29b0d86ae68d83f9578c3f36041df943195bc55a7f3f1d45a9c23f145d75af9d

Analysis

max time kernel
48s
max time network
130s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
17/05/2024, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f2b73a6f2a7816e54ff0b15b9dd555f.apk
Size 4.1MB
Sample240517-w1brpacf26
SHA256 29b0d86ae68d83f9578c3f36041df943195bc55a7f3f1d45a9c23f145d75af9d
MD5 4f2b73a6f2a7816e54ff0b15b9dd555f
SHA1 f6e585e552cfdfc762d809a95bd48e41bc15c605
SHA512 9d7759eee7082f28439ffb17e81c366dc1b92f15c074643bdd42d76fd404257e46bb644c3dccc7ce35efb734cb7e5f7a45393590ef75909654d6a9c463425a2d
SSDEEP 98304:F+iSqvb1KDI75XCuRHDwodfeeC8sB34wT+/ayBP77GSj10GAa:dSqDQDSjK8o3NT+/797eGAa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion execution persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.android.googleservices

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	com.android.googleservices

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.android.googleservices

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.android.googleservices

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	com.android.googleservices

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.android.googleservices

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.android.googleservices

com.android.googleservices
1⤵
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Queries information about the current Wi-Fi connection
- Reads the contacts stored on the device.
- Reads the content of the call log.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:5090

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

Call Log

T1636.002

Contact List

T1636.003

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_base

Path /data/data/com.android.googleservices/databases/data_base
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

data_base-journal

Path /data/data/com.android.googleservices/databases/data_base-journal
Size 512B
SHA256 bacdf16b63211f8fbb257902276aadbb592346067e16617487104b34d66c90da
MD5 a80cae5efbcf6e21bd156204079f03a1
SHA1 d6ba99cde72960b6489013a5bc21fd53dcbcf392
SHA512 4d5b701c000a3ad3d36ed9e3ac8e2c6ce12ec8e88f7b12acf44c6da4001e2c7ef067f95de3453206a81f091f11e3ada2f327943b6f44c4f7c5ea9a9b6f4648fd
MD5 SHA1 SHA512

Submit Download

data_base-shm

Path /data/data/com.android.googleservices/databases/data_base-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_base-wal

Path /data/data/com.android.googleservices/databases/data_base-wal
Size 16KB
SHA256 49bdce87af5c98fe962a4569b7a947df62e70e887820a819e550d18abbd329a8
MD5 145863bc41cd9484d804518a7fa873d4
SHA1 41f6c027670a1bd8733a01d4593c7c0967094596
SHA512 6dc21acacb1318be597d44a43ad34bf7053cc1253e677d72238b1536b40f7a813bfd9a24cce3980acd9e907e6a1b12148c8c4a12e6e63f26ea3f98d2289d71a3
SSDEEP 6:K87iK+i2iayXEKD9FZdrlOERX4PBX4ogLugMBX4suuK+/ciwhlcX2jcKkJVOw2:K89rKy1zdTRmBEyPbP/zX2jcLzOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_base-wal

Path /data/data/com.android.googleservices/databases/data_base-wal
Size 36KB
SHA256 c9d7d8d93ddd555c7b8a6d3872b9cffb60acd7dee1c7ea7bb134e7fad3917f2f
MD5 48574e14afcf7891fc7f2744034f1056
SHA1 fec7a3662bc2198bf44d35cfd4d0759a287fc6d8
SHA512 7573abe8f50469c1c51b4a70cdb569e43f289da650dca12a44ec2d75c80818ff79256d46d195fd29a7addf7d4faa00b1850ce08f652c2c3f2004438733eef8fa
SSDEEP 24:eQTB66wP/31B6nniGQV10GSP/DelI2T5hK:BTB66u/31B6nniGkSP/D6rK
MD5 SHA1 SHA512 SSDEEP

Submit Download

spydb

Path /data/data/com.android.googleservices/databases/spydb
Size 48KB
SHA256 912617eb4361c36057e9123f97c8119d90b3d458e3d2c5790d19ece7b9ab9cce
MD5 e04505fa5529a0245a8a8b8b1cd0a014
SHA1 9b70870405086cef59f9b0e3df338b93a2279b77
SHA512 fb7f55437a5e091fb57c5b4a67ac13e8f1bf4c10a65bf0f2162635f51c4484878d826115f5a1c3a6c51561e98a00b14a894280ed13967b3d04ebc1393f474130
SSDEEP 24:TLPCr01HOvQ9vFcFSqQnqWqqNNrY1qpGSFGQQQQQQQ:TLCr01H2QNFvqeqWqqN+qsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

spydb-journal

Path /data/data/com.android.googleservices/databases/spydb-journal
Size 512B
SHA256 be3656af9537823a05a198fa5213cce4506e57f3ffb396cb6e8a4a6a8e088011
MD5 0e0178d1abb80a20b5f61eaf6fe79e30
SHA1 4105e8e8ecf41bde46a70a9c5e977acb3d9136f1
SHA512 48ab2acb857de3e9c31f14f4ee92ba453e9dcf1b9acc63a54e52087b78f56920b2b28e7bfe4c5d36393862f2e26000c11de93f90d73b82d8824aef0bef29c11b
MD5 SHA1 SHA512

Submit Download

spydb-journal

Path /data/data/com.android.googleservices/databases/spydb-journal
Size 8KB
SHA256 09ebabe517caadbf2d64b019edfa64c8746440a443fe6e16da41501c3cc98346
MD5 5a13b31f8446ffc36b29bab7ae162bf6
SHA1 89a12615dfd8109ae7b999a32083791b86570098
SHA512 fcf178fb54a216d31c04871a247f4506fda34cdd735f353d19064c1955fb272d72b7970c5d2bf423e2e8495c70317911771d6f5ff1677bc1c02972f9b6690281
SSDEEP 6:7+/l91SFn1vlng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKsv:7+t7olnqLiuWdwRmBEyPbp
MD5 SHA1 SHA512 SSDEEP

Submit Download

spydb-journal

Path /data/data/com.android.googleservices/databases/spydb-journal
Size 8KB
SHA256 a141c558caa77b26c3efbdc792292ddc23dc74ad627a5e5f6bc0178cb251af8a
MD5 392d9f7c93b43f2eee3532cad4c727c6
SHA1 2e92dec3b021b9bf5af9269843259f50a6f12534
SHA512 67925b3e4825304cc4f5e544cd93a11824352a2530abc94c7e8d8f40c85eb0f28d539a40a62e83d15066a3dbacbeed4759c5e216154c4c95fcd7d5d363c28240
SSDEEP 6:7+/l91/OPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKutU/1:7+tPiqLJdTRmBEyPbfC1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads