961606a5c8a4551b28f860da2a8d322e2f0063fcfee07179697bf93d7d94f3a4

Analysis

max time kernel
53s
max time network
150s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
22/05/2024, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Emtiyaz .apk
Size 1.4MB
Sample240522-nypxjaee4w
SHA256 961606a5c8a4551b28f860da2a8d322e2f0063fcfee07179697bf93d7d94f3a4
MD5 a7aab9c22e5deb03fc6e6980fe9ae2d4
SHA1 97be1d11203ab09af5d3ea95be666d61260eb9c2
SHA512 800b4b084ef3965592a29af968cc07e7ce0b79994ad0b0e7f9d970977ff1c5327ded6f6865553ca076c20a5a035606a15b2860c06e0a54d8b36b88156594219d
SSDEEP 24576:V0m7XIv33im7SNjXgxHMSpOdxlbZwsY0vyl4HSZkGZzaRsiv4MUDa5GE:hXCd7SNjwxHMSpmYkHMZ+Rr9UDKGE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	app.emtiyaz
/system/xbin/su	app.emtiyaz

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	app.emtiyaz

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	app.emtiyaz

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	app.emtiyaz

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	app.emtiyaz

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	app.emtiyaz

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	app.emtiyaz

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	app.emtiyaz

Checks the presence of a debugger
evasion

app.emtiyaz
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:5146

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/app.emtiyaz/databases/com.google.android.datatransport.events
Size 32KB
SHA256 a6417906596802ee2a80cd22ef848d832848a6f36f4e45d320e9b98633a5c456
MD5 ad7bbdcce258ba21d0a07659a3849e3f
SHA1 887e17f38cf736cc82125092f6cadd5753184286
SHA512 4519d5aec86a163c9c2c97d1cf9862cc9b421749c0d78c0f4ceee31c9fe07ac557e736d5b3f72942e2d5d44b578fc8a6789f2e7a3ec98ec2199fdc50dd3ac45d
SSDEEP 48:Tk859MEoBdUdndVd/7d5IvdldHlq8/JqFS:AEMEo0LIyNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/app.emtiyaz/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 9eabfa2609186935873983e5065d5bab842874ddd46fa7c4a0b16d0c21fd02a8
MD5 520db88d736efd3f36e47e47a2eb22ac
SHA1 1a065a9b694093e88c7af106c0558e269508a3b6
SHA512 8589c3b21d1b06a96b9eeb6cf15b089ee751d436f7f71b4e8f34ad5910dd6dc07da426a939f1971934a6e623468b62159bdf34fd6fe02699bfc8d60599263a85
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/app.emtiyaz/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 d18a6cd13d999c08d41b3ec3e1c76d060032c515ed5a5a1829623866fb769e94
MD5 dccbf041413b0f2653af40bb648c98aa
SHA1 d75770aa1999d44b122b649edbcff9ef13decca2
SHA512 2eeaa4d2d23f586319968fb243250471914944ff19d2b096c4e3da811e3b0a4e3bda67929965d20a07b30e32d6a031d2e02dbb04d8aa18d5fce94e2d8e431a4c
SSDEEP 6:7+/l9wn1/vfg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKE:7+t4HqLiuWdwRmBEyPbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/app.emtiyaz/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 7b3548f1ea0dd1dacfdebcd5823608103bd82d32c336e85dd543c061237305e1
MD5 672538a40d8a376f3a55b2379e82205d
SHA1 7228932cdc0d2efe60030d9f97c3f43e993e83f6
SHA512 3762e53947d12feb1e9395f55384e4f2f0b27ced025df075eed69a1acc17af82a53eacc6b9750d6e97322fe94ddba04b8234d9117f5a3a2358b60b6a2635c98e
SSDEEP 6:7+/l90QuHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKD//sw:7+t3uvqLJdTRmBEyPbMsw
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/app.emtiyaz/databases/google_app_measurement_local.db
Size 16KB
SHA256 f4344fdd0ac1351893f663125f9994ec451e5f730de2e071ccb92b4fd4058910
MD5 90ebb38d8ae3d484cebb131559079f1a
SHA1 e8b16644bbac544299a1e3b9e3a1821267abefa9
SHA512 fce92427c0ec92378d6404a04a2867c9a3c50c87228c0f22aeb016f9b4e53d67da6ccd0fdc3975e5c5f97ad73f0a4944092ee808e8d67f49741efc5a1b7f83ac
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6HuK:TLiEy9zmzrfRmBEyPbP/P+/0Fl6f7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/app.emtiyaz/databases/google_app_measurement_local.db
Size 16KB
SHA256 48b85439c3c1fb44be4da21bf3ec027481c5cff91e3144b6eed9223b2c4769f3
MD5 095cf55009a99757bbde90774acf7226
SHA1 29d55b493324153e6be72b821aeaa975186decac
SHA512 657c2efec1bdec70acc1e3eb0ed2222a1c788c2e59075655b8677bd990ac3c6140c2c89996166586f87840e4a7f3718add83aa304220883fc7552538b2984a9a
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlYzWV+/0Fl6f7:TLQpmzr0GSP/h1499FzlFO
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/app.emtiyaz/databases/google_app_measurement_local.db
Size 16KB
SHA256 b6ef1954df60b691ae902eac13462896ac4aee32b75e5e5c7d6f1905f02f92fd
MD5 c82c23bd0400dc4ecebb03b8ea5ca09f
SHA1 38bb4105a8935ae19e971a44f4ddc4ce3214c9b6
SHA512 b5ea3b39cd7ed527089f90163bc9bbd11c0632beffebdf492ee85297b3d1dd992e31f5c78a979919bd64cd86027eeb219d7c61be5fddb55a91a66e5ebfae245f
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/ZRhOLavnOAU7wU7UyWlHicB49blqYFlYzWV+/0Fl6f7:TLEvpmzr0GSP/nhKamNZ2DB499FzlFO
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/app.emtiyaz/databases/google_app_measurement_local.db
Size 16KB
SHA256 e9af19ab4b53d057b3e62dc6df647d21d402c0aad923af4c3a07a48e25f159b5
MD5 52816c2951cb66d054d0ccf9e3f1d107
SHA1 d99cda00cefef2a2f2a957657d9767cbf2c7a410
SHA512 4637e9271850123130627a34a0a280a7e27fa8776b23833ee4791c7606b7c8cf650dcee0d96080200e31c78cf1b3dc62bc4d68bbf7e4fe6cbe7bcfc1c1665a0e
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/MDRhOLavnOAU7wU7UyWlHicB49blqYFlYzWV+/0Fl63:TL6Xpmzr0GSP/M9hKamNZ2DB499FzlFK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/app.emtiyaz/databases/google_app_measurement_local.db
Size 16KB
SHA256 dddd24fe03bb4916d4c74e47aa46a1d9ce3c63c745643468682e1c841d1dd01f
MD5 de50a4574b0837d2b186d808e288a2c4
SHA1 b08ec652de8687cb0d1c8d9867837149042a5529
SHA512 4a2a581a71f9d74033836701b05ce7838c3766a8158822dc1013e6793e2e9e8b1da9e720588edd0c23131ca5fb0c967b977cee3695fb87e644206790ee0a1fa9
SSDEEP 6:l9bNFlkls1KlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W4mNt:TL6EK9zmzrfRmBEyPbP/W46t
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/app.emtiyaz/databases/google_app_measurement_local.db
Size 16KB
SHA256 807a730a3fdd317a498fc47219974a77164975674c7bb36d33049a1d02da020d
MD5 a8aef1376c5438521db576a34ef8b02d
SHA1 5aa9aa59da8708a0d459053ed256515232dd6498
SHA512 1ac8bdf63ae848429d7a9f608f7f47aad8bbe6b49af9b03d3c6bb437f18da341518c68cdf3ecc57a80ecb73b0dc076949ae15daee12a05a515c405296a4edfaa
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqNsvfLNs3:TLWuEOe9zmzrfRmBEyPbB9XLW3
MD5 SHA1 SHA512 SSDEEP

Submit Download