b420db3dff4637f07caaa145b634106e4c2fc559ae1b4b692271cedbe21b62c8

Analysis

max time kernel
48s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10-04-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b420db3dff4637f07caaa145b634106e4c2fc559ae1b4b692271cedbe21b62c8.apk
Size

29.1MB
MD5

548674d18b82bc0d58a1b7722029a156
SHA1

c74b006badbb3844843609dd5811ab2cef16d63b
SHA256

b420db3dff4637f07caaa145b634106e4c2fc559ae1b4b692271cedbe21b62c8
SHA512

76fda6a5c9475a8d4a367649002f7875b9be434d3e28fd370a46e3b83d2aefd60ce24693bc1151dc4f8f18519e03f23cccf4e19c7366055aa803015b298a924a
SSDEEP

393216:z3J8b3SRZd1v3uFwCPwmSP8VbiaOhECW1Fypl+W9ESAHRDQ60/rBxqHoyvc2IGpI:+bKhE/cYxU6A/q3lq2sDIMe+1AppO

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.secure.vpn

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.secure.vpn

Queries information about running processes on the device. 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.secure.vpn

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.secure.vpn

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	com.secure.vpn

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.secure.vpn

com.secure.vpn
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device.
- Reads the contacts stored on the device.
- Reads the content of the call log.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4157

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Protected User Data

T1636

Call Log

T1636.002

Contact List

T1636.003

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.secure.vpn/cache/rndseq

Filesize
48B

MD5
bc7ab4ba2c01aba2e4eff8b51edecb81

SHA1
2c39b57301a4d528dc9dc62f8ec9cce73b55cfa5

SHA256
882723b07c0a4fbf3b15cb892f6a69475bb9009afba2b0f3ddc325a7d348e005

SHA512
84b797d6b9305ada570f229ae58d4e14aa2e0bb08321d8356e3e5cbc53286f702264018b699286253438bd66363bdedf6f54cb513c6400022695153f2edd8e6b

Download Submit
/data/data/com.secure.vpn/databases/MonDB

Filesize
140KB

MD5
0e769dcc726912482552291ec822d204

SHA1
812711bc73aeedd9a7870c3f063c202a78f532a2

SHA256
396dc040da3642f6fa769baf5c0b431a1fbf75ff36b36e465d3633423ca6958f

SHA512
6596627b041922ba20c173e16d030612a5ef6cc140cfd62d3fea9b302d1aeb8930e199e08f8b54137f27ffa3ea38587cd7dbf0ea093d579cb5ffbbd64f594ebd

Download Submit
/data/data/com.secure.vpn/databases/MonDB-journal

Filesize
512B

MD5
803e4f6889089441d62dc7f1dfa347a4

SHA1
75453bd5e484bfed86c8084e54eb38db726f7ac7

SHA256
c311dee9263991f928198a16b5de258d3e6adaf24b871a9fb6d3bdf5c2f51fe2

SHA512
cb18a09bf0c4b1f4b665d319c58521935719a65c3daec590eb99c6a6389b8315efde2dd5252b9b63398fb5d92cb7d0270c6b8a1c34c0504e4a728edccdcc09f2

Download Submit
/data/data/com.secure.vpn/databases/MonDB-wal

Filesize
16KB

MD5
feda4d0beb52b7f664bd2afcc258a697

SHA1
7ad709eec1e2647b2781f24a3f63df78147145d9

SHA256
2b3cb0a4fda0a4c501e00c67da49febfc3980c325cb17ca59f324594571dffd3

SHA512
e877c0b7f7fb8c54a2d625edf163ce9d967e1a90b06f82afa48d393e71b7631265a060dd8192fc2335d33bf5bc547649ae3027b5fb6cc6f40226676bb4d78de1

Download Submit
/data/data/com.secure.vpn/databases/MonDB-wal

Filesize
152KB

MD5
46429cc000e867f9b3c3135819a9e446

SHA1
9d44e2f9a9ceb853fd3d59b28e76191af3960a00

SHA256
e78c9808b6a7fc601c487d28b2df7fb8c6fe8253e1a19d8246f2fc4d9dc7db8b

SHA512
6614b06b7c68307b331e8a6c13cd46374220e52bdd879d5588e51bf1de391d43f23a6752fde3f172644c61eaef5be6708d0e8776d8236e3ca1b30cfd453f4696

Download Submit
/data/data/com.secure.vpn/databases/MonDB-wal

Filesize
410KB

MD5
45e9a161c67cbac7e3ba230843d2e9b7

SHA1
e47137e577998ff7f8baec874041b0c72be90ed9

SHA256
72849111374303765ceef8d24a490a08094309796960cae5b3686362d2ce8fc2

SHA512
1fb35210de1b1342893c6ebbe01138590209c24fd77e09b8f02850f2b04570b89b41eb0992df2e9ee29f5540de7b81aa584986f17b805d6b43a2ccb68766222f

Download Submit
/data/data/com.secure.vpn/databases/anchorfree-ucr.db-journal

Filesize
512B

MD5
4df2bbdc5bbfc821a4c30ef3c99bfc0a

SHA1
a2af7d822d6d38e793aa93ad82eefa4e627247e7

SHA256
a41d335c01e47566c18f59f7fb570c2648f02b20ab375ee3872db5cedd98de38

SHA512
a5f5a564bb19ee450ea89c44702839f4b931dcb6f2330fdaa1d4cc6474a87c9036c29f0a9c9454e28358d859eb699b770be4b34643be7002c097109b2c45487e

Download Submit
/data/data/com.secure.vpn/databases/anchorfree-ucr.db-wal

Filesize
32KB

MD5
a590dbd1b6f318afe92eaa0423f9830c

SHA1
bb827cc95c88d0d3be3a7ade3c22c96090c04e79

SHA256
2955db917b8981fab3355f8dc4faf07e0d843b1eb1c8180bbf5db8da38031cc0

SHA512
bb5a10f2d08869676d50a1f7b5cd3afc39dd3db7e7c3083648b765cac60877647eb71ca4e64a03403dbbe3d899c6c1d4dd2f69460435ca83a50a7f87867fc665

Download Submit
/data/data/com.secure.vpn/databases/key_value_store.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.secure.vpn/databases/key_value_store.db-journal

Filesize
512B

MD5
e2c4d44a2f0ced28c58add59390b5bec

SHA1
7c3c4a0dadeb54ce923b1c87c29d6fe2fcb3a403

SHA256
916bf5867be81b14ee389c030d1e493073c110605120d65f5ead4ef994290017

SHA512
7dc8ce882083bea7521130f113325cb8193ee9b8605d4543d71f7c92a56b1ed42ab9a070e10741587923411f4279114ef33077bed3901fb7bcae03ee52968adc

Download Submit
/data/data/com.secure.vpn/databases/key_value_store.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.secure.vpn/databases/key_value_store.db-wal

Filesize
209KB

MD5
a90edd2b3d4a20b7f78b0a592db16ee4

SHA1
acc0bb3afd2b7472b9b189cf21b13549450c1481

SHA256
80b0de405f6a1236bfe422259165a88734bb49515c7cbd41c4153beedf3b4033

SHA512
131c55ca144a5e6595edeffeee551074fc5b0e5bd08178192424fcb70aab880053fd3a994d50a28a951f931b437a8bc02346a2bac00f86f19a752b088ce5a0f8

Download Submit
/data/data/com.secure.vpn/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
fbc178341c4401cf2afc7b7303562c95

SHA1
77cc88f0aa721bfac85c0e2d4c7d59aead1e7fcc

SHA256
35619c4b629d408acf11b573127c1e1d896d0cbcdc6cd4f3e72153a734d6c5e9

SHA512
6dbf599fa761b39444d3e1062e95d1644ed59d1528029b97dc9b8e3b3f4ec861ef818eec94d95383e7c43b2b79c1317ce56f541936d332325a56edd04ad60c19

Download Submit
/data/data/com.secure.vpn/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
8f3bf0d624e8488efb443c900c83688b

SHA1
8418c715692a45aaa80ea12ebef252c85d313c1d

SHA256
d131214f194373be8faaa71a0f090c04e8415a87a6c72a1f345e19e45377ddc2

SHA512
b5258d0320f17eb579a6a11dd450f5f039a55cd67e2c4e36761accb93135d5e8bace0d0007edf59622270d89b92e0fd160afdcf2fcfe60872bba7da133e7c83f

Download Submit
/data/data/com.secure.vpn/no_backup/androidx.work.workdb-wal

Filesize
189KB

MD5
c31921630dd91787032e75a180c995b3

SHA1
d336132c6507892b75d621b92d08a9a5dce1d193

SHA256
55345215f376310e01a74bcbbd98fc04ec806bc3fc77f8fd9484dcb1ebfb0168

SHA512
be2ef27f1acdd1f4edf7640fd7b482d4406a6aad47b33cacb20504bfe71321dee7b0a56adb53207dd921c056435435af14fe323268411c84b486ff089f33684e

Download Submit
/data/data/com.secure.vpn/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
56483bc4c00ec486cd2bc5e23de88900

SHA1
3d90433f20c814a2cf74265320652853be819cf3

SHA256
c0b68336a703f4dfb9c62f537cfdb3166370245219c1155870b59fd3d4900d78

SHA512
bd6b22de23ba3459720708c29d659b4aaff509eda6ff67dad2f49dd4046d6a5eb0aac7a31ea5ac37c47018910b21545bdce273b3eb2cd83c540e2222ef64663c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads