256 e0f5a7fa49641d125b3e8109597526fcd602b68813d04d019d03eae94643e77f
MD5 00c5953af5d6620484b04024c93cfcef
SHA1 131434dd19a94524df1ae2ea721fe041d680b29d
SHA512 e0608175a795e92a6fd773adce6b420fc478d32f804c0ec1e5bbf1442656af1bf1451d6b968fdb5bb42dae21f913938ab35db5e55176d9f6d4c13576c03c7cde
SSDEEP 24:7+tHQLHzxKKnbNOqLqi0pKyOmctlDWwwTRD5xs5cQlNGSD:7MwLHzYKnbNOqmiDP6PRtxOcZSD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZPkFS.log

Path /data/user/0/ru.dvfx.vilfoods/files/ZPkFS.log
Size 36KB
SHA256 02e9e7f1294076a43e989fe11e39af71d44806ea7f504a46b4e90684d9fc5517
MD5 e2ca2a92531d8315d561dbd121c1d977
SHA1 98a4a98253ff9ef84d9052d07af0bb5abdd47b08
SHA512 13c653a4efa567b59622dbf84bd0b9a9eb217bcea85218db0241d617558d238d280e532ec7ce6f81f224f06c5118b836f7a6e64f93e82dd7d00c168752f803da
SSDEEP 48:TtE8WctFMkUe9kftcPSMhH9bKqWyH9bKqteBk9CDfjE79I8ZZvpXIZuGIpg5+3pN:xE8LtFNpkFcasbbWobbte4gajbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZPkFS.log

Path /data/user/0/ru.dvfx.vilfoods/files/ZPkFS.log
Size 512B
SHA256 f72814c4e0bccc9e5cefcb89881bc3f52b5132b506132815e8064b226c0c7589
MD5 6771621c2be527b7aceb11a5b141c668
SHA1 f28feef9f9554a6fbff0ebb504269c7a6ae0f5b9
SHA512 701a4809517f2be0bc8e1bbe505700537e36f6938bc0b76b691869fd3cb25d222bdda129fc019a5d2c9eeaf52b0f2917fae4768fe1df0ab16cb1ce3969acd0a6
MD5 SHA1 SHA512

Submit Download

credentials.dat

Path /data/user/0/ru.dvfx.vilfoods/files/credentials.dat
Size 427B
SHA256 b8ac197109d904ec9d5f516226845137764f403e125ea27fdc589a4f157c1838
MD5 36fc3472a9d97b2367dc03df909283ad
SHA1 599da7b2810ef4b8e4abfd391c649f7b27c8b5c9
SHA512 19798347503abb63630cb1b7ead17432b5af142988408119d53a456b5a0984646c1bf95e5e924496a83d8c80700e0fdd50573f2fccc9b362120ff4a2c3be241b
MD5 SHA1 SHA512

Submit Download

credentials.dat

Path /data/user/0/ru.dvfx.vilfoods/no_backup/credentials.dat
Size 233B
SHA256 47e888f3176ddd56428fe2315400fd5df62087d018f3d25b4cfce050b60437f5
MD5 367d8420b91b24f095a61ce1110f902d
SHA1 23929daf7a43d7ea150e5152493108961a2c75c3
SHA512 2c092c4336cd90d067c90f2c3abe26e5173ddbc839d795d8e9b691f7ef84220ddac5651df1f2546db031a8169f8843b7d03956e1c76c5a4fa368bbccecc8bc4c
MD5 SHA1 SHA512

Submit Download

db_metrica_ru.dvfx.vilfoods-journal

Path /data/user/0/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods-journal
Size 12KB
SHA256 e7722cc184420da268ce172f7a522dce22e1e708a5b1caf229ef86233bb074ac
MD5 906e252c028c93b32056fddf2ef81646
SHA1 10773e0b38e123a97263c61e1557bb55c048bfa3
SHA512 fec86dd37399f3e0427300cc3d9430f7fd9f1bf3fc08ecfc0b022846252807d2a651ba63e89c9e2dcbcf70c430c834f403dec944104c6d3a38f39a62efb0916e
SSDEEP 24:7+tCusMFEUZNsRSwgncGCTgEMETBMaRFYncCpqL6dfcQlNGSXU:7MCdUZZwgncGkTYncWq2dfcZSk
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ru.dvfx.vilfoods-journal

Path /data/user/0/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods-journal
Size 20KB
SHA256 ef1f5bafb6a8ce168d1ca17a073e3b988191a11421a2bdba61a9d3eb7cf670ab
MD5 eed4c42ad4d4895754e689d78531ed60
SHA1 499b38eadaf3707303fa6b75d685a4932f8d9a7b
SHA512 5ee9289d12073c93ff96b12da93d7d15ac1a0074a563eeb469ce075f1379f681d8735e5f932cd51b8a9e050a2a9dd25f751dd9740865212112c2303d7e704109
SSDEEP 24:TLofcQlNGSP/kGSvxQRSwgncH/qUqyncCh:TMfcZSP/zS9wgncHBBncQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ru.dvfx.vilfoods-journal

Path /data/user/0/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods-journal
Size 20KB
SHA256 6d1e799ad8c7558e2a2ac4d900e5794b288f4cf03912caf18338e1e96958ab47
MD5 f0b3a974df19e8ea1bcb54075a7bb81e
SHA1 d48f104f97b44d696bcb8d7bb08a5b18adda4158
SHA512 705509cf00d629170d99f7dfdf7fc3d4d72cccd1f379adcd8c83880f5e5f6d6d8397c673f16e828b00b272707b945d2af941e19433fece7b8af40c5e4bccee9b
SSDEEP 48:T8fcZSP/wqNE8WctFMkUekbNGwgncQiMTgncS:g0YP4GE8LtFNg4NncQiMsncS
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ru.dvfx.vilfoods-journal

Path /data/user/0/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods-journal
Size 20KB
SHA256 4b1cbf612c449dbdd39ce0e597dfcffb54d7ea99969f08e5afc52a9bcefe655c
MD5 970bdeb0302a899fe532d16839ae245d
SHA1 c888dee63ff75d301fee3af749969a467eaaef97
SHA512 a01eb53729e1388156372d901b7f4bb3f88f940e96442ce99d12088a249a0796d9804f997519f8b63bf62d307ed0a05cc5a6b38804e618ba842ebfb0dddbc3a0
SSDEEP 48:TcfcZSP/vfbRilq9E8WctFMkUekgvCwgncXBtpncA:A0YPfbElWE8LtFNgnNncxvncA
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ru.dvfx.vilfoods-journal

Path /data/user/0/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods-journal
Size 12KB
SHA256 f18b51eab126d46cb75f014b1da6fd375575f3fca75f1f0bfe5db416311ae26a
MD5 a2075f890e72b6b30ceb0850b48a9aa4
SHA1 88c54742a179f74e5b12d1d91e504d68ae54aab4
SHA512 235b53734d708545540da39d0d785d7893b620e16afe688c65cf2f95ad0ee86bbe6262c2406d9d99aa10cced9a0872420b353948df389ce4ef3832f34baf3f5b
SSDEEP 48:7MFPk9KDfjE79I8ZZvpXIZuGIpJ5+3p6V1FuK4WbIqG6E8WctFMkUe9kftcPSo:7AKJtjbIL6E8LtFNpkFcao
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_ru.dvfx.vilfoods_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/user/0/ru.dvfx.vilfoods/no_backup/db_metrica_ru.dvfx.vilfoods_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 f5746e1580f930a9c98ab5f136b4647c79d059d039a203ce02f0da37530d49a5
MD5 f3e575a4116b38fac249b1614d8198a8
SHA1 ef82dfc25e766c5deb6694e132667d67d58f62de
SHA512 7e71bdf9aa296100cbe83a13169906bca65b449a43a0079a5f5a4f243a4317c8a59c605028f97036fd03a8e96078d517a717d7948b80e28045163ef7a053614a
SSDEEP 48:TNE8WctFMkUe9kftcPS1eBH9bKqEYjEk4IfjO8l226If1oG325VTp+TsbzTL:RE8LtFNpkFcaEbb+WHjsbj
MD5 SHA1 SHA512 SSDEEP

Submit Download