5a1c6c2a07a4748b6327b9eb97031d1a77d2ba701956166c3221b7fa0cc05bbf

Analysis

max time kernel
6s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
11-04-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a1c6c2a07a4748b6327b9eb97031d1a77d2ba701956166c3221b7fa0cc05bbf.apk
Size

3.5MB
MD5

c6306ae2dee43b0c00e2528838370d08
SHA1

7afbcce6c7f9867f1f0e0451175f2817aa61fe85
SHA256

5a1c6c2a07a4748b6327b9eb97031d1a77d2ba701956166c3221b7fa0cc05bbf
SHA512

50b131620fa119920483a3388923bd7462cd3900a5b93bd223540872594faa602b156da15c0e81f1aa4640016e5cbc142826fdbfe3e6dc7c6fea212e8279934e
SSDEEP

98304:kFgcJvDLkRCQDtToTwr5LvkCR8SdtYqoEDYO52Ik2k:kFdJbLkc68CSsDW

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.drnull.v5

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Checks memory information
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4677

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
56KB

MD5
5f0179504349c5edaa4b6dbff614c8c7

SHA1
bdd53cb199fac9d2405c79ba3fc3a91c60089e93

SHA256
b35fb56402466dced7a68eb0b3cb7a8c65bffa5030c0be7d8c5f7aa2614675d1

SHA512
1a26421efa5748bbed8864040d5eb111c951e7ddfa71ff50bafb8527b2a9b5ae51289d37e20d81495f55371b8da828e3324d3fed386ac07cf6e480ac263b88d0

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
9dd04971bb4af00effe95059708b37e6

SHA1
2986579d2829d2e218a8b8754d1966e5a5892d17

SHA256
97394ab6df38f3c4a702e3dda9d5a74070df78368362197235e6daca40039c99

SHA512
9f2528e48eefc4262d4c13236f174a09a760ab4fd1ecee64cc45a49894e36c4b2b90b5a6bfb8e13459fc8bf687b7ec2e50c92397a1e0802c3bfeefb7b37a288f

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
04fde151f165a8fc68cb607314a1e611

SHA1
b3cf526d8a171b4e6aea54c147f251d834d3f288

SHA256
bc06a5273ad74048e8a2d439a5e2f40e6abc4f67809d442ec4e1503914956520

SHA512
3dd6382aca378fc89d50432287f3b1833d9df18a07c9affe864f3eae78274c224552aababd787275b6b45221a40a19a0b921bc751ab5aa5c82d0c1a14994deac

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
5bd7e01ab5bff55c13dab9ef094bab02

SHA1
6ebb57c4603ed453f690ad11ccb0bcef3eb0fe3b

SHA256
7100af034d190494c4006a1c92e783a633dc9aaeaa4697809e8b8cdb799f1a7d

SHA512
5a3751d8cec65600171941720d55852984edd4230b3d9c611d17f6d067f213d3d38f6c1c560c15a33fe883878350b2fb6c0ab330820d28a9db35f448ed3d3ab4

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation1008487815963184460tmp

Filesize
569B

MD5
680607a4f5ea37b8ddc9249129d12a90

SHA1
fdb63fb2b622180ce37dd9f67c51645bd33dcdc9

SHA256
68d5d6df9ba49ec79c5e2c2bce43d67003f6e11757efff73b218b56fae03fe50

SHA512
23727b33ff135f7dd34d1342e03fbfef59e5ee80d4ff51be3c51bf4e0f780e952edc67721f4e2678791ef36df753dc5c9cd1e721ef7fdc709be5662311e0a06f

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation2450355862336343699tmp

Filesize
90B

MD5
857065fa6a07a07569fd8a1cc7f99665

SHA1
4b3c4cc2211e1a8d345d56ada5b081f4673903e3

SHA256
e3cdd293b8748786d76f25012877f4376914b87a995b7420d7b1e3c6136b48cd

SHA512
9fa269b6cb82281daeb48e4e9d7312dc553781597da6b977431302ee29178bcbb1878334b1b0acc8ffdc5cce3c4208197e9ac3251a22984e73b9668825c3db5e

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
2c1c9a1dcd3070c6f32741c0ec9e18c4

SHA1
1dd4974afd82c7c39b881bd0337da77da2f4d1c5

SHA256
9a0dba7a774cbb9a7c54988b4537541056fb08fa0442e15ed35c95c871d71cc4

SHA512
ff198e84dccbe2717c78101134bd5214a6a4bf5bb117999167882f386e08bec537d06217ff42c1298bb33fe7f45e47ca7b4b7bf51b6b2a4095e84463fe3b3e93

Download Submit