2f4ce33224f0c7551fc77e864ef2e401351d78e6c96ac2c440d2c65f666eabc2

Analysis

max time kernel
87s
max time network
149s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
28-02-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad03d79e25aeabcc04e4ef053245cf1f.apk
Size

2.5MB
MD5

ad03d79e25aeabcc04e4ef053245cf1f
SHA1

8f4f14a4a7857a7cf3d1ddc834340c9edf6b9aec
SHA256

2f4ce33224f0c7551fc77e864ef2e401351d78e6c96ac2c440d2c65f666eabc2
SHA512

5c29767606d12a1d98a9b208eeae901316e55c5956d2c2d1607b605101292c0745cea6271313eea225a1f1761ac0af297cf7c372071d89ce8293c19001395d2c
SSDEEP

49152:4CF27/7n54+hblJ37avFS7z+ieXHs3Tb9P3ygoEa5E3tfu:g7Hb37awn+ieSTb9zVru

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.rainbowdeveloper.transparentcaller/cache/1582435991586.jar	5091	com.rainbowdeveloper.transparentcaller

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.rainbowdeveloper.transparentcaller

com.rainbowdeveloper.transparentcaller
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5091

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.rainbowdeveloper.transparentcaller/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/data/com.rainbowdeveloper.transparentcaller/files/gaClientId

Filesize
36B

MD5
a5310ce17d15a0f4abde106015dea3bb

SHA1
afd80a4a92cc7dfe49e6842b0d75f9472b858dc4

SHA256
aa6f22ebe92484f89469f9b0112f032e9c72aababeb149c4fcfec43fd989725b

SHA512
3fb453bc9ac894e0e3335c4dfe2a6bf6a60ccc6cc12279557a9a237a90f340951ac056a0a2399024e876406c52015746ea3c93edfe652eea7a4d01b3737d2139

Download Submit
/data/user/0/com.rainbowdeveloper.transparentcaller/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit