14786e3fe720be26cbd551badf135dda21c3d0e664d962b95b1ed88081ed5843

Analysis

max time kernel
4s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
14-04-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app.apk
Size

3.6MB
MD5

e6995652396ac7a0219cfb57a95b6374
SHA1

8a5aaae0b26e62a39a75831c1b5e5461bd522abb
SHA256

14786e3fe720be26cbd551badf135dda21c3d0e664d962b95b1ed88081ed5843
SHA512

77cef5499f9660abf90726d520f60ac44cf5f92d6bca161a80db830613bf8e060a6d2e4e09678df2fa2cd4ee13ed2beff9b5a7f65b6fa572e4b6d97ceb6d87a6
SSDEEP

98304:+1+hKSo6QcUiazToTwr5LXMmFgY35gy88XY+tEaI1:+1WKSo6qiccmyAXFw

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.drnull.v5

description ioc process

File opened for read /proc/meminfo com.drnull.v5
Acquires the wake lock 1 IoCs

Processes:

com.drnull.v5

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.drnull.v5
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.drnull.v5

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.drnull.v5

description	ioc	process
File opened for read	/proc/meminfo	com.drnull.v5

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Checks memory information
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4284

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
2f30da2886bf167bcfce57b6907b1580

SHA1
ae28e9790d89409a6f571f03563834cf490c1dbc

SHA256
2e4a51003b285a2289d4835d4dd754711a877e200ccbd007ed4a55ecd4f9052e

SHA512
cf27ad8dc0be86785f86b8c96cd7e57822a1e77db0dbeef16244599de5a2bf36b3db41366379829a72f6fa295b7c3b4c6a87826e3877394deafe0a78f213ce36

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
c9fae997c0552e3323f8b75049d0f9d2

SHA1
178ca2c0d1d9236cd493fddd2556c214afdc8bc2

SHA256
89af922235650bd6dae0fbf79e159d0c2f6ae655c763e09560649a4303a85a7f

SHA512
8c8226413ef3c1ade8ed2c2c140bf1ed28440078e18ce29255b9dce81179745ea0ec51ac3a4e1b5836c54b3501e71667073f74fb449b7c7d4538eb68c569c454

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation3285737291843437655tmp

Filesize
569B

MD5
e88b31d5630be93e31860f07ff321730

SHA1
8a942e78dc7b0a09ac66c8ffa607d3ece0bf2d22

SHA256
e60f636a70a3c5e207ba2031ba39edf6670d1d401842c320785dde00825baf73

SHA512
9cb5e24debfcdb12038773460d6d51cdb65a594954cb8d06536b0e83666760b39abe98556cc789cc9efbcd58253bdee7d097607fac15e1efdbcece0d1fcc576c

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation5002737382974802658tmp

Filesize
90B

MD5
89101a494eabe6afa431bdc158529d5d

SHA1
0b72c4a1ab108719bfacad85b0eb68f9e05a9d82

SHA256
f1ad5d1eb9580593fb72eae32044b2bdfba1a3acfa9c6ba73e372403d10dc73c

SHA512
da6aaabef5fa0c85005fbed02bd965efd57c067f2544398090149f4490c5944eb777f5393ca803f76ffa1cda0169c135d760a271b2cb66344d4dfc79c87179e9

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
f80cb6558373b91dfbb17e7db637c795

SHA1
cb651508513f78e22686c9e62e838bea9dcc41c7

SHA256
b3fe957007dd187c68bdb56cff86627f073973e41ede7b6e48610b732895c815

SHA512
4ec2f0bbce7f1ebc35047fd068d639f399f9d18b1d6e4030e3d2b083caf7b886fb04f243afda348626cb2a4b3acecaef92768cbd5f0b9011ea5eec46bdd45e21

Download Submit