ad3e95eb5ad4d5aa5652bb1573f84e94ed8d4a731b24bb7a73e47c3ea9ea8ae9

Analysis

max time kernel
152s
max time network
157s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
25/03/2024, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad3e95eb5ad4d5aa5652bb1573f84e94ed8d4a731b24bb7a73e47c3ea9ea8ae9.apk
Size

1.7MB
MD5

5d5338ab6bb53f29e972555b2c57e6b3
SHA1

f1cd94fe564700dd6d927df1ee598568a05243c7
SHA256

ad3e95eb5ad4d5aa5652bb1573f84e94ed8d4a731b24bb7a73e47c3ea9ea8ae9
SHA512

f665374089478d0e69ea51dadfd04e012a5634c63e9b5db0006f6386733e928102b73466fbb594d7268aaa42144cc8b6baa56cc9ec4a2f9d007c83f03f17c932
SSDEEP

24576:26GxiEknj8PEMR9ai0s/QKzCFJGZGDYExtJDWEghVOGOc3HtsSCKcEjv:HlwP1aXc3z/GkEXJiEgjFp3nCbEjv

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.draw.nearme.gamecenter/files/77a011a8.dex	5134	com.draw.nearme.gamecenter

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.draw.nearme.gamecenter

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.draw.nearme.gamecenter

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.draw.nearme.gamecenter
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
PID:5134

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.draw.nearme.gamecenter/files/PersistedInstallation4061742721591724800tmp

Filesize
571B

MD5
692dfa824247179aa7c93086a9539865

SHA1
f36bd8278250229fcb8de2b2a66c627717816f1e

SHA256
f56c6e90d1c7de88601d1f4f474fd4cbc341f015127d7580f8a4f8b0ad5c9528

SHA512
0fb4c4bc8d69245c000e507d937e0636bf3980a321aec3494bc1bfd03e7cfb5adfaa7cb0a8665947ed16163a895d72b5755a1e16322dba2a815c149bd9c937a8

Download Submit
/data/data/com.draw.nearme.gamecenter/files/bFCNU

Filesize
230B

MD5
5682e9821481f853f56a5bea58704cdb

SHA1
a1208a420f1dc25e440046d82f1133234552f614

SHA256
2fca16a6438e3a0cf8cd80c76bff19567f6241c8464d4bbc4a2d93141799b56f

SHA512
bb30bb828b311f9fc9d76b0c7f38b79693e54ddbe21c9674e3952a57b2255db304ddf67750640f7c1c8841cdf4a94610a9c98fec3686ceed73f7774d0cd8e072

Download Submit
/data/data/com.draw.nearme.gamecenter/files/dES

Filesize
718B

MD5
f14d87624c08c095a1dd13230f607fc2

SHA1
30df7357842ff50c0907c787bbadac505bfc1a92

SHA256
5f0577c1fb448636bf67509024d7522bfe846d8a20ea33204f7c836e01eec0ae

SHA512
36adc9f203d935a132486875ee8324130d8d8aa3fd5376a17b5cf29a8aa5704f66db9f2b82d3f88508a7c0ca3e96a107045b04209dc78951f9983ed4765436e1

Download Submit
/data/user/0/com.draw.nearme.gamecenter/files/77a011a8.dex

Filesize
2.7MB

MD5
52b4dc68e0bac0d1ee10f0d87fc694b8

SHA1
0a5203f48454c51d34229697663c2e6f313db96c

SHA256
8b49dfc5f58a91fba8e32707bf584290a9107ddfd6fd52eeb6af38cee95bfd3b

SHA512
205bc2139cb337884e124fefad002c94ae4c192cc255d8693f263e5325bd8378a9dc89f18d7b27025798d14e492ce89dcdd3537844380145e3f40d6f264dd06e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads