5139bf4007d436978af65cc37bbc293146cfb223d0e0d18b2b9be5a1e2098944

Analysis

max time kernel
179s
max time network
148s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
16/06/2024, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2f955d055177fd63a4b0414c5a44da9_JaffaCakes118.apk
Size 5.9MB
Sample240616-maa8sstblk
SHA256 5139bf4007d436978af65cc37bbc293146cfb223d0e0d18b2b9be5a1e2098944
MD5 b2f955d055177fd63a4b0414c5a44da9
SHA1 0e796a0abc9b98b3b430e461c742b31868247127
SHA512 0a422bec929af4b86db1c950e1b5b2f7c5bcbeac9e8b925d2c375a39df73c6c1ac06e7d446fdec7803aff8774d1ab7f801072f8fa68d0e608c24602e79cfb413
SSDEEP 98304:XHQljvUKULoYgMmTRavh0nsudJ6VMyq0QBa9uqArf0iLhZ601mT6PPE:XHQlDU8dcKPMU0QQgz/600R
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.appsmart.delivery.darbarmuenchen2087:Metrica
/sbin/su	com.appsmart.delivery.darbarmuenchen2087:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.appsmart.delivery.darbarmuenchen2087
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.appsmart.delivery.darbarmuenchen2087:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.appsmart.delivery.darbarmuenchen2087

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.appsmart.delivery.darbarmuenchen2087
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.appsmart.delivery.darbarmuenchen2087:Metrica

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.appsmart.delivery.darbarmuenchen2087

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.appsmart.delivery.darbarmuenchen2087
Framework service call	android.app.job.IJobScheduler.schedule	com.appsmart.delivery.darbarmuenchen2087:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.appsmart.delivery.darbarmuenchen2087:Metrica
Framework API call	javax.crypto.Cipher.doFinal	com.appsmart.delivery.darbarmuenchen2087

com.appsmart.delivery.darbarmuenchen2087
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5034

com.appsmart.delivery.darbarmuenchen2087:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5097

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ZPkFS.log

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/files/ZPkFS.log
Size 20KB
SHA256 ddcb0e1970efc2dcb42a4dd328ef8c10f3512b39a47277d5b075fd3b92dfc3a7
MD5 ea9c2dc01d788f2ed7ad6a455e32335a
SHA1 3da6ee06226734e9a402c3ef2b542af3b509b6af
SHA512 5b834f25f6f8afea98eec78cf8e148671ceca48aee8019e09308389c1f336e47e55666fedf66e09c97e827c375ade0fad635b98686ebd2f72240108670d25e76
SSDEEP 12:TLnwfcGtSBw8w2RmBEyPbP/hqVK+QBncQmThzoQV7PRQBncQm2zZjn:TLwfcQlNGSP/hAgncHVWncCh
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/credentials.dat
Size 234B
SHA256 cad5e7b481f4e16cfe41e9c504c256005e606cf27303c780398284505e8e2aae
MD5 4f6876c174797817ff6e4268a4f4a3a1
SHA1 b1c331b8c1697abce5874ac8c35f4548ac367749
SHA512 704f7e04eb60d26a662878dab43797827361496d5ade56a11007fc5d5618c7b6f02a1d4c2b0fd795d19cac1a83069f541e231bee3c03fe1f539d920c58d7f1a2
MD5 SHA1 SHA512

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087
Size 36KB
SHA256 3035c7356f75afad053bec05608742220bd90c7c0be93b69eae560abe8ac39ad
MD5 2c8948419ee8880177073f4b33d6e576
SHA1 33b88266d66ea9eb46e98b4763d849f70e9bfc0f
SHA512 c656fd73e6db0ea5be390101415613814bc0108aa1f681b6a546dd8d4936e63e06328f8910b1b4dd349dcdac0c116ef07e99ea0bd2269d59fc85edf6a6118d92
SSDEEP 48:T1E8WctFMkUe9kftcPSN4nc03Bk91Vfj5r7I8NuH5LTIsBIp4ZbwwI+VIKIMotNb:pE8LtFNpkFcaN4nc+q5416bH
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 20KB
SHA256 1fd82e00a87a75d637f1366eab23ddca2de8df206524673c408851e4b1117264
MD5 2cd1db4f8f02281c4ce1e271a4aa9700
SHA1 0db2dfa28837d4c20eca3822fc7052eaadaa43e6
SHA512 8608e82b9ad4758ca1eabe0c350f0a180262b66e3a5e41c24eb0d77688a2212a13d8dd7dffcbe715b6ad70f8bd413cd3dd69cc822dcf0a67bec5015c4c830891
SSDEEP 24:TLQfcQlNGSP/Rh0wMhDEHs0gncPBD3EMNdSzPn3ncC5:TUfcZSP/rZHVgncZ/dav3nco
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 20KB
SHA256 183071a51aa3e5432867c91c86950b0fdaa8584cb9a891a2f7c9eccab11dfc92
MD5 17593c6ec34701ef81dcd9d7d33affde
SHA1 14879292728583fb22d8b03fc11dc180b462b29a
SHA512 b3852f0ca0088b9f22b1d560e2252da9d591a2dff2c8144a017c9b248c6c8408fb3c0b7a24f994bb8504639d3881cae6311aa5684880eebf83ccaa971c576f5b
SSDEEP 24:TLwfcQlNGSP/AWqLiuWRGSTh0/ktMn5EJy0gnc7DZEMlml5ncCFd:T0fcZSP/rqZWES1ok5Jjgnc7doncW
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 8KB
SHA256 2e7af94bf2fb3456bbfb8702a54d705d0a0fd482b32d0a4329d86d9a46913732
MD5 3e31552b200836fe94ed44bf9b5068b5
SHA1 953c7f22c4ce889e50e03ef77a5d9d39559d9900
SHA512 3b1ef647d5344017fed0cfc7f5e2732dc95dde8a7bee3b46f4dca850035995757424e7e70c97b6980ccbe13bb524cfb1606c314b77f01ba4c333cbdc7c46a990
SSDEEP 12:P3HW7lPTWRbeDtJKJAIdJIcPeS75uPD1djhqLJdTRmBEyPbXbCv:P3HOWatJgAOecAfhqLJyGSXbCv
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 12KB
SHA256 4da16bcbbced656ecdf31892b5cb6224cf1c110c3a693e99f1e05fc87a1c194d
MD5 7ef46491917dcbefdf6413e1d5cebc67
SHA1 0afac88a873558835bcb8809626bb7b6c4fff7fe
SHA512 33946ee08fb287a4de95e58a5770151307f8a136e987f246e1b2aca091922cc84175fa7ae7c8fa0b2584ef46b7ba39be666f19035044baacd2b59f78f0466a7a
SSDEEP 24:WaPmNnqLGpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSF:HmNnqVE8WctFMkUe9kftcPSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 12KB
SHA256 9adf1686885938e141ce85e7a7b650006b278a9e8ce3535785dd139d378fa2a4
MD5 fca49a76b7d813695fcabe0f577f2a6a
SHA1 dbfe9eb2765b601e05842e570daa6fef5b43c7f2
SHA512 7608773dfed1316f7418c7d95f3a48dc7f180f76e85508df407707520b22a5389fe0b5351d21d50b015aba7524a182659b4499fb9e07860ac280f850c71663b8
SSDEEP 24:7+tiHE2fb+iGsWqLZUpOmVwvWcuR5OIwHATDFWDx+kUeseA+hp2RkaoWjg9+GSD:7Mz2fb+iDWqtDE8WctFMkUe9kftcPSD
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087-journal
Size 12KB
SHA256 b5c42b20925ce37bf996bee27226c59a49f98557cb1c53c7245fbb14075c59de
MD5 899e7ff4470fe0052f192d21072aff5c
SHA1 ab0749a46e70957e67b627913647472cc7ac350d
SHA512 e75e66b9566f93ac6f8d42068a8d8d59e85f520794115b3feda4107fd1103aaa71bfbd4e26bbfd04fc0d9157318a87d3afa7cb456d0c79f794427227c06acdad
SSDEEP 48:7Mn2k9PVfj5r7I8NuH5LTIsBIp8Zbw/I+VIKIMotNbFqGCE8WctFMkUe9kftcPS7:7Q5806bFLCE8LtFNpkFca7
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.appsmart.delivery.darbarmuenchen2087_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/com.appsmart.delivery.darbarmuenchen2087/no_backup/db_metrica_com.appsmart.delivery.darbarmuenchen2087_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 3748ae132f0194557628bbfd15059c3981cc0092b2a43524510b9e985092b3d7
MD5 ed0bd0bc7ff8c352a7326acd00beda18
SHA1 554c1c491abce28a5e88ca050ed646e4f367ebc0
SHA512 6f889824fdce6b15444b048a483051e2fc2d78a162f6587ac9f2bcaa25d2e04e7e79b20e61a2a17b85c50d75f2c6e6f76dd6de1eab7a775ffd56efc6cfcb879a
SSDEEP 48:TlE8WctFMkUe9kftcPSB8UMwM6HBbCEljErMfjSLfG27I/C1oGM2O1jnSkTiTsbH:ZE8LtFNpkFcaWWMSbCP9H+3TGsbH
MD5 SHA1 SHA512 SSDEEP

Submit Download