ca9872a126ca593117e4474d35473043e7f9c5d6d1713f1bffc313974e4f940c

Analysis

max time kernel
153s
max time network
169s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kaap.apk
Size

8.5MB
MD5

e36bc41209786c568fb2371c824167fd
SHA1

a887f8a0d806aeb723be1680615331b0677e5410
SHA256

ca9872a126ca593117e4474d35473043e7f9c5d6d1713f1bffc313974e4f940c
SHA512

494b5b4f386f54c18576ca28dbafc1b56970d63ba917434f76e3ea1c0c008b8062cd7dee97693afac2cdbe4b36f78aa10532f604ae8da8010ef50c2865c753ab
SSDEEP

196608:pihLG4rpmbcP8cfiDCMVZ44ejnSUYA4WFuOkUBZd:pOLGNIimMVZ44EnSUYAxTBv

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

T1426

Processes:

com.karenpayment.app

ioc process

/system/app/Superuser.apk com.karenpayment.app
/system/xbin/su com.karenpayment.app
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.karenpayment.app

description ioc process

File opened for read /proc/meminfo com.karenpayment.app
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.karenpayment.app

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.karenpayment.app
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.karenpayment.app

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.karenpayment.app
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.karenpayment.app

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.karenpayment.app
Acquires the wake lock 1 IoCs

Processes:

com.karenpayment.app

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.karenpayment.app
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.karenpayment.app

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.karenpayment.app
Checks the presence of a debugger
evasion

ioc	process
/system/app/Superuser.apk	com.karenpayment.app
/system/xbin/su	com.karenpayment.app

description	ioc	process
File opened for read	/proc/meminfo	com.karenpayment.app

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.karenpayment.app

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.karenpayment.app

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.karenpayment.app

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.karenpayment.app

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.karenpayment.app

com.karenpayment.app
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.karenpayment.app/databases/com.google.android.datatransport.events
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.karenpayment.app/databases/com.google.android.datatransport.events-journal
Filesize
512B

MD5
6c1e33896e911b1a2fe03fb4d237cd07

SHA1
2e9bd33c1e7a1d33426ccab2f89d4800a38e5dcb

SHA256
91de4e66c4aa57aeb8891aa4f2fc0e547494065649c91ec44e04c995ddea2b08

SHA512
5c439cd5f654f803a08d1ebab6c21133a5de248aaa9d2893ee6ffa2c6b67fa0ce311351ae967aaad1beb25149235ea49233716a70abfa1020c22a0ed1ac7e31d

Download Submit
/data/data/com.karenpayment.app/databases/com.google.android.datatransport.events-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.karenpayment.app/databases/com.google.android.datatransport.events-wal
Filesize
52KB

MD5
9fc9ea518a8d45b42c6e97e2d2dedbe2

SHA1
ae09a994103876bdf51886fa7874986863d7d8fe

SHA256
851ba039bc385311904ea26dda45a3e9f38ed0c92245171a9c34713c0b59f130

SHA512
294bbff08068e557f7c0af88341c6f36900824e20ef10404a4a85d4f074b9d2755017645e8d4d43344e28405d761b0bb7bbfee46ccc2b9ca7e70aa206e0535a6

Download Submit
/data/data/com.karenpayment.app/databases/crash_reports-journal
Filesize
512B

MD5
da8e991855dca67775cc5a3af48ac7de

SHA1
f50e64ff2989b6996aa6be40b7f3d7454ae41a9d

SHA256
1318edbeabfd1bc89ec3b061fe8f938f3458240714e7ad4d345da4a5029fea9b

SHA512
15473ac793be4ce5f31fb5be40e641f05bc0f24b5348923e378f823eca132d8a71e654b033adc4a08a867df5b08ce93adc2d1cb6dc401d6da8336aa183a83a2c

Download Submit
/data/data/com.karenpayment.app/databases/crash_reports-wal
Filesize
36KB

MD5
fad3f2f14505dbea9b0ca260d5990a0f

SHA1
9118e6d8b3556b7a15004da0ab3df9cdcc3463ab

SHA256
1b33a37e922d7598eda6a32c4fd25e32119769de4c62cbfc09fd7d49366ffe4b

SHA512
43405dac9763a5b3f88873ccf7c217824080d0f2fc2c23c90cebbffaed06a6e396cb7552dbb112147f9072b3b2d27b5f5ee4ed178494ba4ac28addb97ec1b737

Download Submit
/data/data/com.karenpayment.app/databases/google_app_measurement_local.db
Filesize
16KB

MD5
7237409e0640cfab7bdbd429bf821a3b

SHA1
4c3da934842f8d4835dfe2a9c275a300e5123309

SHA256
5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

SHA512
c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

Download Submit
/data/data/com.karenpayment.app/databases/google_app_measurement_local.db
Filesize
16KB

MD5
3c7cb2276a680a457ec8fea56c1191c7

SHA1
c2225a1712a737bc07f5673220bc14476b096ae9

SHA256
11c667e505ffbba7bc551d3333896da289c5fcd74ff94d0392e432165e6bcd79

SHA512
4b26061d86515a00b1bde96bac2e08f244faf04b27fa93080c4d72f0a944d5289217c7487db4d25e64914255d14fe58966a595f70db7215f5659e3eb115a36e9

Download Submit
/data/data/com.karenpayment.app/databases/google_app_measurement_local.db
Filesize
16KB

MD5
f97968facb4f4a1f63728e29e29cbfa2

SHA1
d1d969477dd54400429c4bf5cd4e24a4ca446d34

SHA256
35e340d1cb79ab25df92afcf17162fb5a1c04ccfddeda4cad9f50a3970bbe4ef

SHA512
0e4651b68483b741b28193024d9909f3d6939614356455c9514c247d0c02e0889eddfbd409b2e568af31207ff174fac9d922b6c743b85492db8da4c9c1fb7a6a

Download Submit
/data/data/com.karenpayment.app/databases/google_app_measurement_local.db-journal
Filesize
512B

MD5
f731617cb9353cb801f789e075af4df8

SHA1
bf0469773038e2571a45e450f1810ca4d279e51b

SHA256
ac068f4bb0460a0e75da9c96d5477443876265a8cc7191339dbe59ba776b694a

SHA512
27fbbe3614bdf2c15d63bc233d0345558284b1382ce2260a3eabf28d5d24cb199368c5854f0c49c5b02ec2e3c961ab1d55533e6bc7dbe21a28db4d3307f693ff

Download Submit
/data/data/com.karenpayment.app/databases/google_app_measurement_local.db-wal
Filesize
36KB

MD5
eb16ae6ab93457cca8a5afd57ea83b19

SHA1
e313531614bc0d22a5aac12fd040e3bc9c025582

SHA256
f66bd5f4c1562ad637ac81f79059944d137371844ccb6875086961a80d8ef375

SHA512
fdc697016aebb9e014931d0e3079ebdfc8e7911370262b47df83a8fe6265c840b54fd69fad10867b9bb48bad13db5ea93c1774939b0f05e3e81c4487218a0079

Download Submit
/data/data/com.karenpayment.app/databases/google_app_measurement_local.db-wal
Filesize
4KB

MD5
aab1914e1aad08c1d374d3c10346c59e

SHA1
3dbe30161ff462cdcbdde7e87b0063301cdec1e8

SHA256
a3d5b7f4185d907c7f5856943a18c197db1d9c1829538e104e63da1aeb430a1f

SHA512
2bcfe7d9c58ee6c38fe3a16d8ef86b3655b48e3488215489825bdb5d4eb4132b87ae6d10baaae1cb932a653a165c457d9d12b58ccfe94b0399a02c0081026719

Download Submit
/data/data/com.karenpayment.app/databases/google_app_measurement_local.db-wal
Filesize
4KB

MD5
ca300dc78e73c59e67a009924218b0b6

SHA1
201bef14480846fdaff388364c8458aaaafd1659

SHA256
90bf4959c57251d0ca7e9cfb74fa5e2d32d898a231cb226dd842105ff30d2754

SHA512
228cdd33cb02c2129340b81deef3a6f5a6a3779c355ef55dbf40d3cfe5c72955b766b5e524a3f64f9776431b571ea341a5f2f4637bb95f42b7e45381bc13ade2

Download Submit
/data/data/com.karenpayment.app/files/.com.google.firebase.crashlytics/664DEF650110-0001-10A0-409985770378BeginSession.cls_temp
Filesize
75B

MD5
c9346b4c755247426363b49a8bf3e075

SHA1
98cffe161f05dcc9e0b162b2d056da63459212a4

SHA256
2491cfd636542a837c964d9d7eeb1027c40b6b2d40ee32b62e2a4b99e7c3c728

SHA512
3fc5e8ba4622913bd2aa8adf3e455ac85fefa103c1403d32ca0f86a3cd03a53d833972ace0bcbbe34b00a2f5dfd7c0288adfca70ab18676da199f85bec098aa3

Download Submit
/data/data/com.karenpayment.app/files/.com.google.firebase.crashlytics/664DEF650110-0001-10A0-409985770378SessionApp.cls_temp
Filesize
71B

MD5
8661e5635a07e356f57a9540b98e39f4

SHA1
46856d413a640766467d7f89a78de64d2aa155c0

SHA256
2e388e2e6811c12b2196613fd4dae77b24e781e0b29f7440e3f95418cb8c5235

SHA512
d426c920ece68d6409da26c85786043630991fa2b0cb5455bfad89d7c6d2c9ceb234f84535cbb7cdae3e28d4866fa3cbdef2a1b5f44551bc48253d0383c1dbff

Download Submit
/data/data/com.karenpayment.app/files/.com.google.firebase.crashlytics/664DEF650110-0001-10A0-409985770378SessionDevice.cls_temp
Filesize
48B

MD5
cf9cb0612d588a1f71b63084cea67316

SHA1
3d035bb92fd3f8997160cf8025c40239af74d3ca

SHA256
0d37c5a64baf86735501f9044eeb926b3d46548cdcf67c2cd1f773df36624ac9

SHA512
70f000233e181e3b7c6fcf07aa04fdb570f970335837f8d1c4680a9f78af9f9e17c73a0a5646770f7a8787e338899edc4a5197b023865a4da894b1aca12bf600

Download Submit
/data/data/com.karenpayment.app/files/.com.google.firebase.crashlytics/664DEF650110-0001-10A0-409985770378SessionOS.cls_temp
Filesize
14B

MD5
9b3d4522944ce6396563812bfdb92fa9

SHA1
6d2a6133c8f01938a48ccc77ef86ad8ca335c020

SHA256
d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9

SHA512
091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727

Download Submit
/data/data/com.karenpayment.app/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DEF650110-0001-10A0-409985770378.temp
Filesize
88B

MD5
fb92cbae5d4e891cd4aa7faf13aa7e62

SHA1
c4ca44538bcf1e0a7c9bb9777456d4e79f919dab

SHA256
40a7e05c5f293f58c6b6b6328a7bfc8e0ea030ec7738d79433d0a905affafbd9

SHA512
a7cab7a14f1005b3ea956fe49ee559ffc742a45a53e2a2cfa40b77322bd3c43118c87a1fdd3958f201f837300ab6e145c244ba1472409bfc3bc1cb4de41b4c54

Download Submit
/data/data/com.karenpayment.app/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DEF650110-0001-10A0-409985770378.temp.tmp
Filesize
16B

MD5
c33583fae4e0b61cde1c5b9227963237

SHA1
fe2ebe4d27469af1460f7e852031a04208ef629b

SHA256
35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

SHA512
fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

Download Submit
/data/data/com.karenpayment.app/files/.com.google.firebase.crashlytics/report-persistence/sessions/664DEF650110000110A0409985770378/report
Filesize
743B

MD5
d0dcd9434d31f0a1af57d9c16043dac3

SHA1
cc22122e0d80be1600063fdafe5b2a51ac1b5d93

SHA256
5394a11a6b251fe8ffd982c354d0d57e45e7e3af80a1513c811ecd7aeb134a9b

SHA512
708da46c6452a7a008f2427b5504aada0ee367eee95c943f4bf48d5190cf3684e96a3803aa91763887afa1d2a06b30fe98ebeecac9b3c212b69971d8c5491c4f

Download Submit
/data/data/com.karenpayment.app/files/PersistedInstallation5066343675637878944tmp
Filesize
567B

MD5
f0af74de0c13b45fe7572c0c22c52da4

SHA1
297635a96f158e230a943e8c3d896e97ec2fa039

SHA256
bc9cd333d13b6a5e9af0873052b4b818b7024778d0ce19cdda8c03237df17d8e

SHA512
f0faca52236970648c0ebab9100e39ec0740a78d81fffcc661df538fa33dec287cc10f1221816981b93a6ecf94a17a8f279120815b80460853bb23a1aad407cb

Download Submit
/data/data/com.karenpayment.app/files/PersistedInstallation703149131937186255tmp
Filesize
90B

MD5
6e3080c100b02d4dd864a34534be8a93

SHA1
94ed52ba247c53db74bedfa37be72da65190bf0a

SHA256
0597c22b3994c88b96cb090ae1041d1c40d8305e0a2b82993ef57206233d6852

SHA512
02b9f0cef6b8a4af5d37b0c2c9e63da6fd30e6684b952ba44e0ee796e5d68f1a1b851aa00db58293267c8dddeaf5870bfa198eb3aa5cfb848e039d8bbfaa521d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads