fd570f9d86e716780dbe33b748fe6067abb7165c1b481e7128c229c2b6b5d629

Analysis

max time kernel
47s
max time network
154s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
16/04/2024, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd570f9d86e716780dbe33b748fe6067abb7165c1b481e7128c229c2b6b5d629.apk
Size

4.2MB
MD5

f3af51bb5f7e0815a8cc736e516e8021
SHA1

4f6e69be51df8d9f694a6c70e4cec63e52df14f6
SHA256

fd570f9d86e716780dbe33b748fe6067abb7165c1b481e7128c229c2b6b5d629
SHA512

1c9e6159276f8c89c7c330d3d76f8b437fc1c31d956e3995fe01cbc3b349c6c09bcd5f6148ecb209292b17b0cc67a43634b69c66997a6f813bcf6f759ec7f83f
SSDEEP

98304:7rq2vDgmiPnafybZrnBB8EjBYIzO3ttBU:7VZSMyNnrxKjtBU

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.madrasa.tawhid

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.madrasa.tawhid/files/audience_network.dex	5034	com.madrasa.tawhid
/data/user/0/com.madrasa.tawhid/files/audience_network.dex	5034	com.madrasa.tawhid

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.madrasa.tawhid

com.madrasa.tawhid
1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5034

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.madrasa.tawhid/files/audience_network.dex

Filesize
3.2MB

MD5
42a776716f329899669f6d761d626003

SHA1
7c8a66fddabe92a33367f14c29f13955149223c1

SHA256
7aae06433cff5967ac254484d784c2c348380891d0914c56de64e7e006668cd4

SHA512
bebfa64178281625ce6a58a3ed61ec0b80278041b79a6db210ffc5e0536056174582daa32c2042d1dac5be7a5b8afa19c55a92b7067ada2f25072375c8e22cf1

Download Submit
/data/data/com.madrasa.tawhid/files/oat/audience_network.dex.cur.prof

Filesize
715B

MD5
24860996bbc14f820ca47afee181332f

SHA1
7989c4158ee8ffb74eacc5ab3f7505c41f9d0904

SHA256
7214cbf97b85e74c8ec57eea52f2d73d3849615e25b14d8254aa16c8a3e5f6ad

SHA512
4e05c43a18819ea647f67d52166bfb27b5155346af867946eb2e4f9b0f41ab7c5c25454f929c1c198689c97d8650658c8a9f1782713619c67018dda7f14641cf

Download Submit
/data/data/com.madrasa.tawhid/files/profileInstalled

Filesize
24B

MD5
f6c92560d36b1a7401792f26bd8e1465

SHA1
f01be2931cf9189e201be3fc8a17995703085ab0

SHA256
32f5101d41112ed5a3644920fec384b4125b02cbb813037fafd097177c5e23a7

SHA512
fabcac13058ef180ea65904ec1b082cab05b7465aab4e786bb30062a1ee5458d784eac6441efe124299632da6f68533553296c671b6bb84c7dca6ede452129f7

Download Submit
/data/data/com.madrasa.tawhid/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
1a91bb0c276c803eb685efca84a4bd40

SHA1
889e6f37a64d4822336ce1f106ba612f843a9e7a

SHA256
b668ed717eaef17a8b3576ed38a9122e9d8d64b14f2c8a6b45c2e6f7604248a8

SHA512
8e5f176545d9eebb5e780d0ff34023259ad1d208194ceab302282b1b379186e8f5afe5c85411604955a317b6d1fdd2e226acdb840dea63dad1b7f5b2a5c6c342

Download Submit
/data/misc/profiles/cur/0/com.madrasa.tawhid/primary.prof

Filesize
971B

MD5
bfb34a50e837a28eee092ac385ba679d

SHA1
e55396ec2a850b6f8eb84e3fa655b70da3dc8ff3

SHA256
7307ba2de670c5f423f10016402dc9b8dd8746d52f775fd4273b625350649d36

SHA512
34a15985c32fe4d708a0e05d200bb76122d51c72e6dbda5df6600cfe995c36e3581b118a86b0b8906e576b8e88c71cdea6dacc95f847a072469203b67b426ffd

Download Submit
/data/misc/profiles/cur/0/com.madrasa.tawhid/primary.prof

Filesize
2KB

MD5
bd579b97a3916bb3b9aed4cce827f85d

SHA1
4491a8bacfcdf4aa0540cd10e014cb5a05de6b78

SHA256
8b1c33151a1fc3bb6d262d82ea1b4b957571e0d0a8d802c7d68019818775b986

SHA512
13cd70bb0419c15abdb42f221aa59e2843afb756dfca892d05faceb858eb8f6b4b3ad089f731775c3ac12b94e7923d77895f82a49c644a9b15871b16e6165157

Download Submit