90d40e206c39f2f27eaa187e77bb88addcfdddd7cee8f64060bad70d61aad215

Analysis

max time kernel
20s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
02-04-2024 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

590a24580b0e521e5a508b65ac5843e0724cf3d2ecac4356d2423116ba891e71.apk
Size

3.4MB
MD5

3e3edcccd847bd1f40bd0d7c71a8ef9b
SHA1

5b561522d91c42e5eca0bcbefa854fe83653d69d
SHA256

590a24580b0e521e5a508b65ac5843e0724cf3d2ecac4356d2423116ba891e71
SHA512

32c997698bfb07081e4c45337b402acd294f3211cf9df8bbc65a9f21f06b23d56d0172a2c1cfef9c92de2d762ea4fc8552e8fe5ae7382fcd302c7cc447a887f4
SSDEEP

98304:gA+u4Y1sNALlOUajvQoTwr5q7QASwW0bhX6rKATh:gAk8OdZM+XGh

Score

8^/10

banker discovery

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs

banker discovery

Security Software Discovery

T1418.001

Processes:

com.drnull.v5

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.drnull.v5

Acquires the wake lock 1 IoCs

Processes:

com.drnull.v5

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.drnull.v5

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4263

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
718a65675c8e1cc2640c11cf6d826a48

SHA1
9f022f962b7a2dcab8fa63693bb103fde4457ff5

SHA256
0ce8c74bb2641a420aaf112a876e07314bdf6b5e5831ee1000e5cfc4070cc603

SHA512
bec8571bed58e3d4a331f79d7e0d6b6e5bef4ffd5ed69e673f1604478f96e19ce657b45b520c06d4e707ca876ae52bc0eb0a06830c56f6aef2d432bda5da770b

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
aa5f91ac52d743d53098180ad948ad5a

SHA1
093e05ee732e727cdbab7f0c45574a8eb6710da8

SHA256
590cd465d983cf16484a63aa5b1b551c977a878fe205d9d44f6c9b16eba52f6a

SHA512
16f1395bc7444a3cd178c82a05c8d6075c404b6b49d35a0f8552e97c7b3e5ce04c18cc1ce6d1fc525d572b902d1e462b6c18f549c8216327379d0b56c7cfbe58

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation1031499052356435147tmp

Filesize
570B

MD5
fbea9afeb7fbdaaa4e065c14371689ed

SHA1
69bc3bc235a2947f9438474c826487e7dffbfd8d

SHA256
f7bcc9e074b89155645ad1e6291907a2d06829b532e7d66d3e6d10f4a2c05693

SHA512
7f48b75353e097fe1c82d4e92b879d97381fd91c643942f3a1387c6691b69033cc71b8b9a9b75ea10b2e4fbe7f7768c1f8114925417dc50e510e7acd932f7532

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation349981840221474443tmp

Filesize
90B

MD5
fb02f19d2b00a5ad14db907bba594d49

SHA1
17cdd3bce54da47832b17b6618ac729950a07e80

SHA256
4efa5334937f824363bceec603ea5c53cf9c1f75a73053879dd8e27cf06f15ba

SHA512
48422411f5710a7c511adf340197d6b5384d6fa2d171eaf7e52fb25406c4719addd9544c17e21973a02cf61c730e4e19587a2eb37a837f5d90784b01487ccc82

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
f236ef87a5b8f280d1aef2f022eb9e7a

SHA1
f599822f45eadc27d31d78113e593b9b4045947a

SHA256
987c7be02a42d5ac0ede02fe4f387d99506162f06f49fc14a021411120b16842

SHA512
4b8e7fc3b30cc7eb3a05742422f1ad1dab977fb2ec3d8ddc67e72beba471f5afc954d772a15931acce5d34b698d9dda974232f04b790956f3d9803c6e58101ce

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
662382639dcd7480ae68247e196d5a1d

SHA1
7b5178bb66e6b8822b7f636230c3ea29855e755d

SHA256
e8515bc6fa212364be59f0279e961a269a2b66941aaf942257cc5011383a83af

SHA512
e96fdb178047aadb6307587781fff55538db67269ffcbf98b850b1fc93cfa78ddc28bef13b9eee85611b833d8ecc3c573ce909e8815628c1abfe4070e50815ea

Download Submit
/data/data/com.drnull.v5/files/profileInstalled

Filesize
24B

MD5
3a542246cea14f2813f87f06ac3b0fab

SHA1
db27eced38b491d34082482984342b1f4f02fd4f

SHA256
6378e0a2f7e79ad69bccbfad060b5578e632d27e84d10a25bd63e0dd352238f5

SHA512
5df9630fdc77af88446998a2c3b51a354174d0e84d881c7d8a3f0fc0fb133984fcc4c7df5b77b538806f455986898b760ce28d35b1f015a7c9dd410a3d8587af

Download Submit
/data/data/com.drnull.v5/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
c4d0470b5d6df82eb6c081770c7d32cb

SHA1
c522792f58dd11b3883a3fd56544bec4cd256291

SHA256
9eab0c7a6571809b32e63fd02ea459a69daeb0176933809f3594d804727e9e26

SHA512
44a29779509aa02aabc6d2b6f45138c84b0cfe16580696e52f3c25e8ba7364e3fd054f04bab3c73367d648a362c1d15c773eea6ba40d8654c71c51182afcde4d

Download Submit
/data/misc/profiles/cur/0/com.drnull.v5/primary.prof

Filesize
1KB

MD5
3bf4327df6b1fcec0de5399a885183ed

SHA1
4f2ceeb901b71d3f3c5d56ee9ac0430c94088308

SHA256
87964145ade7a79f223cadc1c48ed417d86ac1872b5f6d533814312da485e6ba

SHA512
5c3c3416af07cfa265043ee24909c59ea99d482f8e77f18a33b02cb0dfee6e48587341ee575dbd687fca82d249a00130c047b754994cfff9f9a4275724de4043

Download Submit