a549718fdd2441073a0158988b32b17f58ecf66cd15720618d9a75e786aa776c

Analysis

max time kernel
6s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
11-04-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a549718fdd2441073a0158988b32b17f58ecf66cd15720618d9a75e786aa776c.apk
Size

3.5MB
MD5

7c756b3b970e0e9101a0d27136c204ff
SHA1

fa625264cb6ca1d8737db2d89410370a249345ea
SHA256

a549718fdd2441073a0158988b32b17f58ecf66cd15720618d9a75e786aa776c
SHA512

3a99d86043751fedf717ee83c316d43549ea059cdc80554f80a8be9d07297120f9eaa6b6913a084342b2a68adbc5c38f904119e1820854d9a93ab1bac49250f7
SSDEEP

98304:w1+hKSo6QcUiaDToTwr5LNb83myQ8OL5w8Q4iJ3uby:w1WKSo6qigl82O8kCy

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.drnull.v5

description	ioc	Process
File opened for read	/proc/meminfo	com.drnull.v5

Acquires the wake lock 1 IoCs

Processes:

com.drnull.v5

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.drnull.v5

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Checks memory information
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4178

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
24eff0826ab7a337aa8e0c7f056be217

SHA1
7b268e49597b7df73f3e67067da07ce800675470

SHA256
c5ecbebfc107b6750dcc902b43b100eb8e4a8ec301853e686576075dae525c34

SHA512
3c108c5573db313f1431d297cca4054456d44ff739e467d42d34bdc071e89dc60f85d2629fccc811f59d8d690f37004735d0fdbb3aba8da843cb70a3fba364f5

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
eace792ff3008db9dc0114132b15c69f

SHA1
883313db71a8e4b2f1b9f3bca9fa8ed0829ca636

SHA256
1a2387e15a0741ff66c6c4eef633a4debda38cec0d967b3e3a66f42aaa611576

SHA512
f4137ca975d16a9d3aaa8ed8474718fe273686757de4a98cef3ace8fd71ae921e74043e807027fa0250ba3c8d406ade95ea2ca6804f45d39018232e04c8b6952

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation7226458472650782247tmp

Filesize
90B

MD5
2a71c8e2c591ab250606a2f9aecf1f54

SHA1
e9ae326aeccd34372f656e1867b9e717ab20bc9e

SHA256
058f4641c2863b947956ac19e97220e82f0aeabae66de68685a4b3cdbc8f32a1

SHA512
f48f92d68cc6dde2b2143da3a79b32c39e1ce19cb6b784bea7c15982766e1cd68738502c13c66e619362030b56d38babcdac3aa75c08a1cf79afd3e25da76219

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation839431202321671179tmp

Filesize
566B

MD5
42b347ec98232629f0cfcfce994c6cb1

SHA1
cfcc9389e4365066c791ab39488de6289279ea67

SHA256
5b064f800b8fdb49c5c0c3d7e7112e8d9b4d6cf212f8f939478fa9bc23cf7587

SHA512
608ca3ebbf25dc2784954fd69bbd47708f54159ecdf4e21ae66f30a645149e1befeef00a2f63e3eac18f07b3c8e529efbe4e012fd3837a5c31bbceee25729802

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
431d9ff3c8721cd31d9764c5c58a374c

SHA1
56023470ac6fdca058e93a7b71cb9f7df8dcd0e0

SHA256
9f9976dedbb21afd5880ff66df5a493abbfccd14c872120683ea2b19c8914d07

SHA512
6069bcfb88438e49ba8ffa3e481786525ebe195e4d998f9105a208b5a100b5d5098b02f26436b7251f236a8d47c023d8ce430ffb0f8accaf73daf9c413ce2539

Download Submit