fd570f9d86e716780dbe33b748fe6067abb7165c1b481e7128c229c2b6b5d629

Analysis

max time kernel
25s
max time network
160s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
16/04/2024, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd570f9d86e716780dbe33b748fe6067abb7165c1b481e7128c229c2b6b5d629.apk
Size

4.2MB
MD5

f3af51bb5f7e0815a8cc736e516e8021
SHA1

4f6e69be51df8d9f694a6c70e4cec63e52df14f6
SHA256

fd570f9d86e716780dbe33b748fe6067abb7165c1b481e7128c229c2b6b5d629
SHA512

1c9e6159276f8c89c7c330d3d76f8b437fc1c31d956e3995fe01cbc3b349c6c09bcd5f6148ecb209292b17b0cc67a43634b69c66997a6f813bcf6f759ec7f83f
SSDEEP

98304:7rq2vDgmiPnafybZrnBB8EjBYIzO3ttBU:7VZSMyNnrxKjtBU

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.madrasa.tawhid

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.madrasa.tawhid/[email protected]	4680	com.madrasa.tawhid

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.madrasa.tawhid

com.madrasa.tawhid
1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4680

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.madrasa.tawhid/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
47646275cde99797a7957c7cc1e02d4e

SHA1
8f6a86ac82b4b1e000c1e6404e2c0ab8634c1fa8

SHA256
e279ed6fbdf312fc884fada9b888048e2f95bfc8826e646bb199bb85eeafada0

SHA512
7a806e50401aa1f700fa9c8ccc082c97f0a6f23d4356084439c120c36cd1e55d54d713a8bce2f511adcb51fae2d8eeb9c23ab372d42ccfa111f6498c64c27363

Download Submit
/data/data/com.madrasa.tawhid/oat/x86_64/[email protected]

Filesize
344B

MD5
31eb2bccf7db988c7684b8022f7eac85

SHA1
e06ef16ecc42974d8e6e3b0be80fc446d84d26f4

SHA256
60a5e558602cad99eafd722491e894d5f2d8e303f4040d95b1da041d33d4bc15

SHA512
9a270d9b8459e75b6d7cacaaf43f218538ae71d2dc84b2b924dc036ce32b3bc3584801cf1fd66a6371f2ef6c341c8c96ce56064dc8051557ca33bd1211ed44bd

Download Submit
/data/misc/profiles/cur/0/com.madrasa.tawhid/primary.prof

Filesize
971B

MD5
bfb34a50e837a28eee092ac385ba679d

SHA1
e55396ec2a850b6f8eb84e3fa655b70da3dc8ff3

SHA256
7307ba2de670c5f423f10016402dc9b8dd8746d52f775fd4273b625350649d36

SHA512
34a15985c32fe4d708a0e05d200bb76122d51c72e6dbda5df6600cfe995c36e3581b118a86b0b8906e576b8e88c71cdea6dacc95f847a072469203b67b426ffd

Download Submit
/data/user/0/com.madrasa.tawhid/[email protected]

Filesize
3.2MB

MD5
42a776716f329899669f6d761d626003

SHA1
7c8a66fddabe92a33367f14c29f13955149223c1

SHA256
7aae06433cff5967ac254484d784c2c348380891d0914c56de64e7e006668cd4

SHA512
bebfa64178281625ce6a58a3ed61ec0b80278041b79a6db210ffc5e0536056174582daa32c2042d1dac5be7a5b8afa19c55a92b7067ada2f25072375c8e22cf1

Download Submit