Overview
overview
7Static
static
1apk+.json
windows7-x64
3apk+.json
windows10-2004-x64
3base.apk
android-9-x86
7base.apk
android-10-x64
7base.apk
android-11-x64
7split_config.es.apk
android-9-x86
split_config.es.apk
android-10-x64
split_config.es.apk
android-11-x64
split_conf...pi.apk
android-9-x86
split_conf...pi.apk
android-10-x64
split_conf...pi.apk
android-11-x64
Analysis
-
max time kernel
307s -
max time network
340s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
22-05-2024 05:43
Static task
static1
Behavioral task
behavioral1
Sample
apk+.json
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
apk+.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
base.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral4
Sample
base.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral5
Sample
base.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral6
Sample
split_config.es.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral7
Sample
split_config.es.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral8
Sample
split_config.es.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral9
Sample
split_config.xxhdpi.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral10
Sample
split_config.xxhdpi.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral11
Sample
split_config.xxhdpi.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
base.apk
-
Size
3.5MB
-
MD5
193a62dcd89032dff96dcd0c6a756e69
-
SHA1
104b70fb2f8441ab335cf9cb4fe0e607e2cbb575
-
SHA256
b1716b11437276c5ed72367862010bd399b382e790d0ec3e77fa51a6c421eb5d
-
SHA512
751db3f074513ef1ac468ee54130203ba5a61cda79f7f24b73a2e4e665155aab3684d8a82e46b9df550806e3722324872662b5df5684468eb5ce3d75fc850f10
-
SSDEEP
98304:1OB/VsYoPDoq9sEpoMPtqTuqL7g/sIDatEXhgHNOVB5oTwrLfAV:1OBjkNoItEui8Ce3N8
Malware Config
Signatures
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
territorial.iodescription ioc process File opened for read /proc/cpuinfo territorial.io -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
territorial.iodescription ioc process File opened for read /proc/meminfo territorial.io -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
territorial.iodescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener territorial.io -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
territorial.iodescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone territorial.io -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
territorial.iodescription ioc process Framework service call android.app.IActivityManager.registerReceiver territorial.io
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/territorial.io/files/indexUpdated.htmlFilesize
475KB
MD50dbb525498e7881e2d7dba6cb43b0d2e
SHA1953776f122da96459c2441c5f8121635c17aebe7
SHA2561c8330f97452a01f92f1f2e7d2cab969d95710936f82127a2747f01310025b08
SHA512dce8301fcd4dd4c1bb357548d70dfb6378161eb451a751edc68a8cdaa9af60c9d4dd8f5820fee201b16f1238fb3b7adc595c395ccd9e3ebc68c79987cc849212
-
/data/data/territorial.io/files/profileInstalledFilesize
24B
MD5aeab2c1e3f8d05d95bde1eda5dcb1d65
SHA1cf374860e82f2c09ab7b7001fa1951f172cba754
SHA25695b0f13e66eb836ba85f53945acec7346b6b594a4fac30808a8bce5abb99fff5
SHA51235c968d0a6b3ff3704d5e0aa6b299d4353d9e395a6a36ad7fcf43c232e5f8e0b197fb82ce789850c7a711684fae9c9469f28a4e077c267ad02a42842cc87de32
-
/data/data/territorial.io/files/profileinstaller_profileWrittenFor_lastUpdateTime.datFilesize
8B
MD5fcec44fbe53917d0cd44bfab1d3aa6e4
SHA17086a8a58c07b65ee67dde042ae293652eb45687
SHA2569a18badce54f7941bed766a6ee493c4b0a6f9a264ec95c8984ab77db14eaa519
SHA5120c65d82e502319b923ba54df7d8f058dc0b776c293ed3b55a9063cb18b12a36655799514be2a91b417daa10bf45efae6aa8b1ffdc8a9a90178a4de40042bb928
-
/data/data/territorial.io/no_backup/androidx.work.workdbFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/territorial.io/no_backup/androidx.work.workdb-journalFilesize
512B
MD598ca3c767cb57c193a8002d583d5a123
SHA1e24f61a06661c04a53d8f741ceae659fe471880f
SHA2569989ebb37af8f5f50e2d61cbec262c8a60a92305f1572e96abc6587e9632db49
SHA512920f0b718b2567150efc99b16e4a3e36b6873cb8c3388c6a069f63dfd31aaf1d49d62464320ab30d8e801303bcd6e998e95c190f5f2ed17191c267a4cfce5f35
-
/data/data/territorial.io/no_backup/androidx.work.workdb-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/territorial.io/no_backup/androidx.work.workdb-walFilesize
16KB
MD520328fb6c55151ebf6d83ff10219685f
SHA16e83c6dabd3315f5d399918a69d44a28b5d36e9c
SHA256ed86b482f42cfb9b6a6712759f48901e379c35006ce9e5e490a1e777aeb7ed82
SHA512c89d8e96650dc295a39c0f3ac9e81f27211a1415ea706af4d32fec8f4b1bb933292fd3843a68ec3fbdfe0df7d3d5fbb2e70437c6ec4f7470bfd19e8cd2714730
-
/data/data/territorial.io/no_backup/androidx.work.workdb-walFilesize
108KB
MD5f6cd7936583886a064f0cba6e15db048
SHA1e00d5ace8913c3e13f6d886fb4571a3360d7a8ab
SHA256af56d79da9770ec00bdafb6a35ed43c108d9e0849b61e2f5a9f658fdb6ce012d
SHA512c891778cb8bcf8c296a29b5178772111f2417975a6d677fdbd7810ef5a0665f4332cd81e68006a13e9d46469dd7aa70e5e707593b1aebb4791da2f204bf2f14c
-
/data/misc/profiles/cur/0/territorial.io/primary.profFilesize
3KB
MD501cb18bbae7d42c7c5225e5ab9a43dc1
SHA1cdd2c4527c654e7a9712681935b12c9cf3ce648a
SHA256a22fc8028d814dde8e73ae1805ec84213a38b23490f21209f5eea55fe9813c81
SHA512434ce12bbd02676e0625a41b0b1b4415cf4f2f622db1a8e52a1418879be764165e8efc4eb92b276938243b1fbf035270b6b1d3bdbec6abb4325fbde771e1ff3f
-
/data/misc/profiles/cur/0/territorial.io/primary.profFilesize
930B
MD55ff3ab152ed8e0bb6127427f8a6bd559
SHA1dba449a9b9da2c601766da3180943c830a79fd3e
SHA25656434102fb84308bdf7dfef415ebbb0c7a38b6630f1b97ed6c3cc1db47afb143
SHA512206386af05c0b3364beb20103181545c52a50ca0e2a873f6746d63fd2d3dbb63664345fb5ad19a8e430ebe0cb0c524116ab66d37736c01979d701d849d4f1422