b04ceb9e211acc72b2af0ab26e20e502ecde25e4be9a465ec77d16ca9da1bb32

Analysis

max time kernel
149s
max time network
156s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10-04-2024 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b04ceb9e211acc72b2af0ab26e20e502ecde25e4be9a465ec77d16ca9da1bb32.apk
Size

31.7MB
MD5

3c726b77585d359a5bbff08afd682971
SHA1

2fbdc11613a065afbbf36a66e8f17c0d802f8347
SHA256

b04ceb9e211acc72b2af0ab26e20e502ecde25e4be9a465ec77d16ca9da1bb32
SHA512

9a11f73c948877b6c6ac7471a2ab67829808629b07549f2a2ee83df0021a1e284fa98bf6bc9d64f8a0c32c9bd1cb0ba28db807992c055d316916f0df2a0c76e3
SSDEEP

786432:eyg3Em1Dt8TjhYsVsDU86F+VQ9IKlGG7JeoX0638:e7E68Tjh718+kXKGGdpx38

Score

7^/10

collection evasion persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

com.openvpn.secure

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.openvpn.secure
Reads the contacts stored on the device. 1 TTPs 1 IoCs
collection

T1636.003

Processes:

com.openvpn.secure

description ioc process

URI accessed for read content://com.android.contacts/contacts com.openvpn.secure
Reads the content of the call log. 1 TTPs 1 IoCs
collection

T1636.002

Processes:

com.openvpn.secure

description ioc process

URI accessed for read content://call_log/calls com.openvpn.secure

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.openvpn.secure

description	ioc	process
URI accessed for read	content://com.android.contacts/contacts	com.openvpn.secure

description	ioc	process
URI accessed for read	content://call_log/calls	com.openvpn.secure

com.openvpn.secure
1⤵
- Makes use of the framework's foreground persistence service
- Reads the contacts stored on the device.
- Reads the content of the call log.
PID:4286

com.openvpn.secure:openvpn
1⤵
PID:4360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.openvpn.secure/databases/MonDB
Filesize
140KB

MD5
2b074cb24d9d9bad872101d78d579b03

SHA1
d292fc0e6452b045165382037fd4f87116b120ed

SHA256
a04a4c2983e6ce01072dcd0dc2bf468743b433f5c9f300235ac2868efd8eeb91

SHA512
9cd2e0b44391bff1abc2c47e32b88bccdede598b91518561fd9e9b9a04543d9d3b0a1810b649e1a7b0c1e447aeddc54dacb0ba821ad12088ac98b2935a5e150a

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-journal
Filesize
512B

MD5
0c41cfce2b26073fe316365518a0bbdf

SHA1
a470220f495f979946799ed493891ff65ab471bb

SHA256
78fdfe2ea81f47dfb0d291011b00aae6566aeba1b783eed1a025e858db1eac74

SHA512
948964aea2c30dc93c951f40d6895623368ec382bfa8176dcbbeb6f4d076b24a67593c4fca9c9358fb2fc79f7ac98bf78b4a07c6502b360a401e30b90c82cdb1

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-wal
Filesize
152KB

MD5
273a792d3a904bf0f3f7eb353235a506

SHA1
f4f7c336958ab8e56d77352a4e381022e5381bce

SHA256
2939e4b26f210568488fb6a4993f118e746e1e397f8e1ff0073b80fd06a1ce4a

SHA512
bae394349cedb7fcd742f6c0d050feb66c01f291cbd3f583404ad8169fc6451bc9d317d30d9979eda44dd43f90f4d2a0ec7bbeff4ca01df06934a3d86e561dfb

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-wal
Filesize
410KB

MD5
40e60a386e88489f15d74d53e51282b9

SHA1
86c9f35f9f227985d724920cc2be46caf06f7351

SHA256
53efab5f7ff96d75be402b054a6fb53672c60f250e9784b5018a0bf177ede89b

SHA512
c90cb55f2ee077d46a0ef905324ffe0d6323268c2a782394dcd207d0e72773b0860639d79f3eab33bfbdf44b2b8cd7fc7def2486ff73788264d9f9f94eb7f3b9

Download Submit
/data/data/com.openvpn.secure/databases/MonDB-wal
Filesize
16KB

MD5
6ee55ccc00295ee9e4053fc855ba0a9c

SHA1
ae5b7e7c69677845b3b40680e8b0bb38594974a0

SHA256
3e3cb70a013c1682df4a7a542fb2a823f5b3724e610c875134558c4d3c7ef0e7

SHA512
d7b622d5885085db2326f25bf3a086f5764667178cb11583b082551e51f60c84d0bc9bedac45e8569a1df6bf2ea14ee17b00934a76a07af16641efa942ac7f6f

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-journal
Filesize
512B

MD5
61aef5f53db0acd240769d5501e66897

SHA1
ab49098373e985590e28e291a737a217d3e907f3

SHA256
dd99931048f87e73a82af06173d11680ef1c5286bc2054ed4b9e56ffbfc790e9

SHA512
71808a569a7d42fb13a323a0c9aa31e867620d036a2905eb7a1b4cddcee548caca341f84833aa2ff184a8011038a8fdcd15259b435a5189942f0ddf71d902efa

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-wal
Filesize
16KB

MD5
9e89d4ce54dd4a98dca304c5f7a173c5

SHA1
93f6f1df5d5b5b1ec6471505ccdf438933a01876

SHA256
851055119987b39baa44c7cc8945cd8f055a2de91e8bd9af6faf7b47f1a77865

SHA512
e752f42a60932f0ed73b624a82508d6cd678b8257a40611c19582354da0d7cccf11942b17fb6cc5dc66582db8b581bc033ed4537a481d6ace8a91c0a6855e01e

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-wal
Filesize
108KB

MD5
7796a3e1b473871e8992804363c0d2d2

SHA1
f87f231c9c0132761f3be12499a588da2908c9e8

SHA256
33276084a838c35d8b0f5b1c65481732f4e6f056b1db8b14c3f0605b47ecc294

SHA512
1d121eefcee3905257c5287fed0a0b4eac2be45a51e48915df390659e389d28134ce7a726b1bde452f1e973611c149dd8c81fe00b1e947bd0dbb03145e741780

Download Submit
/data/data/com.openvpn.secure/no_backup/androidx.work.workdb-wal
Filesize
189KB

MD5
eaf8dac079078b9832325115bc56144d

SHA1
76b785e1d90f752dd1ec990b700cd9c87b1b7b36

SHA256
02e0e0b8ed167f533a06e36d2d9563b5aac55e03027d4037a719e0088eb35b9e

SHA512
631f8eb3dbb67c33e2596d55f4a0dac0e91aebf204aa909b51a8731749fba0d8e2c18d44443ff3d5acb068607dbd027131e10fbbf6ee3f88e9f6c9d3965685ab

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads