14786e3fe720be26cbd551badf135dda21c3d0e664d962b95b1ed88081ed5843

Analysis

max time kernel
7s
max time network
134s
platform
android_x64
resource
android-33-x64-arm64-20240229-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
submitted
15-04-2024 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14786e3fe720be26cbd551badf135dda21c3d0e664d962b95b1ed88081ed5843.apk
Size

3.6MB
MD5

e6995652396ac7a0219cfb57a95b6374
SHA1

8a5aaae0b26e62a39a75831c1b5e5461bd522abb
SHA256

14786e3fe720be26cbd551badf135dda21c3d0e664d962b95b1ed88081ed5843
SHA512

77cef5499f9660abf90726d520f60ac44cf5f92d6bca161a80db830613bf8e060a6d2e4e09678df2fa2cd4ee13ed2beff9b5a7f65b6fa572e4b6d97ceb6d87a6
SSDEEP

98304:+1+hKSo6QcUiazToTwr5LXMmFgY35gy88XY+tEaI1:+1WKSo6qiccmyAXFw

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.drnull.v5

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Checks memory information
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4316

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
56KB

MD5
89e1f6a3b536ac0aba771670c90541a5

SHA1
a05a83f9f11bb7392474af190de2af6dc1904f4e

SHA256
c1aba1f1a1b8feb0402c2d495ff20b9d6961ff3677b27e59833f08f758edb395

SHA512
bfb8e1b49202ed6231b0b90adc7df320643ba8d8d8482291f6357812a0ef69fdf0c7fb491f1aaeb81b4f05f811ef139e410428d76939a65891c0d2137721e299

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
9170b33319f200587b4bfa6c636114a2

SHA1
712bfd21839fb7960757cd353eebbc16c497710a

SHA256
4e8b5b5a482bad022c6a5908dbe42b61c8e5c8b6256141e39ac643155ba61a95

SHA512
0bc48f2e309e174919c4442797531168007d5355ff5d6a3fd1269b12b82811e69ffb4e7d1a6ef4cc386cfb25688099c101d5ab6fa83633f9ae024cb3c197f489

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
e2fbc13647098bea12ff7f115a7d4f13

SHA1
50021e14f92baed6a9c9414bed8da6c480b05b35

SHA256
243fb0de0eae14d8be6eb471f9010acd4d39dbd9c5056f03b3bddba8d411405e

SHA512
204f2248d79d66bb47e4f6d71a941b815ccf5dd2e5af0bcc76e80a0f450fbfa2c1e81b822300334a022663c0e94037e062e841748005f8ea7d26811708f37a67

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
fe300be4cbdf0d0b1d8abaf027c2aa1c

SHA1
8598d956fa4a50043cbe17d048b2070ce0343868

SHA256
93b53775d4b003e32fbd4cbbc4d5aeebf9496ab3c5a87e59f3a3d0c275317d4f

SHA512
ffdd071ce2c799d82a6ed3ec40c6aaf45943bac040a2f13048e0492c6b3490dedc87cebe3b573a09cec29d242dbabd3ce7ea54a63e96a997427ad58a88f0a431

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation1787147376427164439tmp

Filesize
90B

MD5
46267f1565a147e054d415a064746c2a

SHA1
125c9519c738ac59dca983fd99d4b0daceb385fb

SHA256
eabb8000c0b6783639c639ac172059294fb08d22ee912fefd6ab3712e1ac1092

SHA512
28781c0938117a70f809b77c8a74dca7647df31ec6cfde83c444c1bdc50025637e36bb5bff7a9a2b992ef6a45cfdf188449dd240c1f226e635607c912bcaef66

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation8764657131323339302tmp

Filesize
569B

MD5
3c0b7453f560c4f98f4213e3be3bb339

SHA1
1722e86e47a8b277c74b6416358b093b5c39d530

SHA256
36a39df46e615513e7ea85d161b4fa844ee48407dbcb65943b0d51897b32add2

SHA512
d3efd860fe78eef4fd7c937cbf1914cebbbaae68f3f1005106547170db010ef802e2181d69c58d41f7037f55881f82aa6ce977c1151a87984af483e121ce1689

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
71affd3dcbc3eebf8b7f550adb6611f7

SHA1
c9381c7cdaefcaa1a906676c6415518a3d02433a

SHA256
0a7a1af0fde3aa507f484d105ce06e31f43a7241aa61a1f2e146d541c2daf2a7

SHA512
474e87c86cd2b46ab74594b64ab218289e54de758583f8894dd7e7f8ce081cbb5c8771d6c33aaaf5c1644c190891ae3075297d18cbce61629e9919f9e15e99df

Download Submit