1352ce38dadd5e7ff5ed7d0a84cb04e12534061e5aef645c650bdd06bd2d5847 | Triage™

Analysis

max time kernel
48s
max time network
161s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
13/04/2024, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1352ce38dadd5e7ff5ed7d0a84cb04e12534061e5aef645c650bdd06bd2d5847.apk
Size 3.1MB
Sample240413-1wpvzaad46
SHA256 1352ce38dadd5e7ff5ed7d0a84cb04e12534061e5aef645c650bdd06bd2d5847
MD5 68ee0fd56511f904fc45882f974a0f7b
SHA1 faa1582fc352a495b02de0cd43a9d4c05987253d
SHA512 3e68f71a2849539a1b7176725796f5f5b2023252be82d4b85cace0c1b5cb6555c0e46f6fc694816d68af65d5d9c583ffe46fecc703e897aa41d0d2891b6b3d75
SSDEEP 98304:BRVqKyHGwhXCUzTIDPwMZ6hyoiIm1rZdr4fc/gg:EVmwhX1TIrsm1VgE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

System Information Discovery

description	ioc	Process
File opened for read	/proc/meminfo	com.unknown.god

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.unknown.god

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.unknown.god

com.unknown.god
1⤵
- Checks memory information
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
PID:5114

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~test.test

Path /data/data/com.unknown.god/cache/~test.test
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db
Size 16KB
SHA256 ef1d8130c77f08bed987cd1474751b19941ebc12754923bd639b3dbd72fb9fe8
MD5 5e09243a95b57275791a8dd2114b063e
SHA1 b8630a9576f21f81894e006e6f034850a5053519
SHA512 eb12f44dd05eb1effe453d974a2b9642f2e9f55313595bce479fa988743d7284033d41930f5d86a4c76a28e5ad5a3ff1c357c9e548583e5ec8b4fa0904e0e91a
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6eZb:TLiEy9zmzrfRmBEyPbP/P+/0Fl6VU/P7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db
Size 16KB
SHA256 b791755d3e4cb59266d377f30d3c22265f2151fab92cc7ec22d629cf9996a1ab
MD5 aa00e9c00aa328da09207624daa505af
SHA1 c8fb19e926b671f91bb68fd8d66f30518bb9642f
SHA512 ea2ce35c67728550f34ce7579a034d6c69befc112e34230b8dec3bcca17ce4d5a417be6d636790a59c8556a318eb730388f63d2ff1650b0f06bf09b168568251
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlGuGN+/0Fl6VU/P7:TLQpmzr0GSP/h1499FYjNlF0U/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db
Size 16KB
SHA256 6bb1b4d7dea1ff7d3c796d80a11c2f9862b397739fca1fc448569614603cb951
MD5 b94dfbeb6264de5ef6bf1a0c2d219799
SHA1 f41e3ed35cc14911751f47cd3ca7002b9780290f
SHA512 40fc274a0402e2a190ecf6da441ad6a4c519002ca6ec9aaf428d45ce9adbe10c715534ad4fec2f3d3df3df49f66861ca2429e8341ea5c26cb4465b8aaaffd4e9
SSDEEP 24:TLEvpmzr0GSP/9PKary5t9AxH499FYjNlF0U/D:T4vArSP/9Saryz9L5YFLD
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db
Size 16KB
SHA256 f4d6f98e3b5643df6db10eded8ed7d9809726f05b65fc714888bfaabe3cfaa19
MD5 4231e57613d246640203eb3180ddfd91
SHA1 1037d8fae61524410879155d8f59e56426460186
SHA512 89a034997d781592d5fd0f9a3aaca25347055024824be3c331e909d044c4dfba47dab281fb4a3b786bb071ad651066a1d9a3ce19e317a8f57cbc6e593fba5001
SSDEEP 24:TL6Xpmzr0GSP/sPKary5t9AxH499FYjNlF0U/n:T2XArSP/sSaryz9L5YFLn
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db
Size 16KB
SHA256 252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9
MD5 adf6082723784327d7d1b34adf974e7d
SHA1 b1502f70eb881a1dfe41139cb719fefb877ee37c
SHA512 762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b
SSDEEP 6:l9bNFlgls1qlvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W:TLuEev9zmzrfRmBEyPbP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db-journal
Size 4KB
SHA256 d2801d8ddd07f7a68a49632dab0a3f51f8793329b09bed1f8c75a6b1357a0bcb
MD5 d94560f28dc79741a178f74d0d47c189
SHA1 0cb3dc1e3138ad092a3944ff21a9598f73b98ac9
SHA512 103a4cebb28f0ccd8f941b9cb68ec1078ca32bfee1935e36b373811ab684cf7a3e6b0b905e261f6c1f3f32f7a84dfab382f08516c58df1a766830692a8970d2b
SSDEEP 6:7+/lDqPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKb:7+tDeqLJdTRmBEyPbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 19e525df58e88471cf4d8b8f04c6ce029558d5d40e6d051c6e44ed5402ea5047
MD5 96c1a33f4d6a5437a72969198b7dff64
SHA1 f39fbd0f35a2b8d4a0f1d4c7e38e16e0f6c240d0
SHA512 6d239def825ae1f76c3ee52d42884f52bb07f87b017c65b55f4f2f14fe4bb60f8ad90c0ccff4031a12efc4fcbc2f8f759ae9dede6c57458c01f5f02d89b1f4bb
SSDEEP 6:7+/l9CPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuK//b:7+tMqLmqCRmBEyPbQb
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 1bb45b4fa45533594d52781520bfc5cef59775f612d9ef688406f2bb057214c3
MD5 3ed41686db22dc8f623535c3f2b3c5ec
SHA1 af884679665f42cc5133938d7fdfbb60b394333f
SHA512 a4f70b120cefaf5c7352db5140ebc41a55444ff39ec5df117afa4542a547146bff15cc9bac72dedaefa6b801a0bf878a5dda311d89c77229912261701ba44eb2
SSDEEP 6:7+/l9QJ/hbng9bNFluls1EhlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuKZn:7+tarqL8EEh9zmzrfRmBEyPbWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 42193f47fd68c30acab66516932f3424a0fc43d0e98243ba8979c9ae91141b4b
MD5 e8be1d0a16f40776ea86ff683c8210d7
SHA1 6db91824546111a2270118751f5957b3b4668705
SHA512 02869c6d3f2a8e71b0c3e5da0393d00cde6608510ec40e522a396a9cea1795b395e16bb8e97d9e7e5cb32fa706b698c08e31c023ef88564e97d7395d78834b7a
SSDEEP 24:7+tmPKary5t9AxH499FYjNlF0U/wWqL6Xpmzr0GSB:7MmSaryz9L5YFLbq2XArSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 db8f8e1517748850ba847996c1923c1fc3816795d92ba3072316a2353b5c9e01
MD5 b600712ef4add18fb013d20ddf811de0
SHA1 7ae24d30f551a6c922ec27ece58500fc2d66343a
SHA512 0d621309b3b150612094eaffa5e148aabc1e2f6379d3856a94d98db0abb63f9662b0690d5a520eb0b1f7e989d5dbc2cee1b4e59dbd569f08b44a178044d7d099
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.unknown.god/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 c956274a9531b4342689dd4f232eb7bb9e297664dd911dc231b4c6f4aa8e6ff0
MD5 e69dab13a36c219bd3aee4c4c9549805
SHA1 ebd13ed1b33373fad0877c3db3beebf262faa2d0
SHA512 1d158e36af5ff5ddcc1c475920cd0aea6bdcd5a56aa46c8ff9ca12dca283a266729d45493314faa8b1a563a757f53718094fc30970d6ee151e875cc2f4fa9989
SSDEEP 6:7+/l9GcWn1+ug9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKS:7+tAxqLiuWdwRmBEyPb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

PersistedInstallation1116004351241342881tmp

Path /data/data/com.unknown.god/files/PersistedInstallation1116004351241342881tmp
Size 90B
SHA256 3b8b02da5c186e96399c38bd9e8e993f9f5dc304bac1fb1d86c5e3d95fc4eb95
MD5 c7ade70d7f4d6237ea0a2bec7d484ed4
SHA1 187063f3d390fcfec7fb021b33d6dd7da4aeb295
SHA512 9d7f736e378feeccd050a2c302bad4f89309380ddf4eaa9765d91f66be4a96ece986daa9ed82dc7ac9b89947af7617f9c3b266096b60146434a96d7ca406dc6f
MD5 SHA1 SHA512

Submit Download

PersistedInstallation2209707009416299482tmp

Path /data/data/com.unknown.god/files/PersistedInstallation2209707009416299482tmp
Size 569B
SHA256 2ffe3d4fd5847f2cddfe7e50a54b43b6a47816e45bfc3a527a4abeec30966368
MD5 2f646d12ff65cdb49281da3b22269e96
SHA1 341c889f34b51cc97c57dcf14ec67697e98491b7
SHA512 1e46f41d0a72fb200db986b3aaa6b4738327114968463ac38f95c9bf4606514e499ec2e2c86930f22dfc5461bef45dcd9244eb9df2e14ac78196ed0eb8f389c8
MD5 SHA1 SHA512

Submit Download