Analysis

  • max time kernel
    169165s
  • max time network
    163s
  • platform
    android_x64
  • resource
    android-x64-20230831-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
  • submitted
    07-10-2023 12:20

General

  • Target

    dex.apk

  • Size

    3.4MB

  • MD5

    98fa31b6bad3e925742469b2ac9ea949

  • SHA1

    211debe45b6d3c92f631fde1d2e37ae5d449a409

  • SHA256

    8a198276e504c169793b01a8ca42fd045670c64f670388076e773c8faa9f867a

  • SHA512

    d7e52bbe9391fa7fa5edec0af248db63cfd3e41c4f6ece09f3fb9215dd20d3bcf282469bd75a8c8abb8412c1babb16b0e87dc4c7e9c9a008eff47b7df88981f6

  • SSDEEP

    49152:UPSQWc/ktinEJkJLIET5HrIL/yFgLCrgDaj1WZCssQLL+Gt:sd/xEJkJLpTdgLCrgD018CYyO

Score
7/10

Malware Config

Signatures

  • Acquires the wake lock. 1 IoCs
  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs

Processes

  • com.drnull.v3
    1⤵
    • Acquires the wake lock.
    • Removes a system notification.
    PID:5030
  • com.drnull.v3:remote
    1⤵
      PID:5160

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.drnull.v3/databases/com.google.android.datatransport.events

      Filesize

      56KB

      MD5

      89664602b566f35c19eb8631de16d708

      SHA1

      82d36ebdb9e35fe049062139344a120f4dcb4e38

      SHA256

      12353b31286ba2344a1646d60c4252ee2509111d1e5cfd83cd5b845fe80580b9

      SHA512

      26c35ed23fd82c87952af4a680731faa84c25640d3d22c9cfde694f7096f7d0da93a436e03d94345c73be33c263696b874ba11708cea3f00975c0741f592d95a

    • /data/data/com.drnull.v3/databases/com.google.android.datatransport.events-journal

      Filesize

      512B

      MD5

      565e15f947f9d733846da42fc083db5c

      SHA1

      e33d2720881bf55938d03247972f81772e18a568

      SHA256

      17a1d7d2d8e95347dcba460f2e3220ab833b3feb62cbfa0a26c98d00fece84f5

      SHA512

      b76021e80f1b88ec15d4b781da356ad99053f0e965fc90f3d2b365cc9b6a7637428cc49df1217b3717caf09880da0c804abdbf0997532c3dba93efbffa9c10ea

    • /data/data/com.drnull.v3/databases/com.google.android.datatransport.events-journal

      Filesize

      8KB

      MD5

      cc0974e69afa54f7ea0536d52c5d6b3f

      SHA1

      1507669ecc240b3546eb03da525949e3617c2d73

      SHA256

      41c615270b3a6fd51c0ef4e6551baffb7df41623bf63be365855ff1bcb549e3f

      SHA512

      250879a0681507dd8ce910956bc1571452f4eee094424c0380a9c870b6cd020f720f6cf715f49488a036429c46f90655fde6ee5367b9ff57e2f85d0a81ef08bf

    • /data/data/com.drnull.v3/databases/com.google.android.datatransport.events-journal

      Filesize

      8KB

      MD5

      67838727d864e95d9d5143ea318d7ba9

      SHA1

      d806f96620003ae27ebd80a7f5f8d357ae94427b

      SHA256

      0a9da946ac21e386b0922cb5a2ba6641de385d0aebc930f346feb813a3dcde9f

      SHA512

      e6cf9db7d900cd05dcbd22f279ed8b390e04d95680e58b69057fbe3f20fddbb43f04d58385460a017f20c0b09c3cf223ac9828fd6fe600de3292581b9eb5caa9

    • /data/data/com.drnull.v3/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      92398ab4a6c92a409eed882f63c37e55

      SHA1

      8de79f554768157819d32303327e0b3d5345a0cb

      SHA256

      1104de2218928fca17d3f5085eabdac1673087dd57b96ee77da5b591fb31cb7f

      SHA512

      2a92c6ae17e534419f5a8f8e2b8222081b40910c64fd1bf0cd2dfbb2fe77cd6154151c2ed93bde1f58f5cd0f7e708b20561b0f4d7dcce729df032d1d72ec36f9

    • /data/data/com.drnull.v3/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      0ac064527e7aab3d2bc01a581022d139

      SHA1

      ef564a614296b5713f278369ffedf5ec2540490c

      SHA256

      485d15d9795005d85076a3da62089e1a4f3b805072ddac1c0d35ca62301b9c5c

      SHA512

      c588e5a4f7e6f77e907c2ffc8fd5f0c13148945543fdd3f14517f69e08a1ebb032ef93b0073b2bf43056c92c2a6b82efc824bfca25cf7b2ad03fd28a9111c282

    • /data/data/com.drnull.v3/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      d23a4fe9be418d5b2a944cc43cb59483

      SHA1

      f4e4dcf21518856dafdcd67f108fa543708d5013

      SHA256

      176f501d414233a1f7da098247eebdb272293335d0937b32072697792030bb9c

      SHA512

      19fcc15210a9598db0d9912171a2135c4df80076b7ad5d6b37213dc3d9d85af84842709c27954d08205178eb6a5b1ebb01bcfc2beb751ebb4390c318890af561

    • /data/data/com.drnull.v3/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      acd7b692111a87c26190dc5e07076d44

      SHA1

      7578cb5da5ca6871d15559398a3161ecc598f5d2

      SHA256

      e09289f3661c8f74960a6245675066a6a8555fb5778a4d4a29edfac6f16acbb8

      SHA512

      9f9b41f3de7757ffd6c4e48695f46b0537e9b86372a6fb8cbcb5ced05dedc81badaf218bcb414ed2ff0fbd4ed13d4d7bc0bd5c022ad3b7b37c87b0d94ce7eb97

    • /data/data/com.drnull.v3/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      eb52a90bb70b76e946b62f50b6f7fb85

      SHA1

      42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

      SHA256

      48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

      SHA512

      b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

    • /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal

      Filesize

      512B

      MD5

      c48a1336f866954e9c7d214bef85d841

      SHA1

      905b19a0a1e2e30809329db72dde13c3079a47dc

      SHA256

      5d81b4ee3c5901615ac2064059ca9c9184a8d8d8ac4577880133d0c89113a6ef

      SHA512

      7b8e4039ae30d4da9131899b1f6d7fc02e212fd7f40946010bdabf17c405ad74fc564e1d0421164aa01cfc620fcf328e79bd100e0442b71fc18e6318c166c605

    • /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal

      Filesize

      8KB

      MD5

      5ded065cf2d2f6dabce466d9b63b8426

      SHA1

      f84f01bdb7bd1c256c2c6e82c9c3668dafcedb4e

      SHA256

      8590f6e842e95d9b3c7cc6b31770d17114d2f3d8dcffe1d6a4d5ec038056b861

      SHA512

      804c65e307824d3bfc63cfbd2512feaeb29680732fc7cbf5b20e3a680ad560ff69c6b5e6ea1c9198656f3fa95df87cc3cce867ec2ce67182c576604095a32b3f

    • /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal

      Filesize

      4KB

      MD5

      8287aeb945e5959b57c20900784361f2

      SHA1

      a031cb08a5fa12d2c9eab54da330443433f88ccf

      SHA256

      5a8a2ac85013294cbfde38a848706a82ec71c37451db996070112e71652c750d

      SHA512

      325891fb02d70b6baff6aafe5f0a09f602aa325c0be45f6ed65808e7f7795e2cf2643247e5eea10d6a9b4c0e13b5c2b3f43cb36a4027da366b963ddbdfd69c65

    • /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal

      Filesize

      8KB

      MD5

      b826d83543b36575f36568dd53f880e9

      SHA1

      979234cbdea00f0ca629c6bc03824418424594e0

      SHA256

      99e316b641723eafa2949da8591d07e626ca9f1a0a4ec4b090e61c08b15db023

      SHA512

      a6d3b7fab24dbf342312b223141f39f194db167e50103c53c60cbe58681d33bcb367ecf047e93a50baa0401bb3b1503d3e1deee1d3d9d38f04ff4a25bdf7fd45

    • /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal

      Filesize

      8KB

      MD5

      fb5c75ea4277be4509de329e0a14829f

      SHA1

      3a21c6edf7215f2f11b9812c7f8067a2d98134c1

      SHA256

      34d3389defb6fb70643059599aed33aff68e94e5903240ef01bb3ab984c15ea3

      SHA512

      8b3153cb67403914faf6e33cd505888826a2c38f0a4cb0c0c3b7fe252b6dfae66c1177ed612a7b25eb04a4987e3025b05cf9cca850f8448addfe3723eff09df9

    • /data/data/com.drnull.v3/databases/google_app_measurement_local.db-journal

      Filesize

      8KB

      MD5

      89f31ac2ef3632f16125bd70d9f1914f

      SHA1

      fdb9e4084e7462e935105c937113784395314711

      SHA256

      8e9984d80f3749f2d53a30b1ff408f886629500a623e0b080fb094a218cda5b5

      SHA512

      d008d0ad1860b845ed2b5ba040cbb299f226790db07cf21d51af9fcfc87ef002d9dc6d5268a95ca4cd5676473528669ef3bfdefa1101946ae854700eedf021b6

    • /data/data/com.drnull.v3/files/PersistedInstallation32995681703368062tmp

      Filesize

      566B

      MD5

      2c25bc21de5274582b2d96131c395e75

      SHA1

      67695a3ae1b3e4cc0455c80cc739defe4fb5937c

      SHA256

      086324817141c4c4f2c6c25866537a656c1fc6a4fc630f98aa45cdb21af5918b

      SHA512

      6257843bc076067fc59afdfc91ef946ae02f40c9c0301289594d54c23ad8807ec2e2644ebb938f8c87204ef54b4256cd1b8a70ad7e782af461fe94c178a0ce09

    • /data/data/com.drnull.v3/files/PersistedInstallation8767494865269849244tmp

      Filesize

      90B

      MD5

      6a8d0ea161e20283703a83853a856f54

      SHA1

      e000a8337c9b8bdcb07d6445e3bb86281c5e7127

      SHA256

      6a3b6d75fe80e86fb33f250974a64844fa89227aab95bc7a62eb7983bf456fcd

      SHA512

      f2333a2c5a1184b23de108b90a3219e644b87eaa656c8e084082ac500b5872c586c0ba4b5edf8d581c40bf9710907cb293a23a0cf910d464ee070348ae2dca22

    • /data/data/com.drnull.v3/files/addr

      Filesize

      60B

      MD5

      0f2ec768db85a09b4d9533888a2e3fee

      SHA1

      7c785ce7f0b763bbf1b82e2624a18c59ec870392

      SHA256

      06ca4679602cf8358940b1c71f8644dc917e9b745953ccbdd9043891e69346a6

      SHA512

      4b9d62b599aa60b68cbb09c08e19c0526d0121229bc8b29084b4594b027f3ad577a4a4cbebe55d9a7c83073013c7c53db1d2871151d703f4e0b9aa59350a89a4