45f956a3eef5517b7341c119f62cc970c7f2dee4e906481148a1f716891105c9

Analysis

max time kernel
19s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
02-04-2024 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bf740d33b8654c1888b6ff6f2f2d32895cdfd9b205be5acb550e3d15cd705fd.apk
Size

3.4MB
MD5

185103d45cb5c8d59319e8488035e3b4
SHA1

dfbe249d9af8289ebe83f6c6436054498e9759d5
SHA256

5bf740d33b8654c1888b6ff6f2f2d32895cdfd9b205be5acb550e3d15cd705fd
SHA512

eb104556ef2cb685a0a8bca9b71d8bba9ecb857b34c29307a1b37834ae5cb029742e5576315ef0ce57421b698d90b2630e233247edd7d5b23b21184bef4a742a
SSDEEP

98304:css9Dft3aCrCMr1GoTwr5qUa8Eeu0XVvetu85W:DWDFrDRevmW

Score

6^/10

discovery

Malware Config

Signatures

Acquires the wake lock 1 IoCs

Processes:

com.drnull.v5

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.drnull.v5

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4266

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
7da3bc644173eb8c94738b04c767e3d1

SHA1
45550f69e0a882562717ce854b9129531b8b0e36

SHA256
ad1c726467c01177ebe8ea6a0ea2e4437e5ae0e012f5cfc291b9a9b833778913

SHA512
50e594f121c8ce8213d0919b8244575b70cab3acb49cfbc21098d6e220afcf97caabc77e384e8ff29bb143f3df4727eebdb00ff34e8b6562ab233c6419fff51c

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
d9b3444371192667075e0d5b426f760a

SHA1
88f987f0b03b30839777e1d8a9d961b8aca79b18

SHA256
a9b1a04e137b769d9acdb73f8a70a52946e046fc636ef206c83e86a4c2ed4e05

SHA512
9b4b2741ec27f2aaf0b38c224278ec4c18b3155a040b48dff96ab8bae8ea00c63845aa5615925312c7d37e4b85c06fc55a4db26b0e71db1e27c779c2a0caece3

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation5636089357122676549tmp

Filesize
569B

MD5
fdd2c3c686714ebac1937b7d78d1d38b

SHA1
e9bc61fe31cdd59fa1a7fada11b0a31e39044d21

SHA256
46644ceebacdcf54cfd222707273441b98957fb0ec5e1bfbd66f4e67e11875a3

SHA512
83b95c6733dcc502e7365bc9252596e378139bb18a21a16a301e408477630eedb2eb2fb82eb00a260700d3980709d3f10009c458a2c4533e8c2410eba58cf1a2

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation8733788213177138127tmp

Filesize
90B

MD5
1472e73c7843a392d62fcf417f617d26

SHA1
38c89e5dc779d3ba72aa003dec814f3527317e8e

SHA256
c6fc088935cecce00424acaec3e4f2fec6805f71abee05114ebb9e0860406551

SHA512
e65ebd6c7fd3d7787517fd04959442d56b1202e2b1d66c1c55ba21a7fcfa9d688bcda75daef02f12e249475272319c65fb514625a5d1f3ee5da9a23f416e2cb4

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
e9b728cb9252a6ac9198e4f3bb053180

SHA1
9b5867fc433b9258fc4a32f0f11c537741e73879

SHA256
f4e63bfe6fe1ca610d728b428d2a15707b0e1d314c03777425221ce5b371176d

SHA512
9dd1d46d619dc45ded01ee718ceaa2e950c210152661526233e8ed33a9afb8589a3e2f9ef4016edd1e38e2748e8839616099283b15a9a70e3dfdd94c0a3a935d

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
262B

MD5
a78ff3dca3cf6f37556dd3e2576db1d1

SHA1
dd0c86addb2630512bde277a5ea1a4b899b12cba

SHA256
24cfaf85623d1521caa7f3d2cd6dc2e9a004c7b8ae2e71c6cc04083b06221fd5

SHA512
3e619bfde1dc8523610dc3a54952fb0080f5bd06e04f4ef13d9a50c843f6269f93652a05b061619cc07b7e714cd646c76f61dc7dfe96fcec2685ff0081065065

Download Submit
/data/data/com.drnull.v5/files/profileInstalled

Filesize
24B

MD5
4b04c283b25fb9f2d557852fc79f3ba0

SHA1
f92a56508850839243b6a870d7cd2e1643b4feb1

SHA256
bb50ffe4ceee49e06fd7e5d5a93414995aab7dd8ea313a58978fc5f1bce3b63b

SHA512
015a29bb3e519987e4c744a2a5769ab045cd01afbca756bb948df26985cb3d9b845af37a2488b37b1940bcd2d83ebfce48a4add1719a05bf11cfbf4304c4feef

Download Submit
/data/data/com.drnull.v5/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
5c1275f21b69bf954d437038c8d1e66f

SHA1
1f29a47c4ddd256738607327e1091026068dddd7

SHA256
54baab9e3f28f8b17a37ecb0c139f90d5f5c33bdafd93b9612ff5385a0ed0a22

SHA512
e981284b531b67f2db13d06406b26a2963754135936964ad028f75611344357fba77c7679c59f8581039f342c92ec8722b634134e6c9f4126d7e54bbee2836dc

Download Submit
/data/misc/profiles/cur/0/com.drnull.v5/primary.prof

Filesize
1KB

MD5
622cb5612f87a316f2a3bed0eafae54e

SHA1
44ae60d1b0ca6942d37d3bcb662e0c24db451100

SHA256
e1526d6960592512b30665a13f4368b5b58a56c410cb7436844d0de9927a5982

SHA512
30766946d3708ec5cbb9a7d0300ca636f9614fb2de7313d07a577c57e17de7a4ff80e00e7a627ddc030df5c189f58d7a08b64af3f54a56d7e644781e84716709

Download Submit