330145c5ceefe7f2986df4ec470fb66ab890630f0893b548767f3bf36bb50ba6

Analysis

max time kernel
6s
max time network
157s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
11-04-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

330145c5ceefe7f2986df4ec470fb66ab890630f0893b548767f3bf36bb50ba6.apk
Size

3.4MB
MD5

a7073c9f1920fe8695d7d77fe62f2def
SHA1

ea0f741f81bb541e826a29038ef89c3fecd5c912
SHA256

330145c5ceefe7f2986df4ec470fb66ab890630f0893b548767f3bf36bb50ba6
SHA512

1f893dc2f8c5bcebb5218c9eb7fc8449e32a0a0bfa8e8f82683840fd81f86126216949abd869ded9693323adf638b7766952baa5c07573ad29101119872307b4
SSDEEP

98304:CVmSwX4OToTwr5j/X5wzPceJSetDFbA/P:C8zxwBSQF0/P

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.drnull.v5

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Checks memory information
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4181

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
79e7a52d55efd6ee9db0295ef9cd31dc

SHA1
812e1b18a2d0bbe96a3726ea5f392322a76796b4

SHA256
f5d1a0842dbd6b1bd57944c892913d1435d66230c69fe5d450f8efcc96e49a46

SHA512
8d35aeab5b691f1383ce12bbe70f074a1cd1e5977f5e54297c6d317db1ccc886fd530200f80b0ef1648ed7160e6236a70873eb7065098cc4a2ce509cbb122711

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
4ad390cd12890fa5fba73df7bcfb337e

SHA1
61393bf711a42a732ce6bcc087c732e5b8e795d1

SHA256
ac163ef24b0b99d1643692d0eb96a699914f64f73dfcf2601601be60dfaf8fa8

SHA512
604cc5216ca66f573e921f874b8ba6e59181040f91e417e57388901c38ffe468bb1db8342db98448ddef9ce83f8556b94e11b09760f08de8ada11d47dda9534b

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation4465513773068810898tmp

Filesize
569B

MD5
f7030031de0297182d47787c170c87f1

SHA1
04a227ae5838b77cd849279b4cf78d7fa65848d1

SHA256
fdd432940825884922c644535c9156ac661cdb7324af070c1db2140e056bb835

SHA512
183bec504adb8f26d04a6a784ad03235dce6248b6180c62fe5ccaa9a244af28aa866163905104cd9570a4491967aa9bdf15d02a07b9d5d0d55946b0b1544f919

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation677072254606115451tmp

Filesize
90B

MD5
a450efdd3bb35cc33cf8ef950851f8da

SHA1
11e4d5f5e6161e461a4a3c5db0b4aeb24865a607

SHA256
a4b1adb94b9615c13f700ee9bf5a2c580ecf9173245580d4f806716cdf83bd5a

SHA512
731d88a3719047ee42c24b2aecb5a9c8c03e7f46bc77c87a1d59c15337e02c4e3ecd2bd7821bad088dcf843f2a2f78af2c79332760f01a448feaa7cf2cfaab73

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
4638fe1d9f3e82a79fc0593fc4f10a8e

SHA1
fbc231b2a18ad56bf145696d33686a345b5778c1

SHA256
883af354f2bc96f81524d51af36ae8f3e765cf0db80e1477e1556358acc5f8aa

SHA512
95153af3e2823861b3fc0320822d3169b733ee88647ff7f3854f9d5faddfe1f75cf0b303a861a61b833ee9c984045a1551cff807528bad2961ea2201f1e78bf9

Download Submit