14786e3fe720be26cbd551badf135dda21c3d0e664d962b95b1ed88081ed5843

Analysis

max time kernel
4s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
15-04-2024 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14786e3fe720be26cbd551badf135dda21c3d0e664d962b95b1ed88081ed5843.apk
Size

3.6MB
MD5

e6995652396ac7a0219cfb57a95b6374
SHA1

8a5aaae0b26e62a39a75831c1b5e5461bd522abb
SHA256

14786e3fe720be26cbd551badf135dda21c3d0e664d962b95b1ed88081ed5843
SHA512

77cef5499f9660abf90726d520f60ac44cf5f92d6bca161a80db830613bf8e060a6d2e4e09678df2fa2cd4ee13ed2beff9b5a7f65b6fa572e4b6d97ceb6d87a6
SSDEEP

98304:+1+hKSo6QcUiazToTwr5LXMmFgY35gy88XY+tEaI1:+1WKSo6qiccmyAXFw

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.drnull.v5

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Checks memory information
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4235

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
446da16ddd8d581f8d0f0708855f48a5

SHA1
e757ade9fd47c94cd958b15c1dc2e7242586cf15

SHA256
c33f5982468d2cf29edcdaf52a061cc8157b211f4818a15c36e5f564d48323ce

SHA512
1fbc6f69d92bbcfa08fd847cc2ec28c82aa575f7038b277e92a6f1184bcb4ce69d22ead28a5365554345fe9b095fd75a9a21727f64349589537dc7ba86ed04ff

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
827bf7c942d749b3284e0efdaad57ffc

SHA1
c6971debbeb4a29f559c136513e964bd90d8dcfc

SHA256
bcd51a250b185e73c3fa750dd526a031d06983025835767cb2523e49ad89a98f

SHA512
5f7f72b61b585bc924274df921242442268f989e54a3240ca7f4dfe2e85de1fe51c4d1d4fff93847ab100ba5c4525ef2bba39681f4899dfbe9271aac81b1c6dd

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation1849941764430965081tmp

Filesize
90B

MD5
8cc7a89027ba024298a231ccf8c22da5

SHA1
44cb566334ee9fb8f8c2add5ecf09ce0f669d83b

SHA256
4dca2e953626630ab52f8d2018ad8d274cc343aaaf989ace69325bbd1c8c881b

SHA512
839a12e9a305afd7afa0bb1cee157518d33af921fac0a156f8cb74cc84d78cb86e3d8b62ed38e8ad4c20d88d5a7cdd12ae81a5601d88a619664ce0f508da6ca0

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation598522254901568188tmp

Filesize
568B

MD5
2e5df15e745ff7bd53d5cf5a127315db

SHA1
73394156d8a902fd1c06d2cfc2f037021db760dc

SHA256
5f521a1795b5bc4a32ac6f1de25a3e93af356ad2c8f8d9653d005c2a11b8b653

SHA512
1ea6d6e84a3177499c493aff26ad279ebf5d3e7e28de5377ff49ba85a0efde53c6d4ff8a07c4423451f0b1bc33faf142cb9cac4439e05de478355d5636f19e45

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
788b3b1ed5420f65eb350caf2e3a7ba9

SHA1
57bbca962a101af8f15c026d6723e2bf1370bffc

SHA256
a92db48c9a1edd2fc83bffbd930abc0e915369159c0836726045cb3b7b8eca08

SHA512
df3a7ac2347ce0764279291deec4e30730cde4b9201dbfcac1cfad136c6443b0e69a82766000cc7e7ece8cecfc2143ce02d6f6db4a4d1a601a61f6f3ee4271fd

Download Submit