c2ae7e4b476d790bdd9cc9f5419a3c8e656e6856576b003794556f99477c5b78

Analysis

max time kernel
136s
max time network
148s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10/04/2024, 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2ae7e4b476d790bdd9cc9f5419a3c8e656e6856576b003794556f99477c5b78.apk
Size

7.2MB
MD5

a6d84e54ead4dbfd7b19e4ccf2ed48bb
SHA1

4ef07236c8d15ab80314a06c8db8089965f32027
SHA256

c2ae7e4b476d790bdd9cc9f5419a3c8e656e6856576b003794556f99477c5b78
SHA512

fb69dac0f319738a4c0089aa4b397cfab0530d59b67b1cef0dfe5294d7861a91a1d2cb38bc775bf9a5356e483a2fc786ab571f0ab82f5a85b64dece18d591e34
SSDEEP

98304:7zxtYa68dX0z2JiXPBUFWBENyKHN8x/Fhl2/OItsrkmRN9Bi/xev7HPIe51PP6:7JQCJmc3NyKHN8XhwGvrdz2ubj1Py

Score

7^/10

collection discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/psyberia.alpinequest.full/cache/update.jar	4193	psyberia.alpinequest.full

Queries account information for other applications stored on the device. 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	psyberia.alpinequest.full

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	psyberia.alpinequest.full

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	psyberia.alpinequest.full

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	psyberia.alpinequest.full

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

psyberia.alpinequest.full
1⤵
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device.
- Reads the contacts stored on the device.
- Reads the content of the call log.
- Acquires the wake lock
PID:4193

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Protected User Data

T1636

Call Log

T1636.002

Contact List

T1636.003

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/psyberia.alpinequest.full/cache/update.jar

Filesize
22KB

MD5
a64593a3e771db1d3a6cbac217766b70

SHA1
8e54fa8c235506e739fa8cdf48bf09cf47e283a0

SHA256
995e2423a97da8402ee4acc89488a9ec8b585a222290b2f6ac8cee634ca3af21

SHA512
48191a9f6d6495543578c321bc5028e834d796b607d340605c832cc812299159343c1bee2efbe0c559202783894776e0787f43e235728005a03b4f2d0c666f88

Download Submit
/data/user/0/psyberia.alpinequest.full/cache/update.jar

Filesize
52KB

MD5
59b45d29e3f6e9ce3f1685c88040d4ae

SHA1
11597993b03e60cdba42ef38b3da856b14f00d7a

SHA256
9f4b3e839daffef5a34822d1317b6f6c1693aad70685017d023855042c90589b

SHA512
204629e3d64c037919b6dac8fe6284bea2feb8392840d6b0dd67f80059f58635a4aa67d693632a6f70cfb14401044cf24926fc912eb999fe4558ef952d2d4ede

Download Submit
/storage/emulated/0/Android/data/psyberia.alpinequest.full/files/1712757712632.test

Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit
/storage/emulated/0/Android/data/psyberia.alpinequest.full/files/datastore/maps/OSM.AQX.OSMOMSROADS.DAT

Filesize
1.3MB

MD5
80f33b3813568c8fc18cd3880f626217

SHA1
4dfcae4eba5b6f1246172c6e6e4e6e14cc087241

SHA256
efe46503ed7a3afb2528b5629835f2908f101c9475724139331f6b418a2c1005

SHA512
556dd4f13cb306191c28897897275d7347ca2165d0ad10bbed03673cfc0be7186619fd6bd1271b734aa2064f7126744d51ecc81b7eb4f5e856b4b1629aabed89

Download Submit
/storage/emulated/0/Android/data/psyberia.alpinequest.full/files/datastore/maps/OSM.AQX.OSMOMSROADS.IDX

Filesize
893B

MD5
f83db4db223045f151524c53b3e3337a

SHA1
472661cda01e01e554995697df9caf1eaa300446

SHA256
e82a3727eb6e11d42c345b9a8f25d57f8d5d47c2cd747ad24b53bd100b659b61

SHA512
29efce5df3ef393feca46816a40b5c75125147935cfcdf3c2aabdb9f1a3dbce407f4ae5dc6902e01f3259a90f5ebfd3b9928b9a110139035fa1a40c7b7e63d6e

Download Submit
/storage/emulated/0/Android/data/psyberia.alpinequest.full/files/datastore/maps/OSM.AQX.OSMOMSROADS.PREVIEW

Filesize
35KB

MD5
57bab1224f3de9327d2fe4c10afc3d43

SHA1
d7213b9a601611070ea954b563c255e2f01c752c

SHA256
19fc8914a00fede7749fa03298f7868b058cf2731dceea952a78cb3036c647f8

SHA512
391458af4427ac9132b6e141b30652c88d01f66a9f2bcdbf733fc475dd1a500ffa12351ced46738524dce7d311498ce99c4673a0e6a9b8779d722ef00aa7af3a

Download Submit
/storage/emulated/0/Android/data/psyberia.alpinequest.full/files/datastore/push_settings.conf

Filesize
267B

MD5
c81abce2e179d4d1a817d8b59e6106a5

SHA1
ea3762fabc9e43a352a70b649e60be5d41d193ec

SHA256
d19737e5066ae99a85fc080764cf7cb0127d06d26749a3e78dd9e9aa85c30274

SHA512
8aed8ddc372b21806f6239899762b5228f78b654c747e03c06c02f94990bd18e285c7f7480525c8eef93a9d95d0074c3553d12490724ba72c5e8609eeefad87d

Download Submit
/storage/emulated/0/Android/data/psyberia.alpinequest.full/files/datastore/push_settings.date

Filesize
8B

MD5
883cb8d1dbc10d92031f9e012286d371

SHA1
d09ab9fc3de2ace5b459958a04418bd63c2c206a

SHA256
87c45798b773e9625cc74263ccbdf4ddd6a59f44fb20f42ad270069b8686bd36

SHA512
f08d83b81b1837ce0917da6703e57b02dbae6672d022230a064ebe31c9c5d9ff9a9163c44e7543330733d5fe265927beae41f0d4e7ad0c420d9f9e5bef5b1dc6

Download Submit
/storage/emulated/0/Android/data/psyberia.alpinequest.full/files/logs/application.log

Filesize
2KB

MD5
eb623b25f5aa591b3e4b527bfe90654b

SHA1
d306fd1f7a50febcc04539bbab87ea798b1274e8

SHA256
2080fbc22d8c4d2480db24d016c8abb6ccb4a5c6b52a6a69fcb1bb8b92f1fb4d

SHA512
2f528a5d1cc34992d3fe3ec9c005cb3a04311cf3ba938856a1eb4e1e26036c2881642b23dc6a56254f8aed6ab7149b9b257adbcccf30ff6d29cd8d0671fce49c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads