fd570f9d86e716780dbe33b748fe6067abb7165c1b481e7128c229c2b6b5d629

Analysis

max time kernel
48s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
16/04/2024, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd570f9d86e716780dbe33b748fe6067abb7165c1b481e7128c229c2b6b5d629.apk
Size

4.2MB
MD5

f3af51bb5f7e0815a8cc736e516e8021
SHA1

4f6e69be51df8d9f694a6c70e4cec63e52df14f6
SHA256

fd570f9d86e716780dbe33b748fe6067abb7165c1b481e7128c229c2b6b5d629
SHA512

1c9e6159276f8c89c7c330d3d76f8b437fc1c31d956e3995fe01cbc3b349c6c09bcd5f6148ecb209292b17b0cc67a43634b69c66997a6f813bcf6f759ec7f83f
SSDEEP

98304:7rq2vDgmiPnafybZrnBB8EjBYIzO3ttBU:7VZSMyNnrxKjtBU

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.madrasa.tawhid

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.madrasa.tawhid/files/audience_network.dex	4183	com.madrasa.tawhid
/data/user/0/com.madrasa.tawhid/files/audience_network.dex	4183	com.madrasa.tawhid

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.madrasa.tawhid

com.madrasa.tawhid
1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4183

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.madrasa.tawhid/files/audience_network.dex

Filesize
3.2MB

MD5
42a776716f329899669f6d761d626003

SHA1
7c8a66fddabe92a33367f14c29f13955149223c1

SHA256
7aae06433cff5967ac254484d784c2c348380891d0914c56de64e7e006668cd4

SHA512
bebfa64178281625ce6a58a3ed61ec0b80278041b79a6db210ffc5e0536056174582daa32c2042d1dac5be7a5b8afa19c55a92b7067ada2f25072375c8e22cf1

Download Submit
/data/data/com.madrasa.tawhid/files/oat/audience_network.dex.cur.prof

Filesize
1KB

MD5
f43ffd79aaffee9bb5a8c6e7e07dcca1

SHA1
7b4d61a78fb9d77017b9f011d86179d7f4ff9c44

SHA256
edf26dc2e21826e69fd2d699b037dc10e9766ab071b575b21af686a4e048a2c2

SHA512
be6e5786077d6d4d34ddaa9a84feff6c2e646cbfbe50e8b8dcbf487cb06d2205ffb903554b6518c57e8d38938edb09c057381ca711f00b6683d22606c7d4dbc0

Download Submit
/data/data/com.madrasa.tawhid/files/profileInstalled

Filesize
24B

MD5
2a3a0836c16ed22bde73b0da889b7459

SHA1
ece21c1c6374ab035f55e7b0dca57b5f3748fcaf

SHA256
0ba1e4752cf9d5a31479b533a92afa10e57e4e592c2a5d45ef3e9e987438157c

SHA512
0ec7263ef2ca491a33b47cea5d612ffbfa56346a2d47f7b5b0ece5d8be255bbeb54e69538d78ded32fb95cd9a0eef24855f0e73e35f61e6461fe31b854920bcc

Download Submit
/data/data/com.madrasa.tawhid/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
c37f8d0a8330b420c3133779330173fc

SHA1
ede2ba94eaedcb977fe0960cecc67e129efff3b4

SHA256
8aff3dcc122655d64b93707d4322dfa2760fa13a306914830faf97d0309b47dc

SHA512
64189796f9f924539e63146464a745fe4b244ee68863cc609b04839332a9bc656b5e33e29267854ceb158e36dda27947c95cab3c41b54a66e45a842a3cb88cf0

Download Submit
/data/misc/profiles/cur/0/com.madrasa.tawhid/primary.prof

Filesize
971B

MD5
bfb34a50e837a28eee092ac385ba679d

SHA1
e55396ec2a850b6f8eb84e3fa655b70da3dc8ff3

SHA256
7307ba2de670c5f423f10016402dc9b8dd8746d52f775fd4273b625350649d36

SHA512
34a15985c32fe4d708a0e05d200bb76122d51c72e6dbda5df6600cfe995c36e3581b118a86b0b8906e576b8e88c71cdea6dacc95f847a072469203b67b426ffd

Download Submit
/data/misc/profiles/cur/0/com.madrasa.tawhid/primary.prof

Filesize
2KB

MD5
08cdc7b58209ae5896a9facbd995a2e4

SHA1
a9366de47602b3f75b0462008ef68ac8af6edeb7

SHA256
12fa104621a5c6668ed4cac7f734d10c9d0c45d287a1a8c825636e406b3f7ff6

SHA512
0805826abd81b5b8aa7a787db167a7a8983bf9082aa2438e72729f9eb2c41920e40b3c07cfa4838f75f643ee788fe073a8712267f0fc195f2522c84c9cc1b8d1

Download Submit