654e2cd54529f03d48dd196c65051db18af984e59f88c48a5f2bd8c538581bcc

Analysis

max time kernel
9s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
16-05-2024 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

صیانت.apk
Size

2.8MB
MD5

beccc97980716f98f9edd058018bc90f
SHA1

a0f0da9b1306f2a1ce64246161467b2694190ec6
SHA256

654e2cd54529f03d48dd196c65051db18af984e59f88c48a5f2bd8c538581bcc
SHA512

461e298e37e57c075dd2dd43c3dda5f223c6b62d5a910215ed7701318e2db9940c79f0a5234297b3abc712eaa7ce35e9a034663de92edd1ec7bd64197ce226c5
SSDEEP

49152:4/QsZrOCIQVl2KGQx472EXF0/BgrUIwGoKUOPNUzgwcLAB3nxNd3JFaWY:m26lZS72EXF0/8VwxKjPWzMLAhxP3Haf

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.mycarroll.app

description	ioc	Process
File opened for read	/proc/meminfo	com.mycarroll.app

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

com.mycarroll.app

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.mycarroll.app

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.mycarroll.app

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mycarroll.app

Acquires the wake lock 1 IoCs

Processes:

com.mycarroll.app

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mycarroll.app

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

com.mycarroll.app

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mycarroll.app

com.mycarroll.app
1⤵
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4204
- ping -c 2 -W 10 -v google.com
  2⤵
  PID:4253
- ping -c 2 -W 10 -v google.com
  2⤵
  PID:4349

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.mycarroll.app/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db

Filesize
16KB

MD5
c7a6071431c4be51cad0dc556a633ed3

SHA1
fb9fdb25ed060d30df7d99083c50c1450c5d7b8c

SHA256
7fdb54d6cc8042d9f1a4b3553cfb10adbfae8e60e5e91a736593356480472937

SHA512
4fe9a0bef4a849e34263cb56d19275a038db3909ec8b536b9d856b6210b652e77c2642e337e067e344ddc089a4308c7475545ac034104b270c670f12f25afe4c

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db

Filesize
16KB

MD5
6207d41793e9125bdfda6ebefcf5231c

SHA1
a18b8e7b3d7de31bf91adbc89dec2a4855bceee1

SHA256
f06ca215345e7cd5519dcdf6d8e526895fd65b6c032da09e001073330aef658c

SHA512
c84097ed8d4e72ae39cde397f1386e1c4083c7742b8cfabca54f431032e386869a88baa1bdc524f5e4993d59ce8266ba0d2017ae29c264fb2bfb3ebf70b48ada

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db

Filesize
16KB

MD5
8ce826a5950ad97c90829ba63d50d2ef

SHA1
ce6ef318fc083fc46c66da7d0f0c1aa74239b956

SHA256
505680559bdaff64f29cd8ea67922d41c1a5c4a3b2f80a28d8f07793580c9485

SHA512
c05840fba1674e8ae3d790db0e7cfce34ca706bd4d3fc602394760f0e267c031cd20d0f2e6d6cd32d624dcf3e36f4203f7b6fb2ba79921f8e806c43fe63a6d18

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db

Filesize
16KB

MD5
1337ab667aa8986497e7651268c81fbf

SHA1
02f09cc3641fc45f07d0e8cec3f84c674b74337b

SHA256
ac802fb5d9470373ee86dd3140ad5dce398f4657759394d55b4074b5c55ef04a

SHA512
97c2eef40d6842138af2693d76e11568eaa35ff844b4fdc64b529d2b8eb299f9eb0ee71f58f9340581ff122d7ad76c7a8e5e0fbf9e7d7fae889bce2cd0527566

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db

Filesize
16KB

MD5
6e51f0580a08c55cb6598dee996c9be5

SHA1
225ee2d2dc97eb5e816e7c219c2212f7ac57a835

SHA256
6de59d2460af67b546c95f2ac9d7f38945f3bbfc46645c7f291ecb1dcfe05ace

SHA512
baacdfdef9d5d6abab374878f63d6749862f7f2bee7d27ec859ba2655d21fda76721bed71d1bde0799c332b0ebb6ce317d18c08706e36b04b0c0768fabe89f90

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7237409e0640cfab7bdbd429bf821a3b

SHA1
4c3da934842f8d4835dfe2a9c275a300e5123309

SHA256
5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

SHA512
c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
737a78e9143d57e70aab91fce8d7f4ff

SHA1
ee0eda62ca6ba05ff0533c992718e965229f8241

SHA256
5ca7830a95b99c18798e11aaa33beb20b3c553ff767cfa9877f9521bd1fb5f52

SHA512
6a263e4686a544ebb8dc357d973582c3566d30afeeae5b87571b20c5424eb79deac15052a64f7ba48406f65b601cfde18173e627c11a8dcab645a13663b2308a

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
ed7093f3c21d0614cdd360cfffedcdbd

SHA1
eba0c88b740dfba1d3aab5ba66b106fd80515821

SHA256
3a171ee13f6e8c930e5871c510f3e1d2e79e10c760ad59c1644a6c3cca9f1d54

SHA512
75561a6389f052a4f3de1f776f8cac987f24d1fb23c99bed0db91820b58c0e93352e20f7fd2890f423a1fc5a6d24844e662a98f65fe21e08d00b1243424f3064

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
0a30d77401c63d5dfd1fab068357e0a9

SHA1
0158b6e6d8e81ae53d3ea7cede7144e2720d3e3f

SHA256
48744ad6777a6ca88a2870980885154f9589740b04b4b934e8e1d77d2c0a427d

SHA512
2537fd1b3999ad1767f7e79bb251cfb46a139c1ae5208566da73461f7c49e6cbd911e004732fcdab723d847441522a2722bf61eea1d7b4685e9c3ef3d5bad2a4

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
14bd20bfa2c59a9e25fae24c528ae11b

SHA1
94bc248c52bc962aabf267d7d630b5d87e89e62a

SHA256
06b547bc38152d730b07021d5952fcc2d117d54fd162776d6841cdd4fbedebd8

SHA512
20a715a95459b6dcc7545f19f65f69a0b1263152ce21b8edea0f13289de7a5b1bfb2db7f6ddabcac9a8059b7f41bc886746bfc97c9d78fb2ceca5d725ddc4833

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
959a90b17fca03a901c892aff8172da7

SHA1
1f609aa5977c69d7c3294fa95ec554a7f196fecd

SHA256
d53279ed31c0d3e54457146e72dda6d953723480bb8c48b24bf82ce961a1e9d5

SHA512
2ff54a68f78f84e7dc1cb657182f7338c045677157c4fb2749bfc72a66aecd89ff1533cf7a693e16c4c05818d79ff077cfcfa36fd14966631d7edc9c6f189f09

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
b9d9dd3b13c73f3334e9c67f3440e8cf

SHA1
e4a5ec57f8213a6097063bc8c122e50beeb51ad9

SHA256
84282e253ec08fb953bae7f17b9f64f472de56920b20b8de97268a3cc371ed98

SHA512
1b190d65f1df609d29a2df1b40665ee7cd619fac89eea2ec56f62034d6742c34649a54d87d43186a40c0d523e11a4d91afceda397c0dcdb814a1cb07b57e6d10

Download Submit
/data/data/com.mycarroll.app/databases/google_app_measurement_local.db-wal

Filesize
36KB

MD5
9a51d25fee8c4b283c22daeda704e905

SHA1
d388eb9540b57c15cb85440c8e8bd06d68ad25b2

SHA256
41742f6fa551c64d1519c0d67302bd414bdd5c3bcdfafef20828ebeba3015b61

SHA512
2ae491cb2f35d10f2d818ebd8281cbe4e65018751bef1d0ebd219dbce67d5ae38ffb503d69392c93ad507e7b87c0ac8ff347d152dbabe8170bcf5e8c4f7f8b61

Download Submit
/data/data/com.mycarroll.app/files/MessageId

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
/data/data/com.mycarroll.app/files/PersistedInstallation4753401837221066957tmp

Filesize
567B

MD5
1dc5485fd6753a7cbc4be3b88aecf42d

SHA1
aa8450531f3b76a4be604dc87ae8c7c57f325d24

SHA256
aaa1aa5949b9074ba346b6aea00da25c662fc4bc810bae58d3f33ff2c5c8fc61

SHA512
943570a9e8469614455d2604e079e5caa4981f4086103b325fe98946154bc0c6f30908de10d8288597234f4c76f7a59eed557d95fb65bb83cbaa0032967990a8

Download Submit
/data/data/com.mycarroll.app/files/PersistedInstallation7022450315631262294tmp

Filesize
90B

MD5
3948a238c336e43bbacc3dd3ff16c2f5

SHA1
d3dcb750c11723acd5a6231308c0acd91fc03842

SHA256
9ebe96eeffca3e02b27fcb936025f33ff0f4c43da90ddd7587d25b6c8c78003e

SHA512
6e256144b719de6981e60677e40eeda045a285b4186820cd4ae1c42e3bf5180b8a39c4aac5b8ee60deb4fe780cdd0c0d63ee7e812466df6486436a87df483944

Download Submit
/data/data/com.mycarroll.app/files/port.txt

Filesize
3B

MD5
4f030a02e1a1b7c16733403b65164e5b

SHA1
d463a841c6ddd212bedfb1e68c7639426e354f0f

SHA256
46fde00bfa275b287932e1a651e072c36a0a43c50d41f922f5ed72e9b3734441

SHA512
902d226fbdbad3178c7f9390c0762620cd31595e7f582b926a552edf5d3bdaf379ca4cc53f6263b5a8fc305a3dd2c805280ebb1d9ba79213d67b87d3c13e416b

Download Submit
/data/data/com.mycarroll.app/files/user_code

Filesize
6B

MD5
3f22feff5f36ff0d51abbe995ef17be1

SHA1
0de9dd0c671feb4d04dd96b9b0561e4d2a80c417

SHA256
bb4359fc6bf89058b558a539ce3df1fd2283d335666a27d4b7a190aad7c036fe

SHA512
630709acca2c317e570e9dc9edf369b27e76fcb692f1d6b17cb505777b5d6d128ad80b9d9ba049d9f4a357d8b9a08651a6f906af13e0d163289b4af47b6e3c9f

Download Submit