362dfea655d1fdad4b40f1d624e0b4a9c4e7e0aba7f334950beda2564a184313

Analysis

max time kernel
48s
max time network
131s
platform
android_x64
resource
android-33-x64-arm64-20231215-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20231215-enlocale:en-usos:android-13-x64system
submitted
18/02/2024, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
latest.apk
Size 4.3MB
Sample240218-txsjxscf23
SHA256 362dfea655d1fdad4b40f1d624e0b4a9c4e7e0aba7f334950beda2564a184313
MD5 7b3eea2dd00b9e331661156f63eadc8a
SHA1 0b4478ac6ebb45701cc175a5c2fcdaaca5c05155
SHA512 735e00355343ceee6ad7473413f8cc6dbdbd145ebe33388f4c499709cde8482ddeceaa73ecf8fa85cbfd1f5654d5992508f4cb3af8f8d52c34740194df35d045
SSDEEP 98304:YA+u4Y1sNALlOUajv+oTwr5qrdwcVkU1n9y858la:YAk8OdDp59wa
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.drnull.v5

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4278

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.drnull.v5/databases/com.google.android.datatransport.events
Size 12KB
SHA256 bb9e45aad35b43e895393e7a66e4ead6a5f728f90b7627e3c741d391bf65d4f9
MD5 edb655088d1ed9f33f9d0d499b7a3ef5
SHA1 565c4f4e43179dbfc285cd6331dc8ac75a901af8
SHA512 98cbf923880de82921c38973fbc6d711dc39884428d1eb4ead33658a5a7f163734e5121823d5b043ca44554d19c5b6f966674ac7291513944a94cec97d5be599
SSDEEP 6:l9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKTqiOw2:TLJdKBRmBEyPbsOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 4713cf24d2bbd7b1a2c29c95dc4b46c8fab35eb42279bf57528db7ea6480a32b
MD5 df4e1beea4eeb5a0aedeeadfda1bfbb1
SHA1 2a2a12e34b2c0332bae93798e9fabd3639322593
SHA512 636a353a71e20a39a0558f4b0d2898c00d535df3c9d40d2748bfd9a472c85f062999b0b1ddd2c0c24b8558b7a5109d595a45752dc7009878513d9fed80093ef9
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 c4f806fca8cd79206f6a550cec236b7749a939f3866d4384bed5050a78435750
MD5 b649125134277ef447faebe3226a4d47
SHA1 ab5bb1bcc2a40e641bd5ec8d5448e9efdae5c793
SHA512 22c3507a34009cdbeb323b421fb2e3d17a4b6a3c15ea5248c35095c187f6bac6854866c53c526a4ed88296e9cf40cbefae9bd7ca7c9b1be7a9c86c9dd1b55dd8
SSDEEP 6:7+/l9Y7Xn1+0g9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuK0L:7+tIjqLiuWd7RmBEyPbB
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 a8423b8f601b8eb5a2ce6b87f3e312e9897d2d276182f3b2790ce782913cd92f
MD5 6e761b94a870f6147f6a8f7d5c4b079c
SHA1 c38df4ea9895fd4c83a61a1b575fce4673ea9073
SHA512 6635c98ac7dc1d6673213ac3319377c9f4a5e0b6a17fc0d5dd73c1712701c2369ef4988930421821dd170f07a3c589d370246c0391d798663bca28c45acf9c1b
SSDEEP 6:8FHPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKd/Um:8ZqLJdKBRmBEyPbiUm
MD5 SHA1 SHA512 SSDEEP

Submit Download

PersistedInstallation3477301192454576762tmp

Path /data/data/com.drnull.v5/files/PersistedInstallation3477301192454576762tmp
Size 90B
SHA256 858bb4981bf2c16ebab8bd5481aa01bd903042dc82089381703726fc4c730a29
MD5 6a234cc1e3bc9942c55c62543b6a1376
SHA1 cd7943144944ecbd9c35263ab0d263b530090e9e
SHA512 0029b66d96a158933ec9a1135b2fc9498ff279e33d5f46b47c4088249c39330344bf567aa389b861dc5249eb613747a902746b61052fa33f33f06af6bb3b765b
MD5 SHA1 SHA512

Submit Download

PersistedInstallation5783894331086161656tmp

Path /data/data/com.drnull.v5/files/PersistedInstallation5783894331086161656tmp
Size 569B
SHA256 f59fed5063b5214056179bbbba2adb79b812cc13e9abb43170af394841b9bbac
MD5 5e04391393521b07f627dd37e5e7c0eb
SHA1 2d0875bb57e011ab569b610c1c13b5f5856b8f8c
SHA512 320e14d5a9636c821ec31e3b098a0342425a8cffe37968fd623095bb305428f7b3a56cbe1036271b0bdcd38f17263c85d054e57baa3ef1d82da43782ae4d02a9
MD5 SHA1 SHA512

Submit Download

database.db

Path /data/data/com.drnull.v5/files/database.db
Size 102B
SHA256 32a90e656a15ec0c16f4c169f37e79841a727b071293655a8c8f276f81747272
MD5 c6fb13c6d6a70a829c08b5d440d53e2d
SHA1 df05c52a74b081e8039f4580bd73d0c613ab6954
SHA512 a0803cc26d780c2195124f859e70ac437958cb1c277b7dd3a659ac888914eb049831606a0e48ea225c81ed8bf7048c02da5c6d7df39fedc141526ebde0dd1c12
MD5 SHA1 SHA512

Submit Download

profileInstalled

Path /data/data/com.drnull.v5/files/profileInstalled
Size 24B
SHA256 93445fc956e4925ed918e48034aa4d996783cea4e53b3de526ef8fa90a6b69a7
MD5 37d6207a2f9a9f6b8a21e779aaa21df4
SHA1 5ce45d15b7cdd95d607eedf5b3a61cf2a8c4f99d
SHA512 65ed38a50d263e1948312aadf03f820257246f6dd3c135741be685233468b2c88915ddd9a735a5f0f1478cfc85ea651223813828d727fbed90c9e9d36f8ded48
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.drnull.v5/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 33dbf2c68f574f34515346f4b0faa2338a2a44c50811984f94c32620e39be392
MD5 57eb7e93e45758e3bda817b08f461644
SHA1 3fa73c827ccddc77702955964ccca099b67fc45d
SHA512 07b9fe6eb441dac732763d90099fc43332127416884f5ee1c9587e38db67664e215fd1e578ee92920bbf14c97b0b83f108ccae9475f28fec963727136f42f527
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.drnull.v5/primary.prof
Size 1KB
SHA256 0e987a595a78437968504f7cc3b5c9f8ab619322ea653a768afc40e06a9a5e84
MD5 b47a28282770692af90b09a8e74573aa
SHA1 25726a46f508ba3ef074cff9d7878bfdd5023cc7
SHA512 eac21cb9fff26d4f22ce07523d82c38046f1a3742167f381d2ce493b398faf9baa1a7081c2cf3be8a03ae21df5ae76214c8825f423798e9d154df4c22c5adf04
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.drnull.v5/primary.prof
Size 3KB
SHA256 2e5e47c8a5f1fd8ee8c6ce6ce5cefd171a44e995261c40da6fa3e35f5a3b3543
MD5 0232df7203405b191659b0c089818da9
SHA1 fd8c314df3a43269a2e3e851811a48fcd120dcbf
SHA512 553145d36cb9be19369a15256adb81324d901e16f84d668af8b57a6caff84fe846bf4633b4a042ac5184a6fdbe66e01b85f213d4a17f2e7d602a340a8d13f36e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads