Analysis
- max time kernel
48s - max time network
131s - platform
android_x64 - resource
android-33-x64-arm64-20231215-en - resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20231215-enlocale:en-usos:android-13-x64system - submitted
13/02/2024, 02:49
Behavioral task
behavioral1
Sample
463f9ed427c5d003dbe5d0c79ec0046f7f7b4b73d412588661bf86d3aca8088a.apk
Resource
android-x86-arm-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
463f9ed427c5d003dbe5d0c79ec0046f7f7b4b73d412588661bf86d3aca8088a.apk
Resource
android-33-x64-arm64-20231215-en
4 signatures
150 seconds
General
- Target 463f9ed427c5d003dbe5d0c79ec0046f7f7b4b73d412588661bf86d3aca8088a.apk
- Size 4.3MB
- Sample240213-dba5racf4w
- SHA256 463f9ed427c5d003dbe5d0c79ec0046f7f7b4b73d412588661bf86d3aca8088a
- MD5 19d7d3ff409bf1b5ed9e8f73fbc7bda3
- SHA1 ea7883aacb78245fbbbe0192635d94ffce7b73e2
- SHA512 9a723550714b813d2b1a726e945d306ef3d7cb617fbfe802cd4b49ce403311fcb6b1f8f23c69b70d95343965d0650392ee9ea27293ff45bcb70da2b5cffde658
- SSDEEP 98304:pA+u4Y1sNALlOUajvyoTwr5qTZ8s9EcRjJeA1kZ3:pAk8OdHlBJ83
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
description ioc Process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.drnull.v5 - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.drnull.v5 - Reads information about phone network operator.
- Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.drnull.v5
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.drnull.v5/databases/com.google.android.datatransport.events
- Size 12KB
- SHA256 bb9e45aad35b43e895393e7a66e4ead6a5f728f90b7627e3c741d391bf65d4f9
- MD5 edb655088d1ed9f33f9d0d499b7a3ef5
- SHA1 565c4f4e43179dbfc285cd6331dc8ac75a901af8
- SHA512 98cbf923880de82921c38973fbc6d711dc39884428d1eb4ead33658a5a7f163734e5121823d5b043ca44554d19c5b6f966674ac7291513944a94cec97d5be599
- SSDEEP 6:l9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKTqiOw2:TLJdKBRmBEyPbsOw2
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 261824c23413368bda79c29ea54719969a78835af48196fe94f15111d333f1ef
- MD5 febac48b66d38935f2c2308247f93d23
- SHA1 64a2fbecc4e2a019259c0733804d63a4f8106494
- SHA512 e28c03f2ddbb9d37cdb9a403e5758484bbfe69a6df94272b26efaf77e7edf3c7abcd6aeaae629de5d5ed471486348c70875df63bca7425269b6c5c3c3485c05b
- MD5 SHA1 SHA512
- Path /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 bfa0f159df99315bf89a40d5c14fc219cba3e266089e20f343382b348e8fc5cf
- MD5 a1505bc1e890f6dda33d45aecb351287
- SHA1 fe987eacd2094b4c4c01616600eca7eb78914bb4
- SHA512 5a1fcce6092b5415604257db71c7a773347d14dbed77092f3b9b1b1bf959a54639a7f4c494388e58a12ad6603fefb636403d07cf9ebe5bf6d51df83cacca1f9f
- SSDEEP 6:7+/l9lgn1Plng9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKa:7+t8qLiuWd7RmBEyPbx
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 63a4ee85936e17ac631c96541fd4076aea8f54b91da68e2aa3b4738eb977bee8
- MD5 16dd9318b0012388d421557763be7fee
- SHA1 8942641a800229aea0c23035841eaa15ee209514
- SHA512 4394bba058889603315b51a686c06bc107587d8bcd00734b978951d17467fc18c47da58787a45cd39d0588322b8dc9d86a31ccbc80f93f5a44edde5fb4861d9f
- SSDEEP 6:6Pg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK6U/:uqLJdKBRmBEyPbL0
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.drnull.v5/files/PersistedInstallation6550181358456596921tmp
- Size 567B
- SHA256 de171244e8134b292d955909d24c440a5f5a77701990ff074d3df6f5d53d8b13
- MD5 89ff71ba8ba4fcf2b1531b21a0ae03c6
- SHA1 82aa748ed4af3dc8f8f2cf447e68cafdbe60a58d
- SHA512 a2c503b2920f75d7ab8f7e2af1ce258622a965d6ece39ed8e46c985e0ea50d0064f03d32a570c231df854c2bf51cc4aef028afb5ad45a9bc9f9fe3dcc71c6d28
- MD5 SHA1 SHA512
- Path /data/data/com.drnull.v5/files/database.db
- Size 102B
- SHA256 688bca5e6d17f9b81796cacf520a7084a905a5e59bf7292ac04bc1f8bb3d45c1
- MD5 24dbbfd7eb0cca514983e56e774ae7f7
- SHA1 bcb11cfd1cda3191c91f07686f83aea4340bc96b
- SHA512 b7b490fb27fb8dc51b1335045f1d9ec6c6b40cbe8faab7781ec7dfafc9e7ac16f8aa655a822507a874774b125e96b1289fc1dad15f8e9aa2c82eda2c7c3d7773
- MD5 SHA1 SHA512
- Path /data/data/com.drnull.v5/files/profileInstalled
- Size 24B
- SHA256 c9e9997feda4a742107e5b0413182a00e9b55cd63eb383162b3a6fecba788a61
- MD5 41a8487070e1f228e72ceb81f5d4b643
- SHA1 657b591db75934e931fc17b4a84db8709f41ee13
- SHA512 b21f4477ae7ae4f794f5c60eafe5814d8d6d7ead34298f7db744444428b68a9e37d36d1d44c9bf870e9b31d750c6e4fa659d7c91887333553158acfd6fa17b5f
- MD5 SHA1 SHA512
- Path /data/data/com.drnull.v5/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 7ecf2d6f59a57886a1fb27b047762250eab68f99ecc1ed69a182e166b1594930
- MD5 a95b255763126afbf18d0332d50613e5
- SHA1 c66a4def039a1749a793aaa96b94fefb154e6a0b
- SHA512 571cb409e2c6eb62233aa2d36a18f96a2e2d69424d06ab440d162cbce8ff03202d21d50630482aa2c57307481712ec49d9201f921adf112fafcf45b0daa77487
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.drnull.v5/primary.prof
- Size 1KB
- SHA256 0e987a595a78437968504f7cc3b5c9f8ab619322ea653a768afc40e06a9a5e84
- MD5 b47a28282770692af90b09a8e74573aa
- SHA1 25726a46f508ba3ef074cff9d7878bfdd5023cc7
- SHA512 eac21cb9fff26d4f22ce07523d82c38046f1a3742167f381d2ce493b398faf9baa1a7081c2cf3be8a03ae21df5ae76214c8825f423798e9d154df4c22c5adf04
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.drnull.v5/primary.prof
- Size 3KB
- SHA256 07ec9e45db3e18a1a6a28ea92449b2a30bbdca47055c52fd9659477eacb1c959
- MD5 63e508559d744be27b8ebf3ae6bac450
- SHA1 a04f90ca165e7abccabb37eb4b4f46c83395f417
- SHA512 21e44ffdf15afc562273db47de8d365422f1e92078ea33222a4e0797e67034a0468ce413941ee91d291f113e41bf29addcbe8a3620c99984abfb116271a709fd
- MD5 SHA1 SHA512