b65a8edc06bbeb598e495ccc44dc40e77ab2ef0ab11e136a0a10c24970640b42

Analysis

max time kernel
138s
max time network
145s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10-04-2024 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b65a8edc06bbeb598e495ccc44dc40e77ab2ef0ab11e136a0a10c24970640b42.apk
Size

31.7MB
MD5

20e66b734fa959145a8ef75d2e6cdffb
SHA1

3144b187edf4309263ff0bcfd02c6542704145b1
SHA256

b65a8edc06bbeb598e495ccc44dc40e77ab2ef0ab11e136a0a10c24970640b42
SHA512

903b6322d92c310162e0abc356bdc5daa40c57095655b653564d29c89bf8803e155885ecdfac4820687e86e4d0311badd7cc52cc9ca59ca6b4b55d88edd9177b
SSDEEP

786432:Gx3Em1OMtghYsVYzTKU86F+VQF9Fks7J5oX063p:GJEt8gh72Tl8+ko9Gsdax3p

Score

7^/10

collection evasion persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

com.openvpn.secure

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.openvpn.secure
Reads the contacts stored on the device. 1 TTPs 1 IoCs
collection

T1636.003

Processes:

com.openvpn.secure

description ioc process

URI accessed for read content://com.android.contacts/contacts com.openvpn.secure
Reads the content of the call log. 1 TTPs 1 IoCs
collection

T1636.002

Processes:

com.openvpn.secure

description ioc process

URI accessed for read content://call_log/calls com.openvpn.secure

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.openvpn.secure

description	ioc	process
URI accessed for read	content://com.android.contacts/contacts	com.openvpn.secure

description	ioc	process
URI accessed for read	content://call_log/calls	com.openvpn.secure

com.openvpn.secure
1⤵
- Makes use of the framework's foreground persistence service
- Reads the contacts stored on the device.
- Reads the content of the call log.
PID:4248

com.openvpn.secure:openvpn
1⤵
PID:4306

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.openvpn.secure/databases/MonDB
Filesize
140KB

MD5
a32556b665f1840dc753439dcc8089b4

SHA1
39aa1eea124270e930b5f578be6fe4b9934a9601

SHA256
2875a36cd5b2a12d8533f35afff6d376a792356c1c73728e4cd00137453dc189

SHA512
c473b8a47aa19046f426d05500eb1788eddad218fbdac6c6cbddd1da916bbecadfd92caaf0edb2fb217447798413b17f1c16181220d065a73d3fc93f6b21bc04

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-journal
Filesize
512B

MD5
3c35aa24ece8aad8bf59be556290d316

SHA1
de60278f24c5121878ab2cca41eef64e0b229a81

SHA256
f01d0e346fd9a6f37e275734eba851fd29e9965143b5fba410f9a39bcf17fc0c

SHA512
63e14af57275f153704af06871b5ca9e900fa09c62d0d9b630d2a4196bb6b163dbfaff5da383769b103a58f077e021d815fa0c1ab22f39e223ea446854b9397a

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-wal
Filesize
152KB

MD5
2a3d2a7b09369588dbae9200341d3ce9

SHA1
3a8ae569a69babead9af7d0d41c152b94d2d5241

SHA256
5fd1032ba2a01070a0cc70450dd3327327aa03d5c2d2a2e7af54818dda637f22

SHA512
3e1f2866b5429d4d79de4b35d06b01469a4e29076e5ef10c0a7c986152b33cf0c101b70d10233b2f41eb366bcf24368e805c52e992448b32c8024267237805b4

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-wal
Filesize
410KB

MD5
8672361bdb53cf3d1fb03fce980969b1

SHA1
2c35a753646f033ed713e5fa671a10d4a12ad8b5

SHA256
59b117d313e96cf40dc96233958fa051380b360ca11ef8699c9468ce7bc3fba7

SHA512
7b007abee8b4bd836b5e8066f8f811b21f8a03873e3d7008bdde4678d1e332ca402caeb96b7e1c23afa8ed8175a739635cc21d3cce1ee008d7fa76e7e6bb8937

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-wal
Filesize
16KB

MD5
0285c37ac32aac6731c10572f3f7901f

SHA1
9ae9dd74b2a7f227c97b4ad64bf4c3a578a2f4b3

SHA256
32e74a1beb719974a2e30a1c9f89744f7079c2aee2ee161f7b53d7313fd524e7

SHA512
85bf0af963a7e38db42570f9f7226cfbdcaa6e7f5f05bb7b2bca6a5b935cae3ab8104ab2d42b2c4bdc15a5ec812962a7251e71dad6e2e4ba06c4cf6e10a97b70

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-journal
Filesize
512B

MD5
2ee9da66e07685f879a151e489d8a3d0

SHA1
f4d035396f15e462e2b10a120c0e1b42af9baf1c

SHA256
bc591a31b20e34978aaf4bdd36a1c129dbf0eda8d8ed47f080803810db4234b5

SHA512
fdc92dc21be4d836cd70b4fa48154a8c139a390bcc5fc98c9df0bbe49c3cd65aae43c9fe81a1e8f80b3de5a2fe021e13b68ffba4e2b200893b46ac7ff98c65af

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-wal
Filesize
16KB

MD5
5802f6f132fc1341943b42340e9cbc04

SHA1
3847e5b1c8e42b0e31b90ba4f75acd2fc06745c8

SHA256
a643eda4ffae4443bdd4b00d5c2e4dbc379108beb9b1bdd1a62d99bb971ec2d2

SHA512
33dfb48069838844363e468e3c9e5ce1396fffc044cd5d8b7080c3ff4357948b30a329b1b25738124ea395814421d90bf45e7473e95b91c626c5b4a2e76bff60

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-wal
Filesize
108KB

MD5
5077e48365d6032e7954fd05fb89a73a

SHA1
514214a87684c5ed385086543bb9d74b0b2910e5

SHA256
2473461b4603a0601d3835b63624bad232da772471f54595788c0aeecff623eb

SHA512
eec2f6746f0327d34895493759b6925a19914e7ea8584bcb5c1f804e8cefb291d65e42d4bdf50a5d2b0eaaf84b334277d95ce01d5f0b830554fc9057fc1df7d4

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-wal
Filesize
189KB

MD5
3514960afb3d630e035b05515efba66e

SHA1
b3a6bf7fd5ae961eab1161cd6510831e3d656b88

SHA256
66b1f79ed740b48c2a58bfd44c024a53c67a04e7254bc6733433c155e78b9b54

SHA512
e2ebd0d070a60f455ef707342b8008c8ab6a18fa6c3edceea16fe10a26285447e3dea1db2c65cc4967c5798e30da1347666fbb427a7572b62f8fed3b4a56fa1e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads