b420db3dff4637f07caaa145b634106e4c2fc559ae1b4b692271cedbe21b62c8

Analysis

max time kernel
48s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10-04-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b420db3dff4637f07caaa145b634106e4c2fc559ae1b4b692271cedbe21b62c8.apk
Size

29.1MB
MD5

548674d18b82bc0d58a1b7722029a156
SHA1

c74b006badbb3844843609dd5811ab2cef16d63b
SHA256

b420db3dff4637f07caaa145b634106e4c2fc559ae1b4b692271cedbe21b62c8
SHA512

76fda6a5c9475a8d4a367649002f7875b9be434d3e28fd370a46e3b83d2aefd60ce24693bc1151dc4f8f18519e03f23cccf4e19c7366055aa803015b298a924a
SSDEEP

393216:z3J8b3SRZd1v3uFwCPwmSP8VbiaOhECW1Fypl+W9ESAHRDQ60/rBxqHoyvc2IGpI:+bKhE/cYxU6A/q3lq2sDIMe+1AppO

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

T1516

T1513

Processes:

com.secure.vpn

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.secure.vpn

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

com.secure.vpn

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.secure.vpn
Queries information about running processes on the device. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.secure.vpn

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.secure.vpn
Reads the contacts stored on the device. 1 TTPs 1 IoCs
collection

T1636.003

Processes:

com.secure.vpn

description ioc process

URI accessed for read content://com.android.contacts/contacts com.secure.vpn
Reads the content of the call log. 1 TTPs 1 IoCs
collection

T1636.002

Processes:

com.secure.vpn

description ioc process

URI accessed for read content://call_log/calls com.secure.vpn
Reads information about phone network operator. 1 TTPs
discovery

T1422
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.secure.vpn

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.secure.vpn

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.secure.vpn

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.secure.vpn

description	ioc	process
URI accessed for read	content://com.android.contacts/contacts	com.secure.vpn

description	ioc	process
URI accessed for read	content://call_log/calls	com.secure.vpn

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.secure.vpn

com.secure.vpn
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device.
- Reads the contacts stored on the device.
- Reads the content of the call log.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4157

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.secure.vpn/cache/rndseq
Filesize
48B

MD5
bc7ab4ba2c01aba2e4eff8b51edecb81

SHA1
2c39b57301a4d528dc9dc62f8ec9cce73b55cfa5

SHA256
882723b07c0a4fbf3b15cb892f6a69475bb9009afba2b0f3ddc325a7d348e005

SHA512
84b797d6b9305ada570f229ae58d4e14aa2e0bb08321d8356e3e5cbc53286f702264018b699286253438bd66363bdedf6f54cb513c6400022695153f2edd8e6b

Download Submit
/data/data/com.secure.vpn/databases/MonDB
Filesize
140KB

MD5
0e769dcc726912482552291ec822d204

SHA1
812711bc73aeedd9a7870c3f063c202a78f532a2

SHA256
396dc040da3642f6fa769baf5c0b431a1fbf75ff36b36e465d3633423ca6958f

SHA512
6596627b041922ba20c173e16d030612a5ef6cc140cfd62d3fea9b302d1aeb8930e199e08f8b54137f27ffa3ea38587cd7dbf0ea093d579cb5ffbbd64f594ebd

Download Submit
/data/data/com.secure.vpn/databases/MonDB-journal
Filesize
512B

MD5
803e4f6889089441d62dc7f1dfa347a4

SHA1
75453bd5e484bfed86c8084e54eb38db726f7ac7

SHA256
c311dee9263991f928198a16b5de258d3e6adaf24b871a9fb6d3bdf5c2f51fe2

SHA512
cb18a09bf0c4b1f4b665d319c58521935719a65c3daec590eb99c6a6389b8315efde2dd5252b9b63398fb5d92cb7d0270c6b8a1c34c0504e4a728edccdcc09f2

Download Submit
/data/data/com.secure.vpn/databases/MonDB-wal
Filesize
16KB

MD5
feda4d0beb52b7f664bd2afcc258a697

SHA1
7ad709eec1e2647b2781f24a3f63df78147145d9

SHA256
2b3cb0a4fda0a4c501e00c67da49febfc3980c325cb17ca59f324594571dffd3

SHA512
e877c0b7f7fb8c54a2d625edf163ce9d967e1a90b06f82afa48d393e71b7631265a060dd8192fc2335d33bf5bc547649ae3027b5fb6cc6f40226676bb4d78de1

Download Submit
/data/data/com.secure.vpn/databases/MonDB-wal
Filesize
152KB

MD5
46429cc000e867f9b3c3135819a9e446

SHA1
9d44e2f9a9ceb853fd3d59b28e76191af3960a00

SHA256
e78c9808b6a7fc601c487d28b2df7fb8c6fe8253e1a19d8246f2fc4d9dc7db8b

SHA512
6614b06b7c68307b331e8a6c13cd46374220e52bdd879d5588e51bf1de391d43f23a6752fde3f172644c61eaef5be6708d0e8776d8236e3ca1b30cfd453f4696

Download Submit
/data/data/com.secure.vpn/databases/MonDB-wal
Filesize
410KB

MD5
45e9a161c67cbac7e3ba230843d2e9b7

SHA1
e47137e577998ff7f8baec874041b0c72be90ed9

SHA256
72849111374303765ceef8d24a490a08094309796960cae5b3686362d2ce8fc2

SHA512
1fb35210de1b1342893c6ebbe01138590209c24fd77e09b8f02850f2b04570b89b41eb0992df2e9ee29f5540de7b81aa584986f17b805d6b43a2ccb68766222f

Download Submit
/data/data/com.secure.vpn/databases/anchorfree-ucr.db-journal
Filesize
512B

MD5
4df2bbdc5bbfc821a4c30ef3c99bfc0a

SHA1
a2af7d822d6d38e793aa93ad82eefa4e627247e7

SHA256
a41d335c01e47566c18f59f7fb570c2648f02b20ab375ee3872db5cedd98de38

SHA512
a5f5a564bb19ee450ea89c44702839f4b931dcb6f2330fdaa1d4cc6474a87c9036c29f0a9c9454e28358d859eb699b770be4b34643be7002c097109b2c45487e

Download Submit
/data/data/com.secure.vpn/databases/anchorfree-ucr.db-wal
Filesize
32KB

MD5
a590dbd1b6f318afe92eaa0423f9830c

SHA1
bb827cc95c88d0d3be3a7ade3c22c96090c04e79

SHA256
2955db917b8981fab3355f8dc4faf07e0d843b1eb1c8180bbf5db8da38031cc0

SHA512
bb5a10f2d08869676d50a1f7b5cd3afc39dd3db7e7c3083648b765cac60877647eb71ca4e64a03403dbbe3d899c6c1d4dd2f69460435ca83a50a7f87867fc665

Download Submit
/data/data/com.secure.vpn/databases/key_value_store.db
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.secure.vpn/databases/key_value_store.db-journal
Filesize
512B

MD5
e2c4d44a2f0ced28c58add59390b5bec

SHA1
7c3c4a0dadeb54ce923b1c87c29d6fe2fcb3a403

SHA256
916bf5867be81b14ee389c030d1e493073c110605120d65f5ead4ef994290017

SHA512
7dc8ce882083bea7521130f113325cb8193ee9b8605d4543d71f7c92a56b1ed42ab9a070e10741587923411f4279114ef33077bed3901fb7bcae03ee52968adc

Download Submit
/data/data/com.secure.vpn/databases/key_value_store.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.secure.vpn/databases/key_value_store.db-wal
Filesize
209KB

MD5
a90edd2b3d4a20b7f78b0a592db16ee4

SHA1
acc0bb3afd2b7472b9b189cf21b13549450c1481

SHA256
80b0de405f6a1236bfe422259165a88734bb49515c7cbd41c4153beedf3b4033

SHA512
131c55ca144a5e6595edeffeee551074fc5b0e5bd08178192424fcb70aab880053fd3a994d50a28a951f931b437a8bc02346a2bac00f86f19a752b088ce5a0f8

Download Submit
/data/data/com.secure.vpn/no_backup/androidx.work.workdb-journal
Filesize
512B

MD5
fbc178341c4401cf2afc7b7303562c95

SHA1
77cc88f0aa721bfac85c0e2d4c7d59aead1e7fcc

SHA256
35619c4b629d408acf11b573127c1e1d896d0cbcdc6cd4f3e72153a734d6c5e9

SHA512
6dbf599fa761b39444d3e1062e95d1644ed59d1528029b97dc9b8e3b3f4ec861ef818eec94d95383e7c43b2b79c1317ce56f541936d332325a56edd04ad60c19

Download Submit
/data/data/com.secure.vpn/no_backup/androidx.work.workdb-wal
Filesize
108KB

MD5
8f3bf0d624e8488efb443c900c83688b

SHA1
8418c715692a45aaa80ea12ebef252c85d313c1d

SHA256
d131214f194373be8faaa71a0f090c04e8415a87a6c72a1f345e19e45377ddc2

SHA512
b5258d0320f17eb579a6a11dd450f5f039a55cd67e2c4e36761accb93135d5e8bace0d0007edf59622270d89b92e0fd160afdcf2fcfe60872bba7da133e7c83f

Download Submit
/data/data/com.secure.vpn/no_backup/androidx.work.workdb-wal
Filesize
189KB

MD5
c31921630dd91787032e75a180c995b3

SHA1
d336132c6507892b75d621b92d08a9a5dce1d193

SHA256
55345215f376310e01a74bcbbd98fc04ec806bc3fc77f8fd9484dcb1ebfb0168

SHA512
be2ef27f1acdd1f4edf7640fd7b482d4406a6aad47b33cacb20504bfe71321dee7b0a56adb53207dd921c056435435af14fe323268411c84b486ff089f33684e

Download Submit
/data/data/com.secure.vpn/no_backup/androidx.work.workdb-wal
Filesize
16KB

MD5
56483bc4c00ec486cd2bc5e23de88900

SHA1
3d90433f20c814a2cf74265320652853be819cf3

SHA256
c0b68336a703f4dfb9c62f537cfdb3166370245219c1155870b59fd3d4900d78

SHA512
bd6b22de23ba3459720708c29d659b4aaff509eda6ff67dad2f49dd4046d6a5eb0aac7a31ea5ac37c47018910b21545bdce273b3eb2cd83c540e2222ef64663c

Download Submit