15e5439975308e17ec56ceeb2726dd5c17debde4433c094fabae29fd1660b12d

Analysis

max time kernel
123s
max time network
149s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
23-04-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15e5439975308e17ec56ceeb2726dd5c17debde4433c094fabae29fd1660b12d.apk
Size

3.0MB
MD5

225785cd6b4dee46d8921b68e6947394
SHA1

303b37e927ac2973a1a247d60c65abd43a779e65
SHA256

15e5439975308e17ec56ceeb2726dd5c17debde4433c094fabae29fd1660b12d
SHA512

f5a129beffdf2131a5a1875b1497876e27bacde480137f7700c1eda98687ad335a55a357d58e6a510fd9be1150df8f8dcbbac8b3465e464d60138de20f573e9c
SSDEEP

12288:xTPNwNPNwNPNwNPNwNPNwNPNwNPNwNPNwNPNwNPNwNPNwNPNwNPNwNPNwNPNwNPJ:Kr

Score

8^/10

collection credential_access discovery evasion impact privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

test.app

pid process

4592 test.app
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

test.app

description ioc process

File opened for read /proc/cpuinfo test.app
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

test.app

description ioc process

File opened for read /proc/meminfo test.app
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

T1414

T1641.001

Processes:

test.app

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener test.app
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

T1626.001

T1640

Processes:

test.app

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN test.app
Acquires the wake lock 1 IoCs

Processes:

test.app

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock test.app

pid	process
4592	test.app

description	ioc	process
File opened for read	/proc/cpuinfo	test.app

description	ioc	process
File opened for read	/proc/meminfo	test.app

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	test.app

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	test.app

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	test.app

test.app
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Tries to add a device administrator.
- Acquires the wake lock
PID:4592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/test.app/databases/a
Filesize
20KB

MD5
57baf3e42a94e8dd82e267b2f0619330

SHA1
76512dd29fbaf3cfd2efeae0ac2ab5108b81af19

SHA256
49a98902c1ffb97354f0e8f0f9208b84dfabaa826635f6ade1fc782169a3ec7c

SHA512
227f9d10a39fb0d8ae0a562e3b983fde44de62b3dbcd577172451e0e1f669e5721ba653c324af7c4d022032edd951cc417805a4eeafd5e84f28d378b9126a690

Download Submit
/data/user/0/test.app/databases/a-journal
Filesize
512B

MD5
7850e125d415b105ee7ae90aea963564

SHA1
de5afc5b279380dd3db13be05b1674c0109ccc0c

SHA256
bd8623fdadfda1b905efa8ee46ed3e1e5476c5c6bc55f208057db66b5605b763

SHA512
f1ea60be67530a1b204db3a193ef25747d1deed9d48344f7056420ec7734da1ab4d9eaa5a218310795163304ab0979d63a9aeec69cdaab513f622c7967b234fc

Download Submit
/data/user/0/test.app/databases/a-journal
Filesize
8KB

MD5
2f38ab9487d52723b469d8dafb017406

SHA1
686f30ed58fe998248f2eb785bb6c49d4d743d2f

SHA256
e03588b61df21d3f450f78d2047ea1e67fc9d30dd7c365f5887642ac78d459b4

SHA512
50bb29eef54dbb8196b4238d60a4e69755e524eff035f205a2028b4ec1dc0501cd6f352f0b04582ca09a7026092b5d100f543f0ad556f630c761131596c3759b

Download Submit
/data/user/0/test.app/databases/a-journal
Filesize
8KB

MD5
a4eaddc86516afd4a7df8a842a54ef63

SHA1
9cf97f677467c9e37a9ace6d74a2b6b77b40a6c8

SHA256
7b4d6b9ae8be07b8195876bbee0459d8a84917d7ac598544e5ee854f1842cb9d

SHA512
1685b69347487527ddbd5fb1d362e88f7141eaeef7287d9bb06af215ca980a186c8f83287c6ff18e5e115c6d90d694c1418e5996fdd204af069de61d7a2a0917

Download Submit
/data/user/0/test.app/databases/b
Filesize
20KB

MD5
22038629789dfb4b6a59a09503d4e6d5

SHA1
4aed007e8af5bea689d209acdcace1315750633e

SHA256
61b4315397ed9f7ce8cbf52f77ced4fb63c20a235339a3bb16f8a0196ab23e14

SHA512
278979536df9ec9a089d9192adc4a60da0aeb1509c75840baebcb8e91f82ae61ab2de71c0276f34a652841befc2f09df9e47a47f3fef27ce2b7ea93135cd3c56

Download Submit
/data/user/0/test.app/databases/b-journal
Filesize
512B

MD5
c5f37c89bffe37e9e9bd98b9baab25bf

SHA1
b6395e8fa3209b3e2daf521d8d91b80857ee0899

SHA256
a9d6545363e7f842a35c7f7351bfd9c78bc355b187adadee7ea31be00b851dbb

SHA512
2aee4f899f1b54ce46da424eab6f71adecdcd69bcc22cfd9ef11bbc77ec138e9a6398c4a494d8c0f7d134eb091b965366dfc068db088ed89b8a8157f5c84582e

Download Submit
/data/user/0/test.app/databases/b-journal
Filesize
8KB

MD5
520eaf2227b7c2c62c713830edbc2b6a

SHA1
e5a27f9b723755111fc424ea1f1c87fc130d9659

SHA256
7d6820afc3e30eaf26355b8602225aaeea9108d8aaa8a315d1505e06a8d146d8

SHA512
3731ec31268967e4a7ec928331b7ed9c596ffb9adcbe25d389832d43352175101af5560254477445cbd0d54d36e97d33bfa712f282194861e8dc522f91d65182

Download Submit
/data/user/0/test.app/databases/b-journal
Filesize
8KB

MD5
ae44ed2900f19eebbdc737285b0867e2

SHA1
d212423647b571c463d1de4dbe09fbb5dd8c675e

SHA256
6237c4490459c4f6f75e965d63d1628fb58396d389f416d8e07541ff18f9fc78

SHA512
b34f83df7af12520b7fcd32f39522ba39764f14599e17d20e8556e97fa87da782b40e704a600c5afe5ebb801902199fd52fbdfb6bd2abd3b1f729c00defd059b

Download Submit
/data/user/0/test.app/databases/e
Filesize
20KB

MD5
191705d047cf7a1d23febeb0b3c55469

SHA1
7ad3b5743d1e95f738c6fd176855574d25dbeb4c

SHA256
fc837afa5df95bc863cb3502cd85ebfe298c1241e0f44244bb046d1fc0d01686

SHA512
b687872bb8a07a2d6f45479db269db477e2357d1248669a829b4efd5891e1916bb4de55cb1529cdd7cb78c0f198e5b3f0f6fba4f4bf6c4d879448dcf2e121579

Download Submit
/data/user/0/test.app/databases/e-journal
Filesize
512B

MD5
5b20e83427d1f511944a3a422bc1a701

SHA1
2cfe68041bcbb7255a5ab9cea7c8c05d6e0431dc

SHA256
97f5b77ccc518f51063122643f72473fb41a5037bba3d9aedf2bd594085233a0

SHA512
595cb970b96f51a9f79c226febdf780456933127b1bb27531fcdf4dd9e6f0da7bdc006cf9ddd28a905eff1164eeefd73be8332a92f33f8c528b78d5853e1be71

Download Submit
/data/user/0/test.app/databases/e-journal
Filesize
8KB

MD5
6089029e67a09f6032e994d374007f5e

SHA1
adcd43518b6897938ea21d96756591975192fc1f

SHA256
482a9798aa4ca0a2afaf14e20906b0814b1bf3e6f0a43bb5bf943c63c7440b32

SHA512
74141376261a698468669715896f2b27421945f61f4faa113dcb6fc32bbf5aab93903485fbea464918925358d0ac87e96f185b3ed1300d8d638857b641b033ee

Download Submit
/data/user/0/test.app/databases/e-journal
Filesize
8KB

MD5
20a23fc271f0c48b2d3a71ae854134db

SHA1
2ccb013168de00ef5c2b045c4eaea41bd30a42fc

SHA256
55149ec802087e176d1cc019ea5c7a7aac17a850e9de3aac6ec670b8c56e4246

SHA512
d6b516e401f9a704cbab9c03f3291ca07f091bc393afcb3875cc763c32560a7ac5854e32f0c0d081ddc3a8f1e585862770a99acf7bdc9cb0848e2d88d448e4cd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads