5f9b299b71fcc639689e9906509b0dfded9e813c0a65b76b41bcfe7e01c3af86

Analysis

max time kernel
30s
max time network
136s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
15/03/2024, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d257cfde7599f4e20ee08a62053e6b3b936c87d373e6805f0e0c65f1d39ec320.apk
Size 367KB
Sample240315-b57ppsfe69
SHA256 d257cfde7599f4e20ee08a62053e6b3b936c87d373e6805f0e0c65f1d39ec320
MD5 4aa966ff0455560a2918b746ada2ed52
SHA1 4984af24225d3356689585399ef5e49553e6436c
SHA512 e67061519218f5edc241c9458addf51b05a1bd0de604c973756c02018dddb4a893fbebf9ab9a0194b9fc737c7d479c5949b7d3cf7fa444a8bca88853c2d5ebae
SSDEEP 6144:1krLrE0XFUxWeau+qEqoh5pFtdiEnVXZrAhk3X2I9FZIqovhFa5Y5jQ5m3wQ54:1L0XFuNau+qsDkwX7xIqwhXML
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs

banker discovery

Security Software Discovery

T1418.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.xxGameAssistant.pao

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.xxGameAssistant.pao

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.xxGameAssistant.pao
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Requests cell location
PID:4270
- su
  2⤵
  PID:4330
- su
  2⤵
  PID:4358

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

inject

Path /data/data/com.xxGameAssistant.pao/cache/pao/inject
Size 27KB
SHA256 856061a1d0868d7ce3aa0d3d12e0c67a9278dc84a826293e3f1af231acfb542b
MD5 23bb1f4e4f35e8489cbab091ad3d6725
SHA1 a2e894a1353b1aa9451cd2ff1bcd06e250d45770
SHA512 d620f253b3478ce242e0d75849639637856f6cba9d8ab5e8e97a938a46935025583f1186edc630e5bfe1a32296b136352d31481824ed2d5b19de5c0df7f4fa06
SSDEEP 768:I09N6IkqRjVb0hFjAmo+ORsB9x8gMmsIAAAwstllR:v9N6xsjVb0PjAJR
MD5 SHA1 SHA512 SSDEEP

Submit Download

libghost.so

Path /data/data/com.xxGameAssistant.pao/cache/pao/libghost.so
Size 13KB
SHA256 911c6166ef4bbbf2fb1da593301cccac94f55c5267882640afcf55ce40add3bc
MD5 80892c5e7b60fcef1a004f1abc71d37f
SHA1 5a669700f36e28045c9b653d07b5936790cc83ef
SHA512 16d5c8dcf253c2ba2725b6b3d029fdb5e7cd98c12547add2380d01ba01410b0923a23256936e2da4cf79d0cba2d4a3cdfd2fc55df0436aceaaf2bb5d2f96c35c
SSDEEP 192:tc6uvUQ3Ui9nismRg9w9MjpbTfXe+vd/C:tluvUQb9tmine+V
MD5 SHA1 SHA512 SSDEEP

Submit Download

libhook.so

Path /data/data/com.xxGameAssistant.pao/cache/pao/libhook.so
Size 13KB
SHA256 a8911919780d496276a0cc00528ad24f9d22952af4da34fc120e59302b618a06
MD5 4b6f2a8be69f4fa2875565cfe8069451
SHA1 9c764b795126a6f00f13370215fe0686db9aa1bc
SHA512 d9b69b6f21215062f1d361a4a5947120fdb1cf5c4b0939e1551f5394ba42dd9b24f3ddc90c79e55dce5c52efdde782bb9260ad2cbc3f96aac949d159ae07c063
SSDEEP 192:IZa3UtzGaTksRgMg1MjpyTfXe+vdoRBM/3wxj:3aAsipe+V0j
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.xxGameAssistant.pao/files/TDtcagent.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

TDtcagent.db-journal

Path /data/data/com.xxGameAssistant.pao/files/TDtcagent.db-journal
Size 512B
SHA256 5aba843b8127eeb66d0a569a81bac1fbf69c15bafe3dd0dd37272ef015572b41
MD5 e5b18983afcee473821e53d0dcb931e5
SHA1 9b1763db7e7c1ec43456a629b6a82311da9ec4e9
SHA512 8f729dd2e1a5b71a269541941bb42b6d8ab14d101660cd5ee8f1379b7589dc37421e0af68a33ee8d3974cbca658a2f9e09e747da91444adff7228fd5088dd9ae
MD5 SHA1 SHA512

Submit Download

TDtcagent.db-wal

Path /data/data/com.xxGameAssistant.pao/files/TDtcagent.db-wal
Size 72KB
SHA256 e5dccae71ae817c7cf8ae13ca44f6e286557ccc864b71f985f61a5a126bad5d6
MD5 25307a46a72459361cecf2911a3aeb64
SHA1 015f226a26ed5de1e524d5ff29bee62af207bd89
SHA512 608c1106aa2ab0b4f70736fa005828e2a067bdde62626a1022bc8257fe9797c656718ca9db9cae102b2c65a20570f1d0e89e82205f130221f8fc9c0a07b1abb1
SSDEEP 96:Y0PoRhrP+ZUd/gpWP13ql8Ud/gpWPsW8ql8Ud/gpWPktg8ql8Ud/gpWP:bozBBea13q/BeaB8q/BeaN8q/Bea
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads