c36d774bb54e7609950172d1c65057d583c06c3b154787d845aabc3cf2c05fe6

Analysis

max time kernel
178s
max time network
148s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
19/06/2024, 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd7e4a6d25fe18c105b2ca4ac5ee75e1_JaffaCakes118.apk
Size

3.4MB
MD5

bd7e4a6d25fe18c105b2ca4ac5ee75e1
SHA1

e5198ff65207ac35da4076a082775fe0e018bf50
SHA256

c36d774bb54e7609950172d1c65057d583c06c3b154787d845aabc3cf2c05fe6
SHA512

eecbf50301bf4a3df98d76127a6bdc03d5d3218d6f67d3f9379f6a91268b3d804e8a365a3b4ce809fbdf9a8d80f0a16c31090c4c3055b6baf5f5b57dd7ec9d8c
SSDEEP

98304:QzNqDapg2PXl6nAiZGrb2RT5s/i4A23Tq6:zGlYGf256/i47q6

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	br.com.starwaysistemas.acaijapajuusu:Metrica
/sbin/su	br.com.starwaysistemas.acaijapajuusu:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	br.com.starwaysistemas.acaijapajuusu
Framework service call	android.app.IActivityManager.getRunningAppProcesses	br.com.starwaysistemas.acaijapajuusu:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	br.com.starwaysistemas.acaijapajuusu

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	br.com.starwaysistemas.acaijapajuusu
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	br.com.starwaysistemas.acaijapajuusu:Metrica

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	br.com.starwaysistemas.acaijapajuusu

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	br.com.starwaysistemas.acaijapajuusu
Framework service call	android.app.job.IJobScheduler.schedule	br.com.starwaysistemas.acaijapajuusu:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	br.com.starwaysistemas.acaijapajuusu:Metrica
Framework API call	javax.crypto.Cipher.doFinal	br.com.starwaysistemas.acaijapajuusu

br.com.starwaysistemas.acaijapajuusu
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4315

br.com.starwaysistemas.acaijapajuusu:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4355

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/credentials.dat

Filesize
234B

MD5
a79523b0e8ff6a23ffc8880133e2e6f5

SHA1
fd09be16bf561af35b8d18e6d8d17e2597dbdd5e

SHA256
c651c0eab5cb3530da88cd8ae34d8398b7dc0e2cb1e0c4c1623ece7561b3eb62

SHA512
a35149dff84cf9bac0ce26fa62f89e32c822aa25a90f74196ca2d87f848e07282648cc33cde6b3a78790f41ba8095b99abd3ab5b438d68a60a20bfae24917149

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/db_metrica_br.com.starwaysistemas.acaijapajuusu

Filesize
36KB

MD5
6402e191613a7518be7b09e2c7ebb8a1

SHA1
443894f8965e69d52ab64f68413fe819025b151b

SHA256
1137d2629ab5a677dedfe39aaf2fa519e309f230f204f9e40c7de6e784db9470

SHA512
4d6a77fb89795a661c36d89cae692dbec9df9715d031ade6fe9e25ad4773e2915b22f8a4cf02eea98bf2baf139576236b8166e90fe26aed646e16b42f86ca855

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/db_metrica_br.com.starwaysistemas.acaijapajuusu-journal

Filesize
8KB

MD5
bc5ea35a41b795ab7110ad63ab45fc58

SHA1
6bed4d9e1be63ae23cdc214614997b7f0465a3e2

SHA256
57b28845d43a0780f02508c9c04156a66bbd677bb2d83d4e703d8dc218cc3238

SHA512
744b25f2e11d3872ca03de676c24694dbff5b97b409f81c97068f6596c959873b21647f99e31fba8d7fe4de60a6d842677fc1a1f67e3ab4f284681fa759cf032

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/db_metrica_br.com.starwaysistemas.acaijapajuusu-shm

Filesize
32KB

MD5
cee2de04bfcd9696b2952f31238bbf4b

SHA1
24dec9a389a8fcd3330f1b65c42aca808e6cdc5d

SHA256
cb2f30c90e1991194a3c5ee0c5d401b16e16bbfce684bc83e49ec5645086c6c3

SHA512
805047159e0d55e7b964a79abf712568972f9dcff592fc89e65352fa568236d0da42989b410cd2eaab433cff0711262574ac2853ed73d481a413dc643e053dad

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/db_metrica_br.com.starwaysistemas.acaijapajuusu-wal

Filesize
406KB

MD5
1915105afadb59c78c00d384f3b31b6e

SHA1
ce887fbba30ee9a8ad1205e1093fa9c7cb5a3ca7

SHA256
066f5e179ccefdaf788659005695516db2895472f788bed736b7b1a28b2ef207

SHA512
fe53817d88b082dbbb53671df360d4d1c625cbb01df28e9dc49c6b9ea10c98e60d714e0fed8c143b2e8b474a7f72ebe2c3f496591f68efa302e0e8bc7b8e58ba

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/db_metrica_br.com.starwaysistemas.acaijapajuusu_20799a27-fa80-4b36-b2db-0f8141f24180

Filesize
4KB

MD5
2dcd04e487e92d7d636350d9431abb10

SHA1
4a868c150f6e5a9be7765a3f756d33d5dd39cf9d

SHA256
75c1b59c6c32834742cecfe7866c860cd633fe51a9c9b3254bd62ec84d3f3e87

SHA512
121e6f74738e506300fb298493fb02ecc41ce8123051488277034fd9cb5ceb97618a5879c565b3b20c9adf6bdf181703747f83bdc365cbf18e03c70ee01ce786

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/db_metrica_br.com.starwaysistemas.acaijapajuusu_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Filesize
512B

MD5
e6021bd2162cba2a3e83f7b4481ded5d

SHA1
e7846c7ab108915a4e01871bab828f2d8d22eb8e

SHA256
e7bb9bcb84a52c7efede4b1931d428b3ff4e736cb06df1061890d477234ca34f

SHA512
ca6b4a37ea944adcf75b4ebfea50810ce95aa3d790eefb2448bb024ce502a8e08584acf768db36b697b407347ca96c64f895ab16daf44862a8ebbed398d7d5fd

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/db_metrica_br.com.starwaysistemas.acaijapajuusu_20799a27-fa80-4b36-b2db-0f8141f24180-wal

Filesize
156KB

MD5
10e3d2b810da8b525eb70c0ba9de5136

SHA1
dfd5cfcea412ffcb354b5dca38c26b01cad2e339

SHA256
2db278faad8a76183e84b1886a5aabb1eec556487d02a57da32bcfeb08441fe2

SHA512
6bb1e8937ddb0609d98d7d27c537d8e3c9987c3c7b4e3fb0cc4f3aaf5ac492baad390191b548a05727c9eae334edfcc5ad0cfa1b7e9976e86f4904dfad7332a4

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/metrica_client_data.db

Filesize
20KB

MD5
a6845ad8047e4f78bcabedb780a9874a

SHA1
75912a14d616e1d941078396e829d5c840f334a9

SHA256
de72fcf3b8679e10ff2118ae38ceafc0d674542add83d54e1bf08e1948963f87

SHA512
23ecf2ebfaf6402f825759ec570ffd5cd7de3e3132bc3c75db362d9fab9444a6e397c9091debcb559b5d04ed18ef47e4d06a347de696c2fde525138a482fb9db

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/metrica_client_data.db

Filesize
20KB

MD5
abac1b3d1b5382a9c7af80c1eafafe74

SHA1
f581c7c88c7f3322b78f07d9e53dece8fe8bbbdc

SHA256
51549715dffd11638d3b7d4c184c58a7b53b190d584f8005f37579eca4712033

SHA512
420ccb23e632e2e393ccdc1618fa9a91738eb5e54fe0cbbf270b8d75df0af867663e87d7bbd95909e0c7f11c741e7ae84cd0f86b57971eaad5feba556730c7c4

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/metrica_client_data.db

Filesize
20KB

MD5
44def4f6e42c3ec63f229d23af8c804a

SHA1
f5956d9295778b539bced03215343fd3cf7a9dd8

SHA256
882faff2a0f007164d5dbda7bd7f803306423b5eb48a88b1bb72bde65b77e50a

SHA512
a14770398044635a8a8fc0d59dc95af3a97ae78146a9ace3795d600a44098a5ff7099aa3d0ac40442f8ff8c5d3b5ceecb4b360bf47f3e8c7c902879e2e76228d

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/metrica_client_data.db

Filesize
20KB

MD5
6dfc748b57a70f5e89c6b580e4e0be5f

SHA1
89fd88730b0562bf4345d52a7fc9dbaea1663baa

SHA256
3ed9cca1a2f3c7c64891dfbc0180f65405cdb81eb8d706485162e20ffad8c45d

SHA512
1a8460004ca9f6b7320f325d47399756c11cc6e8aecd1da318e2a45d06c3be2fc1358ced18a160f6cc6382096f72109a25ca48b48af911f1524c363ea71bb89a

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/metrica_client_data.db-journal

Filesize
406KB

MD5
412e2cd64db0e9d9c2d6078dd2a7e484

SHA1
68bfd522ba99941fee74ba556120aec896754741

SHA256
f839c6e37b983e7366c95aa3bd6b655d819a9e6351ee3243cf2c8861019a85ad

SHA512
d2a21af216e957e27564b7095b48603fbe299f645715bccceff4f41a1c998251bb32fde05c484cee271d2b6c37813deb5298bfc6fb5bd56e37ef3482db6d9f3a

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/metrica_client_data.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/metrica_client_data.db-wal

Filesize
32KB

MD5
d94223fcc94073498923c8a1bc870461

SHA1
6cb6f2ec1c6926dd93133f186537d1e8f81c50ad

SHA256
2a8c977d35e679f1d5cd25837a5c310393218784c6ba82d87e4029e6c6bf1d2e

SHA512
14417b4ac0384f8405c9c5db6d9f1e8cf6bd6609a97e7605bb46e7502bcb22b382793b463cbe5dd238e95e09bbc08ff0f492c16bf431bdd7945249f2bcf522a5

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/metrica_client_data.db-wal

Filesize
8KB

MD5
5f0ead5322c5bb1779272dd3413f3c9f

SHA1
627791b4821304f0f551a30c4cc20c073afbe11b

SHA256
da44eefe9aa0824d18845d039351d84bdc7e4d4a485254940df8405b40ea6e7d

SHA512
134a935c2ebb085dab6c1bd3671d497ab52027e1db602623e8487ea2669c24bbe54a4d49bcaf5622b97637c6ab6dd121244150904a450c6b6d7e65d65b8e41e1

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/metrica_client_data.db-wal

Filesize
32KB

MD5
5fee02c9bf708af2a18e067b69807bff

SHA1
853c6fd3203388905f6971b2a1fa8f4495c2a1e8

SHA256
bc12e3ea50fd65a334148d0c7b7553ef5689ae79fefa0773c0ca04e171e92791

SHA512
eb03e08c9dfcb1eebdf591c0e3d0d71f35b180fe06be8734327201db522ed19a935f0db5cfa56ca015df1e66a9301e534d6f0bbdf249ba706129804655db4188

Download Submit
/data/data/br.com.starwaysistemas.acaijapajuusu/no_backup/metrica_data.db

Filesize
44KB

MD5
7b4db312d3943c94b5c7c65d5055e923

SHA1
5ea01f0923c12933db9083aeb4e336be4e1f69bd

SHA256
6dc13f29c9fda50c48a5c885b8a2f53dd55851f99359ddd46c19e96d58599fe1

SHA512
add7d3088947d7c0fdd0d834e3b1613a46e17134158ec3b31fd0a80cfd66ae14b6012deb8812e178356f89cece35c4ef53b7d0d400ebf44610e883899505a7e6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads