b65a8edc06bbeb598e495ccc44dc40e77ab2ef0ab11e136a0a10c24970640b42

Analysis

max time kernel
138s
max time network
145s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10-04-2024 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b65a8edc06bbeb598e495ccc44dc40e77ab2ef0ab11e136a0a10c24970640b42.apk
Size

31.7MB
MD5

20e66b734fa959145a8ef75d2e6cdffb
SHA1

3144b187edf4309263ff0bcfd02c6542704145b1
SHA256

b65a8edc06bbeb598e495ccc44dc40e77ab2ef0ab11e136a0a10c24970640b42
SHA512

903b6322d92c310162e0abc356bdc5daa40c57095655b653564d29c89bf8803e155885ecdfac4820687e86e4d0311badd7cc52cc9ca59ca6b4b55d88edd9177b
SSDEEP

786432:Gx3Em1OMtghYsVYzTKU86F+VQF9Fks7J5oX063p:GJEt8gh72Tl8+ko9Gsdax3p

Score

7^/10

collection evasion persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

Processes:

com.openvpn.secure

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.openvpn.secure

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

Processes:

com.openvpn.secure

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.openvpn.secure

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

Processes:

com.openvpn.secure

description	ioc	Process
URI accessed for read	content://call_log/calls	com.openvpn.secure

com.openvpn.secure
1⤵
- Makes use of the framework's foreground persistence service
- Reads the contacts stored on the device.
- Reads the content of the call log.
PID:4248

com.openvpn.secure:openvpn
1⤵
PID:4306

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

Call Log

T1636.002

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.openvpn.secure/databases/MonDB

Filesize
140KB

MD5
a32556b665f1840dc753439dcc8089b4

SHA1
39aa1eea124270e930b5f578be6fe4b9934a9601

SHA256
2875a36cd5b2a12d8533f35afff6d376a792356c1c73728e4cd00137453dc189

SHA512
c473b8a47aa19046f426d05500eb1788eddad218fbdac6c6cbddd1da916bbecadfd92caaf0edb2fb217447798413b17f1c16181220d065a73d3fc93f6b21bc04

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-journal

Filesize
512B

MD5
3c35aa24ece8aad8bf59be556290d316

SHA1
de60278f24c5121878ab2cca41eef64e0b229a81

SHA256
f01d0e346fd9a6f37e275734eba851fd29e9965143b5fba410f9a39bcf17fc0c

SHA512
63e14af57275f153704af06871b5ca9e900fa09c62d0d9b630d2a4196bb6b163dbfaff5da383769b103a58f077e021d815fa0c1ab22f39e223ea446854b9397a

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-wal

Filesize
152KB

MD5
2a3d2a7b09369588dbae9200341d3ce9

SHA1
3a8ae569a69babead9af7d0d41c152b94d2d5241

SHA256
5fd1032ba2a01070a0cc70450dd3327327aa03d5c2d2a2e7af54818dda637f22

SHA512
3e1f2866b5429d4d79de4b35d06b01469a4e29076e5ef10c0a7c986152b33cf0c101b70d10233b2f41eb366bcf24368e805c52e992448b32c8024267237805b4

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-wal

Filesize
410KB

MD5
8672361bdb53cf3d1fb03fce980969b1

SHA1
2c35a753646f033ed713e5fa671a10d4a12ad8b5

SHA256
59b117d313e96cf40dc96233958fa051380b360ca11ef8699c9468ce7bc3fba7

SHA512
7b007abee8b4bd836b5e8066f8f811b21f8a03873e3d7008bdde4678d1e332ca402caeb96b7e1c23afa8ed8175a739635cc21d3cce1ee008d7fa76e7e6bb8937

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-wal

Filesize
16KB

MD5
0285c37ac32aac6731c10572f3f7901f

SHA1
9ae9dd74b2a7f227c97b4ad64bf4c3a578a2f4b3

SHA256
32e74a1beb719974a2e30a1c9f89744f7079c2aee2ee161f7b53d7313fd524e7

SHA512
85bf0af963a7e38db42570f9f7226cfbdcaa6e7f5f05bb7b2bca6a5b935cae3ab8104ab2d42b2c4bdc15a5ec812962a7251e71dad6e2e4ba06c4cf6e10a97b70

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
2ee9da66e07685f879a151e489d8a3d0

SHA1
f4d035396f15e462e2b10a120c0e1b42af9baf1c

SHA256
bc591a31b20e34978aaf4bdd36a1c129dbf0eda8d8ed47f080803810db4234b5

SHA512
fdc92dc21be4d836cd70b4fa48154a8c139a390bcc5fc98c9df0bbe49c3cd65aae43c9fe81a1e8f80b3de5a2fe021e13b68ffba4e2b200893b46ac7ff98c65af

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
5802f6f132fc1341943b42340e9cbc04

SHA1
3847e5b1c8e42b0e31b90ba4f75acd2fc06745c8

SHA256
a643eda4ffae4443bdd4b00d5c2e4dbc379108beb9b1bdd1a62d99bb971ec2d2

SHA512
33dfb48069838844363e468e3c9e5ce1396fffc044cd5d8b7080c3ff4357948b30a329b1b25738124ea395814421d90bf45e7473e95b91c626c5b4a2e76bff60

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
5077e48365d6032e7954fd05fb89a73a

SHA1
514214a87684c5ed385086543bb9d74b0b2910e5

SHA256
2473461b4603a0601d3835b63624bad232da772471f54595788c0aeecff623eb

SHA512
eec2f6746f0327d34895493759b6925a19914e7ea8584bcb5c1f804e8cefb291d65e42d4bdf50a5d2b0eaaf84b334277d95ce01d5f0b830554fc9057fc1df7d4

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-wal

Filesize
189KB

MD5
3514960afb3d630e035b05515efba66e

SHA1
b3a6bf7fd5ae961eab1161cd6510831e3d656b88

SHA256
66b1f79ed740b48c2a58bfd44c024a53c67a04e7254bc6733433c155e78b9b54

SHA512
e2ebd0d070a60f455ef707342b8008c8ab6a18fa6c3edceea16fe10a26285447e3dea1db2c65cc4967c5798e30da1347666fbb427a7572b62f8fed3b4a56fa1e

Download Submit