5a1c6c2a07a4748b6327b9eb97031d1a77d2ba701956166c3221b7fa0cc05bbf

Analysis

max time kernel
5s
max time network
136s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
11-04-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a1c6c2a07a4748b6327b9eb97031d1a77d2ba701956166c3221b7fa0cc05bbf.apk
Size

3.5MB
MD5

c6306ae2dee43b0c00e2528838370d08
SHA1

7afbcce6c7f9867f1f0e0451175f2817aa61fe85
SHA256

5a1c6c2a07a4748b6327b9eb97031d1a77d2ba701956166c3221b7fa0cc05bbf
SHA512

50b131620fa119920483a3388923bd7462cd3900a5b93bd223540872594faa602b156da15c0e81f1aa4640016e5cbc142826fdbfe3e6dc7c6fea212e8279934e
SSDEEP

98304:kFgcJvDLkRCQDtToTwr5LvkCR8SdtYqoEDYO52Ik2k:kFdJbLkc68CSsDW

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.drnull.v5

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Checks memory information
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4266

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
ca68fa00ba1ea8ada79fe1be17f71d98

SHA1
bb473495997e6485eda8756f2807c8a4409283d3

SHA256
e27c6d0cf217cbc48652d058d80284094d601c149de9fa2fa1e646649bf5c135

SHA512
91854d47f19d19581552f4eac7eda78943cfceb306c8c23f662ed041bbdbf8ad0ac5f740d17fc91df0b6d166eca7a5f64b9d17d9f29621f43373bf206ca0cd9a

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
2b7d95ee98071b61309362ee174c7dae

SHA1
d2e19ef7f4db824279469ee0435cad9fd6d7e43a

SHA256
6bfee51db2b913f2cf9f3a617b88a7c824d9660e1c9e3b9d825e262bbe86d99c

SHA512
bb7d2da953bb464968c3f787a4d6dbe587f8d950110015df5c6cbe6c4b3aefaf368c692e0fc06678d14c64afd32a86b377eb4a69c34c18f3594842267dc21dba

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation3888016892211727606tmp

Filesize
90B

MD5
2b79261fa9f5cc182cfc546333c2bc32

SHA1
33cd4392d01d3bf141511899e1549276dd3a2622

SHA256
e472311b198c4bd82b8af236fe21a1fcf138cbf7b7c300a97735669d80e8823f

SHA512
a5701c05193d885ef9cf339e2b56eeddfd8e30cdcc220f5f87fc704bebe077b55da9f32aa78381e0629f3d36a0cd315d64eec88ccdcf0d5508595855bbe96438

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation8148019178094949247tmp

Filesize
570B

MD5
6412411978a9310cd4c7a032ed21b1b4

SHA1
a39e322f2afdfdcee34ffca83b95e0a6b95af06e

SHA256
519d8171f10e5a2a88ea1106e4083509283df3d34d1ebab593645a9a5b47ee5a

SHA512
8d04d54d861a3abe1f31f70e2441a8b1e0bd00f2522f005d65108917605363ee454f1ddcd0c792ce7d386ca20098111184f315c46fc1ad1b8dd811c3869f8b1b

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
b2b1e7d7ae18bcd4ff7577797876dfc8

SHA1
aa744283bdc3841848f1221f40f8bae476acc6c1

SHA256
9adfbe7f2d312f903fedc11be179108ea3acf758b01114ff4c47ec67186cdcd1

SHA512
257e8fd7be3f57ff38c17ee838f343feb7ccb2c2bb1c815887ce321de8887aa61be13ca24f18bc0012ba13b2cfe80ae9f3d3f7fd6cc28c0032b102b69ab45dcb

Download Submit