a321ebaa92dce5836cb0fce6743f4ff5b2b177350d74fd6822da82baaa3c8a92

Analysis

max time kernel
27s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22/05/2024, 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

drawer.apk
Size

3.5MB
MD5

fbab3b301d93a9eb4c62f0802beba473
SHA1

9e9dfecf608d27c747fafcdbf5e5ca61774c199c
SHA256

a321ebaa92dce5836cb0fce6743f4ff5b2b177350d74fd6822da82baaa3c8a92
SHA512

1474b541fac318f67cc2c17288eaa4e0f0e0ab8e998b79998cac7bc97ae79cc9116d4d8c8bbcc6dac1625179de124347f3fc63217c701988ff8a688690ce7fae
SSDEEP

98304:q41/9CTd3wz/yw3evtmVQCHgXyBx7BEIBYrmlnd:q456dAz53amVQCHH7BJYGd

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sherdle.webtoapp.demo

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.sherdle.webtoapp.demo

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.sherdle.webtoapp.demo

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.sherdle.webtoapp.demo

com.sherdle.webtoapp.demo
1⤵
- Checks CPU information
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4311

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads