8c2d4771444425280f56063ea077c99964cef55ae3bd52ff7908c7b74a442082

Analysis

max time kernel
178s
max time network
136s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
11/08/2024, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c078cf6742f85e62c6ce16f1a6d411a_JaffaCakes118.apk
Size

3.3MB
MD5

8c078cf6742f85e62c6ce16f1a6d411a
SHA1

ea7f5b548139724181aca2bdad56df031c2bafe5
SHA256

8c2d4771444425280f56063ea077c99964cef55ae3bd52ff7908c7b74a442082
SHA512

53e4d1bc6b79403e0c384d45a99f26f1b84c7b0c1a0f3c14754561bcf88ff8c0bca087f26a2b632d6b10415219f023caf87b7c2490158cdcde3fa5d73729ce00
SSDEEP

98304:fPrL/jD6ZNvBoknQqBDCirqDMaepvb3LHOtywXj3kYK1pGP:fDDSZNKkBQe5u

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.producepro.checkout.marchese:Metrica
/sbin/su	com.producepro.checkout.marchese:Metrica

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.producepro.checkout.marchese
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.producepro.checkout.marchese:Metrica

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.producepro.checkout.marchese

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.producepro.checkout.marchese
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.producepro.checkout.marchese:Metrica

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.producepro.checkout.marchese

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.producepro.checkout.marchese
Framework service call	android.app.job.IJobScheduler.schedule	com.producepro.checkout.marchese:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.producepro.checkout.marchese:Metrica
Framework API call	javax.crypto.Cipher.doFinal	com.producepro.checkout.marchese

com.producepro.checkout.marchese
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4252

com.producepro.checkout.marchese:Metrica
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4290

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.producepro.checkout.marchese/no_backup/credentials.dat

Filesize
233B

MD5
93eaf774879a41af03e06ed0b22a9e5e

SHA1
22895c6be6ffa55ab6602e16d11501ce12760820

SHA256
76c0fa415130357ef0403eb956bfa0d9bf42aa8cebe2e30e2d9f42169deb1cbc

SHA512
53e967c62c9e3215903fc2ac61fa214f24f62b3bb44b36cbb68cdb7c7272a305dc9ef411ca26560b29bd46ffba7228d7f5c71abe19bdd3069ee74269088eee53

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/db_metrica_com.producepro.checkout.marchese

Filesize
36KB

MD5
93ff87c84e80d4685af5411301387b5d

SHA1
602a1aa0f4a9a60cefc72773c3d73eb314840f62

SHA256
60926f9e79508dc0d35953cbfb1c8d22e1ab96ccb8bc0f8e399faf86df0a888d

SHA512
cd76b4c0b47b9b987d41e6b3a960a94ddd55436a21af45040ecc0fb66b476deaee273b29a2a526db659ec965d78b47fa6bf134c9fab89cba387c9772e7dc9a76

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/db_metrica_com.producepro.checkout.marchese-journal

Filesize
8KB

MD5
15587c58a603eb8bc6bc2456d6e448b2

SHA1
dabf0e4034aa3c5103c21cbb2d697dae12df8b5a

SHA256
44dd75a6295e60f9201db78f3d7126dbc0182523967816dc6dee127caa777c4a

SHA512
8400406b4eb2f9baea445d5af8c00d8cf03ea6b77f7b56c900afec307987fa9069a3b6c08e1c69060f6ff74c93e88f57b98355ce6bad9cc424c10818edf8f672

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/db_metrica_com.producepro.checkout.marchese-shm

Filesize
32KB

MD5
fe8a1b61286821c7e75a7220bad38a4a

SHA1
fb3f5489a32ae6bd748706eefe3faff190fbf094

SHA256
9a2cc33b8822e4ad8fc1c8297ab4140540aa6882de84865499e6512f3c08fdc8

SHA512
93cd074f99765c5858711cad9d163a1c67ba06ad3ac22a83abbd27d67011b6abb7060daf3ba6c060e4aaba60c2e5b3e4c08987c406cdb81df5822687dfc55e4a

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/db_metrica_com.producepro.checkout.marchese-wal

Filesize
406KB

MD5
0df4c269ec2d55fcb9f1c052592d7be4

SHA1
ef0472666b464857751641f45c9f057a2707145b

SHA256
88749906dc2af51bcacdb6882df4a2ce42062a8e94baa90d68e9c87fb200f26c

SHA512
601f35c0d087778ed1f3fe2a75b11d988cecf729e925b66983dc12c6be86717734316d0a67c9186da5952cb861b72b56b5b3e27cb257c6d2401f6b92c36a6c94

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/db_metrica_com.producepro.checkout.marchese_20799a27-fa80-4b36-b2db-0f8141f24180

Filesize
4KB

MD5
0395f47df2f6ad097b2c251b0f950653

SHA1
409992839b809cda5c7123a1e8730f723eb97589

SHA256
d67714709478fa7d4123301a9e431fa62545bf678316bc8c3a81d94a6877c9b7

SHA512
dc8e3264cc650b1ce7039672e10d3fc548a7c070107fdcbd3213e7d892bb23d47b776219a4544afd924093918e0e12fa9e1f0a7532ac505a279b589bf9bcf106

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/db_metrica_com.producepro.checkout.marchese_20799a27-fa80-4b36-b2db-0f8141f24180-journal

Filesize
512B

MD5
c7b1f5741f1f35450b35572c8db9820f

SHA1
960ea58719eb0f91a7582c6f5a9929dfb7210617

SHA256
e2a1acaf62a2f379a86707816b7885e260f387f7c74db52d4621f287f5ebf418

SHA512
de504d00b9c6c6bef88a40ab4859b8f4ace0b481fed4e20b290f37d3304ee11316c57ee3785c9c9ee2a374f3657b186296c6954a0fda2d416e391819b2a1c4d3

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/db_metrica_com.producepro.checkout.marchese_20799a27-fa80-4b36-b2db-0f8141f24180-wal

Filesize
156KB

MD5
3ec0ca16b707b2202527427588b24c00

SHA1
6f9be9ee6ce96b5688d8db28e4c3f38183ce13fa

SHA256
3299215d4fbf2f627b59a5aabd4cf2eb938fe23a8e722a3fe0c6e0e12c43307a

SHA512
cd012a48b964120645f7844bea8bd0985e6ce35aa343decd300a0cdef493d97013965c36009ed7cf99a3c9ed034aa115f9c23541662dc3165a479d83241a7c70

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/metrica_client_data.db

Filesize
20KB

MD5
ab9a19136cba07f7fb9e2a87da4bc81a

SHA1
eee982cda43112c6e3a582ef2379d39fd51d3e23

SHA256
3276748cee73bbf9ce2cb54fd9f816d6f4b73bc8943497609e99467c6eaddb3c

SHA512
3c0440f4c6c21489b34d65a6b029c475fcc592ff5c8b955c5d953d5fa7cdf8e1ec4a1550177392e2caf5749daecd7066dfd38882b4d27162e7ec1fb0170efb5e

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/metrica_client_data.db

Filesize
20KB

MD5
48c3446d4403a97809a8975b8ffd0ca3

SHA1
16a1d43867c6f29f36078b7a403f1a422019c73d

SHA256
0a45afa92d9bd00dbec3fbadf14813ff2c12b5ecf325831865c2265d6c910a8b

SHA512
06c70a2f91d6c74789ebe648e2708ed6510c4923314e8e25b3082bcfbba2b9fa1f2f68b7b21d88b6902831b77b529d22a7b3fd2f85f9711e656b4e44adada0a2

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/metrica_client_data.db

Filesize
20KB

MD5
44def4f6e42c3ec63f229d23af8c804a

SHA1
f5956d9295778b539bced03215343fd3cf7a9dd8

SHA256
882faff2a0f007164d5dbda7bd7f803306423b5eb48a88b1bb72bde65b77e50a

SHA512
a14770398044635a8a8fc0d59dc95af3a97ae78146a9ace3795d600a44098a5ff7099aa3d0ac40442f8ff8c5d3b5ceecb4b360bf47f3e8c7c902879e2e76228d

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/metrica_client_data.db

Filesize
20KB

MD5
bcf600ed4ab66e993a5b9655735c9443

SHA1
55a16f754a8f8610b72dba6a49cce8de849a268c

SHA256
030ea4044fa40321fcb2c09d7574faa165116c78e17d834863f9fdcf49614e20

SHA512
1de1a15a2ab2c65321de62ef40e3dd420433646304d29e0754d2d04acf44708b15e400173a1e3bac1c5787f630c0d2170a977a37fd075b04e047377251cbbc09

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/metrica_client_data.db-journal

Filesize
406KB

MD5
2998f51a20a441174fd859a2ae56a522

SHA1
4682395bef6fafe464d1ab05fe0b8dda53b9ddd5

SHA256
04b1c6336000d7ac78bd55fc7fc1e63ae3c4a160772d0face0a3e933b6588f06

SHA512
17fc8021dbe7d83a620b75a48a49277c5d44b6d7101a36c97b04cc638f94c73f01d762cc407e6cdd5803af011a87e0bf1263abfe9c387116371e76ab5a61808b

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/metrica_client_data.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/metrica_client_data.db-wal

Filesize
32KB

MD5
89f81b2e6899cd3a0bdd86849acb0159

SHA1
5054efb9790dc543f50dfcf1c33a25ca13ee33de

SHA256
a256945fe3d32a564b17f0a8a966c07970d7ab5db0a4a85c55e8afdbae1ad8f4

SHA512
18785fc652409a4762b7ff6937c7e4ac24de46cb7e7041207c8ee48fd45b79fb79b61b0cd92e60af76ecf737902b2f7d81683250ee2408d54aaa7be97d7ed9fb

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/metrica_client_data.db-wal

Filesize
8KB

MD5
0f18fee0d103b9cd6b5f942dfa5f192b

SHA1
0b229705fb0f80f733f7478d028c7aedadf912e2

SHA256
391ea4e07d555aff73b5835d13ed87c6e69d2b4679fae22932c5809fe301cc70

SHA512
a45bec1623225d3cc06456d1e88d01c79dfb7c70befc8dd30ba1c2c8d4702c20dcabc3001f29da0e03a13958d7eed266cf422001a823add1c4d0442fe9f00480

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/metrica_client_data.db-wal

Filesize
32KB

MD5
9d9c90aacdc9b600fccd78e2ff8b2999

SHA1
f01f88e3cbcd45143bef53439b254df45b80eabe

SHA256
1f66c73f2a7fddeb2cd7074d607e9d73b9571f29b7e97045cd863a760fc0d80a

SHA512
e586e93674036497c94e0d4fb3e69f7d34c312567ea690ad0cea88bfaf46ccc3c814e524c3371a1f2610e00f08bbb6d1f23088712f04bbd38fa2b1a907800973

Download Submit
/data/data/com.producepro.checkout.marchese/no_backup/metrica_data.db

Filesize
44KB

MD5
d4cec2de5d499ab7804d57df3bf673dc

SHA1
644f9af0c7e0b05c85cb186d09d1008811d1e9de

SHA256
c259ba3916a61765d75606e62f0347761f58d52ff67c2e1a3c9f44782f18b348

SHA512
d2bec9079661a2fc8e00573ecb902a9ec6e7665e063d88cbb5b6908d888f5247199dd8e38fd17832c468d1cf58ec42e101a1e9b26c501c093a8eabef653ed2b3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads