7b2125a569736ad0f21671abc0532eb75825c62d1f66c02daeba9f7d6df14129

Analysis

max time kernel
14s
max time network
155s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
22-03-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b2125a569736ad0f21671abc0532eb75825c62d1f66c02daeba9f7d6df14129.apk
Size

3.3MB
MD5

6655869d1d383f4dcfa50d1ce79400f1
SHA1

5ca1d9317b46881d6d96e263c84be001be628b4e
SHA256

7b2125a569736ad0f21671abc0532eb75825c62d1f66c02daeba9f7d6df14129
SHA512

915fc72f92bdb1bef9b2103b65f553d4dc4099dc09c354f40dc2aef851bcaab9abab82c85e0ee3c3bce370c44b7abef2caeb85c3abda19c5c52bc357ccbdc355
SSDEEP

49152:44dtlY6Fn6KZ/Pi3WD/CjnTxxooLvXZ+pYXs6lPhARlrkeHWD0uwAQb6qQdTh0gw:449YO6SgWD/CjnTzooDp+pYXLeGNaw1G

Score

8^/10

banker discovery evasion persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs

banker discovery

Security Software Discovery

T1418.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.cowukajagobulise.sabo

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.cowukajagobulise.sabo

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cowukajagobulise.sabo

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cowukajagobulise.sabo

com.cowukajagobulise.sabo
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5036

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cowukajagobulise.sabo/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.cowukajagobulise.sabo/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
c1e82e7a620b47862484aef35741dbae

SHA1
10187af63d4e56aa767a37328ec7fa9f3015f42a

SHA256
2b5cf8d8f84be1a1f767ae12b4e867a03c0122d4d83e7923c1aada6a2cd62510

SHA512
0bb211ebc45c79d2beaa7f00b68b6cf6cad865a20d97f7f0ad35b91deeccd5bfbe237f8e7244de1bed5b5009b411e88a01cc6f1102ee70dee9b7de913e14ffc5

Download Submit
/data/data/com.cowukajagobulise.sabo/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.cowukajagobulise.sabo/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
4d09f12460ffc1e6c7570a7a9c8fbaea

SHA1
5a283ff21509af55bfcb91796f9341361848e336

SHA256
a55f8310849f0fd7f6dd43f2e452f43bc75c45db1c698b71efea6a95c2c3223f

SHA512
89ca2560ce406fc4f65c983c65db16ac8090c7e824fadd0c8fbd0c608f647b73a642c57c638ffe840f8eea65c17d17a4f22786ad0645fcad2e09d3483e58f343

Download Submit
/data/data/com.cowukajagobulise.sabo/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
655db11b9c6dec19dc280505a9f5a29b

SHA1
a3ad36378f6322f492d4c719b056e0c3bf726b2b

SHA256
ce3d710d3dec3c4dbb8652532b949c339d48a49e504d517c0034e654b8495dd7

SHA512
4f293ff2ce49bb70151c743993fc56f480055ef2437cef92a7a8bf402d242453f92721d01b4d72d6df59fcb12ea1d0e7d2c4c4b5cb8c614b146951182f3090c5

Download Submit
/data/data/com.cowukajagobulise.sabo/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
5b6c4f9b0246dc03fb8849e418cf5eca

SHA1
1776a911ab46ac0cc0985ee9e7c2c06da6f0242b

SHA256
04fc326bac709684bb17a572dbafcf5b4526d07bbc0361dbd43c7f9fb4212ea7

SHA512
fa6089cc9344e1c2faf65fb9381227ce8ea82ac1201675f27b6ea63e85be78776ba3a55b1bb71f35ef17ac0c80ec6098db723b324fb9ba870e353bccb6eda1d6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads