e05defa5261ef82a332a39685ec405516e7080c4cd550422a2db38e47922055b

Analysis

max time kernel
7s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240506-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system
submitted
11-05-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e05defa5261ef82a332a39685ec405516e7080c4cd550422a2db38e47922055b.apk
Size

3.4MB
MD5

020607325599ddbfb956f1e4b9723065
SHA1

a068a8eff52a8a75faa3cf934ef5633d76840f49
SHA256

e05defa5261ef82a332a39685ec405516e7080c4cd550422a2db38e47922055b
SHA512

e77a7a719422b332e666a876f5d856e47173c439d849a25d21715a6dbda9fd6c4396a0934bbbc7fcf0aec04099f208733d3e288ad19cb0713e70c0523cdbd15b
SSDEEP

98304:C1+hKSo6QcUiaUToTwr5L6l03meemCThQ08uQxW4ta:C1WKSo6qiPe026094c

Score

7^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.drnull.v5

description ioc process

File opened for read /proc/meminfo com.drnull.v5
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.drnull.v5

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.drnull.v5
Acquires the wake lock 1 IoCs

Processes:

com.drnull.v5

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.drnull.v5
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.drnull.v5

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.drnull.v5
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.drnull.v5

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.drnull.v5

description	ioc	process
File opened for read	/proc/meminfo	com.drnull.v5

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.drnull.v5

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.drnull.v5

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

com.drnull.v5
1⤵
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4875

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
56KB

MD5
4712dd759a2d3396322514bd038c830c

SHA1
d370b4b8c136708a1a8a69ae0ee845858a476e87

SHA256
85d29d87d972a5e82f2ef8058691ff4ab7c2b7b20a9521f2a402660f167b1402

SHA512
3b93df45a3a5512ef718838ee80bed786fc85b9dfa644344431a96bc0215aa960ba7f4a7c6f1bbe47b718a8bde735560e00caf46aef19cec63c4293124c3268e

Download Submit
/data/user/0/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
815144bd0959a330e84bc89c2ea3b8b1

SHA1
595924fc2f65b74d6f6fbb124cb9e505544ab10c

SHA256
bcd64a8d075e105eaa0ccabc18f89c86541534249539b14e5dc349db0d04803c

SHA512
deac84bdc8793f4663f701cb5b2e01220923404def7850f850c28425115931a6c7f42163eedf7c834be79d2436d059184f0ebb5da06b7f23091bceaa8941be1c

Download Submit
/data/user/0/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
6b1cea0b4053cb4f1138d7ed9be28fb9

SHA1
116827bf1efc2a5f7aa59df3dc3b7ff1b661a9ed

SHA256
88a3fc6cc5df251e8d7088e52beb6e1774c1d9b282695518f93723cffd6cbdf6

SHA512
06295ac1fe33b9f6f3a978e6eb2ccabd6a0075a350e7c3d68160d4e13a96400c37df2c11331dc5c38d9b749cfb831749de79b71d314526b57f24b5b20ba656fe

Download Submit
/data/user/0/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
c928859912fa94554c3d85b70e1e5a9b

SHA1
8a01e58452513684801802ac580cd563c74fa1e9

SHA256
070a7e9ace91d3e16114c9c601b55de348d9f8a9082cb132b6eed79f44bcef48

SHA512
d6ad285036e008a238706579a7e1bed9882f822b24d415314338c4440f455eb4628ba275d6da6fbd694212c2a4e607d9d3767036b6f7b7dc18bf308f319be62d

Download Submit
/data/user/0/com.drnull.v5/files/PersistedInstallation3268802500885577190tmp

Filesize
570B

MD5
14bc62955159958a2cff9adda3d8d10d

SHA1
435e0691d7b2cd1accf6039cad6fd337ed58d94a

SHA256
ae6efd5ec8cd61cf1c84b7574307417cd534614c17aef5ae399558d1b9fbc6eb

SHA512
47443ccaef163c3d9d2879463d07df6c167ca9fe81650f1e6a6a87ed755515eb11fde82fa2428d69a9e01bfbf06434b829fe664e2ad0cf4ef0c94789993dd96f

Download Submit
/data/user/0/com.drnull.v5/files/PersistedInstallation6991153809574426592tmp

Filesize
90B

MD5
7f1c2d44bccac66d7150cabb9a665bc0

SHA1
9a578f9d17e9bb106427ae7635d07d8e79b94517

SHA256
ff81a43d595de20356be78c554f6b895b083abbd0231cc904fc9f9af61aa25a1

SHA512
e9aaf4eb85a4539bc482692410479a74bcbf7ba656d871d977050e13a2cc413a0988f1f9f7491edf77f9a33dbed725df3f297e8fa5fd4455af6141d12d4e3b47

Download Submit
/data/user/0/com.drnull.v5/files/database.db

Filesize
102B

MD5
f32d2fc25d7e1ae68f1f1e2d6b1fc741

SHA1
cc36107a8fab9f34f36bf403829f1efa537f8965

SHA256
dca459088dcdc08101714ee975b50eaf4fcc4562c894db440d89ff267ae61b85

SHA512
2a64caf36dd54b8cdcc9de2e63826982c42e427b0de2382c6ed57a14c28fe3d46f2c401288459592b4089f94a101399fefbfedefe9033f5e679624ee84ec50ee

Download Submit