d6df59f9260439b806c6336d7ade1c8f1822a11aed126e76d4468d9b815df3b8 | Triage

Sharing

General

Target

c6b1e34ec43d944ad355c60394435784
Size

6.7MB
Sample

240313-x9d4vafh95
MD5

c6b1e34ec43d944ad355c60394435784
SHA1

4397aa9cca9f373e25729f2fbb48022c52785783
SHA256

d6df59f9260439b806c6336d7ade1c8f1822a11aed126e76d4468d9b815df3b8
SHA512

4dddeae5f64a57885dc7dd502329c55e34e001dad1a2a35972dacd2fab95a3423d7ade720b1541ac68c4361a4419fe24b2160c7a57ffc28665f17771f0092b91
SSDEEP

196608:d0gjNdZiIxUiePMyZiZmCCIXIPWBMtJiP:ZPyLI8STBJ

Score

8^/10

android collection discovery evasion

Malware Config

Targets

- Target
  
  c6b1e34ec43d944ad355c60394435784
- Size
  
  6.7MB
- MD5
  
  c6b1e34ec43d944ad355c60394435784
- SHA1
  
  4397aa9cca9f373e25729f2fbb48022c52785783
- SHA256
  
  d6df59f9260439b806c6336d7ade1c8f1822a11aed126e76d4468d9b815df3b8
- SHA512
  
  4dddeae5f64a57885dc7dd502329c55e34e001dad1a2a35972dacd2fab95a3423d7ade720b1541ac68c4361a4419fe24b2160c7a57ffc28665f17771f0092b91
- SSDEEP
  
  196608:d0gjNdZiIxUiePMyZiZmCCIXIPWBMtJiP:ZPyLI8STBJ
Score

8^/10

collection discovery evasion
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery
- Checks known Qemu files.
  Checks for known Qemu files that exist on Android virtual device images.
  evasion
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Reads information about phone network operator.
  discovery
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Location Tracking

System Network Configuration Discovery

Lateral Movement

Collection

Location Tracking

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondiscoveryevasion