14786e3fe720be26cbd551badf135dda21c3d0e664d962b95b1ed88081ed5843

Analysis

max time kernel
5s
max time network
135s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
14-04-2024 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app.apk
Size

3.6MB
MD5

e6995652396ac7a0219cfb57a95b6374
SHA1

8a5aaae0b26e62a39a75831c1b5e5461bd522abb
SHA256

14786e3fe720be26cbd551badf135dda21c3d0e664d962b95b1ed88081ed5843
SHA512

77cef5499f9660abf90726d520f60ac44cf5f92d6bca161a80db830613bf8e060a6d2e4e09678df2fa2cd4ee13ed2beff9b5a7f65b6fa572e4b6d97ceb6d87a6
SSDEEP

98304:+1+hKSo6QcUiazToTwr5LXMmFgY35gy88XY+tEaI1:+1WKSo6qiccmyAXFw

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.drnull.v5

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Checks memory information
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4182

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
f91a983b457352a082c2652a76202f40

SHA1
d3766efcb72c345131a9f6630d453df210d98c2c

SHA256
c459cadbd0f47db3d714f48cc2073c0938000fa2b522a5b9326fac8333ef3e40

SHA512
528b8629d6455ff95a7510c2e60031822ca64f37bf84b91cdaa9228a00c2ad5a347f4ec68e7250dea12d82a81af385303ee6e6b673b49e984e12e6faed0fe408

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
6d6e6202ad92e64e0067561feb0ebdb0

SHA1
1d52ceb7925939a045c9cb2c055c78648552a1e9

SHA256
d4398e63b042c3d95f6397fd4bc9bd5c3b3d98ece02eb637db05baa14b47ad8d

SHA512
cbd6badb850922447701b2ca83bc6097ad141ee8a8395c0bbb41ba050edf796a665b8eaf402b22ea656e7bde3049f9808e3023e2de19cea2e544c8e687c1e8e0

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation1028158015221698708tmp

Filesize
90B

MD5
fc41e07359dde9197a70ed860eb4881a

SHA1
45caf52a0964232b861aa315bb97b95dc4c82fa7

SHA256
7c7651e27103f7c0221623d1da83de570f04a1d011a3d2014718b4ad51378915

SHA512
bb48d50b9556977b2f649aa1e12805be447b5d34a45c53446cadf1e7ae3a57996a2913c334c5c87467890a96be77f6a233dd47e123f746158f8e7d31307e17a0

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation5996149410441709418tmp

Filesize
569B

MD5
2bd1beb5d610c6469129d6ee0b9a8724

SHA1
2dbaea930726df44e31a320a4c7a13b829c10d24

SHA256
cf2570fee67e880cb169151b10ad5a0e2bd42643f0cacde7322f2127655c6a2b

SHA512
b592b59a8672c4855df258ee0831a72269c01dca7d8ba6a2840f6e28a0ad4e6a72fe803d15b4e6d0e71a818adc1fb41e2f8a52abbd77738fa09cf06dc299d145

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
3473e36762e1444b743e9e13158b4980

SHA1
d7d74d562cfe8b565213f09a250f669be1b3db86

SHA256
ce10a50c189968406c324328fc9c303cc9f7e9f69f33f46435a213c4d85793bf

SHA512
bc9bf191a21c17ef90268670d6ff855b1402912f6f1069c10af82e97c5d03a468f76a200b665165e7a2771e03c23e0e0318dfec8bf4ba8bdb02e889e4960d777

Download Submit