9f36d98c5bffde9f43e65cbfc3f732e28e4620553f7d68edc75271cf6f5a7c55

Analysis

max time kernel
2485726s
max time network
161s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20-12-2023 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f36d98c5bffde9f43e65cbfc3f732e28e4620553f7d68edc75271cf6f5a7c55.apk
Size

14.8MB
MD5

b3e635dda12293344b6a1ec410b575e7
SHA1

c15ae0e02682933143c4b325c34f413a052233a8
SHA256

9f36d98c5bffde9f43e65cbfc3f732e28e4620553f7d68edc75271cf6f5a7c55
SHA512

5374df264e0e31bfd83e938dd823589eb1a6f3026a07010564b214ab5a4b1a8b6a2a538ec55ea87f4b7a3c611ca54537e82d640585dda064b5cda36be0d9f3ee
SSDEEP

196608:t3Ek94dKz4GmBu4gYRoRcu4dFCrXFV14fQ25+b82zo7nQ0NlKBDoxliHhYx2za7g:tF4M0NBYYJKV4eWpNsLBY60wsBPuB

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Requests dangerous framework permissions 26 IoCs

description	ioc
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows an application to use SIP service.	android.permission.USE_SIP
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows the app to answer an incoming phone call.	android.permission.ANSWER_PHONE_CALLS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

biqfgu.mgycleom.bauokge
1⤵
PID:5077

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/biqfgu.mgycleom.bauokge/databases/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/biqfgu.mgycleom.bauokge/databases/androidx.work.workdb-journal

Filesize
512B

MD5
606e303d202671189de2dcd46e04a078

SHA1
c84a2822a56fc6138bbcf398a0fd1c701ccc493f

SHA256
1c0c47f6303b0ff5b7cfd4f4a360aca75ba635726f91bda935cd18324a0a512d

SHA512
9660e1771873c1281a7c1827e4457e32cc373ab574bd086bf2340fe93c2255556ca1a6e9ecb139683f6bc64565337c39053a9db4a270a9e877b27cc4de996ea3

Download Submit
/data/data/biqfgu.mgycleom.bauokge/databases/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/biqfgu.mgycleom.bauokge/databases/androidx.work.workdb-wal

Filesize
16KB

MD5
c9b87999d17b813074731e6b66b4fe9e

SHA1
370204b2d53bf8990734ad7e300f5c4bf4de850a

SHA256
3fe6ca4db30e12458a7a139237efa16c8512676441cf78317ec54328e1f7cba1

SHA512
2538d474a4d52deb573910e544d65ebad12a9ad82d9b920e952af4ad5ec9c0e0ac0f0d04e2423a44e97987ae169bfa73c6e038b538b4f865a5aec977932a80a5

Download Submit
/storage/emulated/0/Android/data/biqfgu.mgycleom.bauokge/files/apk/app1.apk

Filesize
23KB

MD5
1deb165a1b4881c6b52505b1d11fbe27

SHA1
19f2a16bdcaa074fc1b9af98ab147ff54436355c

SHA256
22ee096a5c7ba2cc76b7bbee1b5ee3403b1221cbf52364a44288cc9e3c57e010

SHA512
b46cbf2b7dae66fe7dca3da69a9bf2a8c832cab7397b9465d9f2882ff39787cdc8f419798736f10bb944cfd7c7c1d9cbf4290d501ed9a1e3932ed3b93c1704f0

Download Submit