52770b424a389e606b326221af03dbe770eac840d4f291f32df3deb6a4fc47db

Analysis

max time kernel
155s
max time network
154s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
22-04-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app.apk
Size

1.9MB
MD5

946f4da12572cc7370be6ed6778f3854
SHA1

7f6f21471c160eda9af5dbb796a99b410b9bbee6
SHA256

52770b424a389e606b326221af03dbe770eac840d4f291f32df3deb6a4fc47db
SHA512

df753a7f17fb40b51de7e568857e68819c717c905982a17ade6e7d21a8453942daf6fd793c908adea318ebbdbe294198eb4150274bac6427106fd60d8998c807
SSDEEP

49152:k/EZL9zHbY+B0TXud1WB79IKrPWI5RAeuTvKC03T1dy15ltJv:yOL9DbY++Y1k75PFAeavl81dCJ

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

Processes:

Madsal_remote.com

description	ioc	Process
File opened for read	/proc/cpuinfo	Madsal_remote.com

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

Processes:

Madsal_remote.com

description	ioc	Process
File opened for read	/proc/meminfo	Madsal_remote.com

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

Processes:

Madsal_remote.com

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	Madsal_remote.com

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

Madsal_remote.com

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	Madsal_remote.com

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

Madsal_remote.com

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	Madsal_remote.com

Acquires the wake lock 1 IoCs

Processes:

Madsal_remote.com

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	Madsal_remote.com

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

Madsal_remote.com

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	Madsal_remote.com

Madsal_remote.com
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:5029

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/Madsal_remote.com/cache/1

Filesize
72B

MD5
3552ce81ee85bd2688b08ea0c8114319

SHA1
f10c395d901c1536f435d7e637cd80157e6adc05

SHA256
2c1b96a99df9fb5129405e5c735fc70bdf45d1f8d8d15c7bcc4d5bcff6802405

SHA512
7a13f17e62f82adff81011168110d7cb3092a2e45d2e3181ebdd00b9922306a3ca354f476a74a1c016ca5151716c753054e817b260035f2e31ed743d7fb43362

Download Submit
/data/data/Madsal_remote.com/cache/2

Filesize
16B

MD5
6a6663ca50638a0e14cddc3487ad0e23

SHA1
471387fc0a32aaa18bca39bac77f8dc2c97a97cb

SHA256
19bbfea39e6141139a50c6539688e28af96cafe3f7e296d07d08c4324dd16d92

SHA512
a69e6151d046d80698efb237d5df9e91f7cbd0e74df8d393f4ecb57ad365ed5d9ea633e19a28c1d6fdbe81bbfd7596848f589e630608406f922a424a2a9b49af

Download Submit
/data/data/Madsal_remote.com/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db

Filesize
16KB

MD5
42910e4e5c4db5650496d0b19194772d

SHA1
2a9e73916ba9553968a4ba87f7004e39d96a00e4

SHA256
f5f1228bea8fc5a4330109cab02ba0ed14749f7e97f37af8da49fa72accd3ae9

SHA512
cf9feb0449af7d7842d29daeb35a22294ce47bf24cf1667f34cad93bab11d3d2ab649426c668f808b386d18d4bc50b668687790fafed389708e108e6c2b6310c

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db

Filesize
16KB

MD5
2a4a82ec131f53cc5bee84dfd5a015b5

SHA1
10b7b1b2651bf24f119bd4ad63aba666d797fd53

SHA256
2f20377942c56a9d5329b16a292f7bd5264e22ae8a37beb57976bac862f27e79

SHA512
91b74b4f086294acf07cf30b977800b6c80e900b98e5ffa16496565ca0bd7da069a74f723384122af73baaf0ba616017527cbf6b077e34c6d2ad3dc108949e59

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db

Filesize
16KB

MD5
1cc64eb75ebe19118b31193ea8d973a1

SHA1
7671efbb211b07378aaba0f010c2a93bd7d46a40

SHA256
27a33408ef3b36184fd094a77a4fc872d9499626b6f1570b83193a3499d6dc12

SHA512
8d463f690cd4a6cc7059fe32561427d7aefe4dd11b2bc16f34b38db7a8789600cd9744e6ca342f34289e495636137cca69b966d8e1a0a670f6f02069b6330c1c

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db

Filesize
16KB

MD5
573a3a5dd544b50c01b419a8ddf41da5

SHA1
a731c192e1994200fcdf3fb883319facffa1ec58

SHA256
7625758d5d9bbf90160c01d69c9e069dab058e8b3717660e7c5e34fce4070469

SHA512
aad94e80687a07452939844bbcfd6e381da0b628349b64bc587459a284741e37070c2c608b2e30fae33c772ca5a7f19d06beac2f83fd0540e66695401db85c72

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
827e5e2d3f5c658d83d5171a641ce1d5

SHA1
183d86ddb06143f4d0a0e43a4cb238accb0eb2f9

SHA256
9511904631564ca539af73be9ea06fcf52ee449847ccd7eaa43178a513624cc7

SHA512
78d6bbd253231674f9aa9e1e7d907b62110b0866f2928cea79e8cec305425d997f20a1961b614f1e698de03ff095e6895db4ae7d54a7a04742339bc9ba4b8e0d

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
934e7cb60559b1df485532b922eb1f1e

SHA1
e3ad6199116af9344c24fd7699d80f132dd48b36

SHA256
f1696cf2876f5b128c7b156c7cc9e26d114032d2ae245da5531d09728667d51e

SHA512
fd9fdad63195183e7b76c80532b27db6b062c7cb705a15437943403c04666e520069d1c93babcc6fdd7cfacd7e3f6d2c577c1431da513da0b27dc20d9bc17bdd

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
ad04ff484243094a7dd621d46330d6da

SHA1
14433ece38d81db4ee0e63770351a016bfebb1d0

SHA256
1869cef26b37881f7b3b41b0690e0b1f64ab9e3e72c1e5385d3f5831a2a9303a

SHA512
1530f5d66e8f6b210d51b15e722fec85cdd9b669707d5ed4babfa1d458a34dba22f836ea306d5d2d01e9158d70078b25c58c121d677767cfb46433501c618fff

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
07a0574395aea07800af622b43f1bc51

SHA1
43aa13de94fb817070391fe9037c75f8af9d24c2

SHA256
5312222d8b86c4c24b414b7f29e8227245b9d8cfc6b7ce3274d48b6d32e83099

SHA512
e7c4cf896f0dfb6943e549bca051adbdb1467bd8cab851f2e35447917e105655acb877a5e16e3705f5762404dad645eb6c4c651ce0b8e75cb13535bbdc9a1c71

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
bd94cd7734e8f0e59f599426aa06b3a4

SHA1
eb6a67988a7b579c867ac2b7affc2c96195db716

SHA256
74733971d949dc9683973353370923947aaab4cafa5f6a18fa4a71cfc39aa6c4

SHA512
a1d9a4b8f9bd9973c56770a7836ef7821c55f6c2fca6f18d178cfbfe9c6763fd8ece704d087f6d688008d79a4436cfcfbc6d93a1d83b549ba4f05104f049b854

Download Submit
/data/data/Madsal_remote.com/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
f1eea267820f2245228a09c18e6704db

SHA1
65af99faa7429da1824b0f8486130d935d895f4d

SHA256
c176b8004cb33fc7f15fda471d4c25606c3b1397cd386692d52cacffb663807a

SHA512
f2a0fe2cd7ae309b952c51b3acdb114febc00deb0aa41316a2de877f8b29b1dda3e994d9d730dae6e9466a94ede834ae70318a9e5ea91904aec9d0b1384e2849

Download Submit
/data/data/Madsal_remote.com/files/PersistedInstallation3617454037842462022tmp

Filesize
90B

MD5
eacbb5c7269f22d1fdd67d4ca3b4fd10

SHA1
705fdad3c78946a3d24a5c1cf307892442eee3cf

SHA256
b0721a3532d20dae7454568b567dc3c71efc2d62bf6ce0260897729281441fdc

SHA512
a455f5d6ed99491dd9b1138470a98c68bd8fc2818f0f28f8a781843ab8424f2987363a7301d63d07c828ae12a4e207aae228a30bee50514e240be3896c5193ac

Download Submit
/data/data/Madsal_remote.com/files/PersistedInstallation9218671858125812045tmp

Filesize
566B

MD5
559e624a5356d1c181a420492380d596

SHA1
b8a8afe98f0e883f54eac7cf77c27ad63a3f323a

SHA256
d4019e61d0e0eb41b0dee3321e781052b1967f57015d03bbe39189007bb73e19

SHA512
0596b7fdd5d004be08bfa0c4d8f0b4a1f392e9c75d7c582b019582d8a334f0e82a65c1ca1d838823557d994de9e136af238c73b0df6c213b982b76a94c774783

Download Submit