Analysis

  • max time kernel
    6s
  • max time network
    152s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    02-05-2024 01:14

General

  • Target

    32e4dee58ea17addc5df4ffb862ab3a8df1697598cb6437f92de4075665812c2.apk

  • Size

    1.4MB

  • MD5

    d59a4848b584fdd93eb3d0b554a8df58

  • SHA1

    c60756e85bc596c61fdd4caf3fec9a0d995c4274

  • SHA256

    32e4dee58ea17addc5df4ffb862ab3a8df1697598cb6437f92de4075665812c2

  • SHA512

    2c34e5cac3ef7063f5ce145975b6fdd025753005b6352d1f2b83aac9c7cfd15f3e065dffb4aab9c1815626277d8c28ade94e5d7ae8803d7349a9f573fe6a0ee8

  • SSDEEP

    24576:UsMX7QNP9BBPhW70qVZybbQe7mPbDYxNR18jregpfOV/4zgdfw:UjodEIqqXQe7ag/8regpfWzd4

Malware Config

Signatures

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs

Processes

  • com.gejalevubakupa.sugi
    1⤵
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    PID:4186

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    0efa1eaec461c62c288071b2f4226168

    SHA1

    63b17c47b4febb51f895d30551b9114e8e0e9f58

    SHA256

    0cf1406b2d1474414037977aa9541f7549acf7b2974fe6bd07fac2b12730a6a5

    SHA512

    2991759f5542d5db288687e608415b7b22f862ccecb69ea024b02f18745096157078b2280e1282ba7acd8aaad1d872a3325831f7637125399d931d508ab90201

  • /data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-shm

    Filesize

    28KB

    MD5

    cf845a781c107ec1346e849c9dd1b7e8

    SHA1

    b44ccc7f7d519352422e59ee8b0bdbac881768a7

    SHA256

    18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

    SHA512

    4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

  • /data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    d50abd6cc739b4ddb8181f90c52c0807

    SHA1

    f02d3bab1db1cee9de0b70c838b8d919f4648aab

    SHA256

    a48b1579027e30ed202eed06138731c1369fc5412416aea7e4e07e6d80448ca4

    SHA512

    9a0dcd7ec772550f6af927cfe9109308f074a340440ac42cda790c20e42038de90fcf836f10b69c12c253243ac0da9c19cf2645fe1fbd3b57ecdc9689dd89c90

  • /data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-wal

    Filesize

    112KB

    MD5

    d021a43f795de01515d0a26792b4b26a

    SHA1

    f5c62c4f54d8116853e13d4d55828ef772a29774

    SHA256

    e2f886ef0c0542d7ea42652b40425d1601aefde22c75e7f02e94f36bad753001

    SHA512

    a9ad92877d4e377ce69aa4dfae0c358264f62978b25f908a4e3f7eaa573770851f15e47996164b5869e7e7c06e4b8b092e4613a376dab79c6b935943353767a3

  • /data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-wal

    Filesize

    185KB

    MD5

    3ba5e21718fa30d077a1467614e57ce9

    SHA1

    523027d230470653fea4e3be1e8ac98c4edb0a77

    SHA256

    1b28f1f028334bf1602bf9ac6fb44c67c87c51c0415feb60baea795c11f371a0

    SHA512

    8da3505e01191bec3224f964107a15799000e4449c10e98e180287766e0309fd970d4852828bede80b79988b6d80d3882a2870bc9f8a0a1dec9864efd3cd5ca7