Analysis

  • max time kernel
    20s
  • max time network
    132s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240514-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system
  • submitted
    23-05-2024 22:00

General

  • Target

    c5a34dc7c972762248b36b48cce65b830830e973086cfa62f56bbbcfed185e03.apk

  • Size

    3.8MB

  • MD5

    7112e3ec8af8fa4a7b000ffcf1f8a464

  • SHA1

    84a6ecfe08c97f871ff8aa4907254395b0524ce5

  • SHA256

    c5a34dc7c972762248b36b48cce65b830830e973086cfa62f56bbbcfed185e03

  • SHA512

    a31f17f3af0b6d8d550bb9ca766d87f066c63a9b777545f02022cb8535bdb111ec92e2e782b738acd84154820d608ce4e35cb94a4d83896ee42c47b70f12c3ab

  • SSDEEP

    98304:g0MqkFtV7Q1qcuPQeYLfToTwr5LVHSthcr3WsNrGiGS:fkFthQ1IAxCyr3W2H

Malware Config

Signatures

Processes

  • com.drnull.v5
    1⤵
    • Checks memory information
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4316

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events

    Filesize

    56KB

    MD5

    ada4a5f09b0240c5c61da6ba14dd393c

    SHA1

    dca1cb7de89ac36bf871b2a369a88fac606fc879

    SHA256

    244414699cfb31cca4f98fe8a4af354ecd713a0e9ce680832f29dde7b8bca3f8

    SHA512

    abcf09fd611498066cc18e1167a07dc92a85fe6681a6cb0b154da661df0e259133196ebefd525a9585890900be427e94bd905ac7a58e13fd7887d29afb283b20

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    1c028b52d7e9299846ca9e232cc57538

    SHA1

    c0aac3ffb334e63b9675dc637552e76dfe098dd4

    SHA256

    e57ca56e1bed5e2ac2bfea6a9281c216de835713f553a4d2fcc02d4aaa45a00e

    SHA512

    201a7c37f57e471edac3e4d3a50f6055323ac9330c663c12f14f98d64f68acfe30ae2e665f6361f83de6f5d386f5aecbed1a61d27bc62c48594ed7dbddec4be9

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    8190d376ffad6a06159248347a3345b8

    SHA1

    992ba783834e1159260988fa50f81b4f482c0296

    SHA256

    50ce88e2de4cf9d885ba6e7d6e735c648d7b0d67cf840864bc11921362bd32c7

    SHA512

    18a5941b5037ca4f26cf0a2ac06da3076a100e1942b85f809d200a0846092e20f1695458bc2607f912bbaddbd5a77d81140c6d88bab25d326467fb0c5df7fb1a

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    0adbce4da7f0d66dfd65603b1ab574eb

    SHA1

    ca207b36f23349e40557ba2e07a580d7fd91c4fc

    SHA256

    704e41dab957c3ae4f1fe86b1855c8fb08bc06397422ac43ccebd9974d4a64c3

    SHA512

    8d3416aa448f921bf90d90319644b6ac0656465c8b37ea67f9cee7021b5eea5cac883705608c96a49c6d18cba4401f02f1bb72f3021e9af486f5ba97a0f8029d

  • /data/data/com.drnull.v5/files/PersistedInstallation2044227706463544008tmp

    Filesize

    569B

    MD5

    dcae3cd35d6212fe8990859d97f9d80f

    SHA1

    46fe4c23d9becd92a9583343ab1b2fcc74c8659e

    SHA256

    8274214d3e0a1210c6dc76cc103a19d57392c34952853e0feb3505d2f07860ad

    SHA512

    72b501546f07187f051ae5166624b85783268ee0d47764d1cd801eaec19f1c18be9710d0f8f924337f6195bd40e067a9d64fe54aca018e0f6b16a8bb036ebf5d

  • /data/data/com.drnull.v5/files/PersistedInstallation8869799458294435929tmp

    Filesize

    90B

    MD5

    3d1bd93f2c91839449b9f47ce4c88397

    SHA1

    ecaf8bbd988c14a16b5392c1bdc981be2a21eda4

    SHA256

    09de5dfa344e4a56b751175240621f67d93302cacb310a4405eb22b12a9047b9

    SHA512

    a596aa91e5d7b607ff4403e419004881f27975bf0ea090bf1956f07286b1d6247a6fcf1abc32b940ff9eaf8792a18fdb4a10692c5416b889c6ed096aca9f834f

  • /data/data/com.drnull.v5/files/database.db

    Filesize

    102B

    MD5

    ea4e14cf8af0584ad2c67248046dfb88

    SHA1

    fe39e0963965eccd36d24c1b43ec2a70f3e76c78

    SHA256

    19c846819ca892fa5070f91f9e27386156f24545d41caa5ee7ef095de3c72679

    SHA512

    85fff2793d5f0790b8218f72409c313aa99c01427c7b6a7f7ba1a8b8cd45f576e56517905e5cc98a54dbdd585b2e6d8455346a2872cf495c6ee63b78bb55fbd2

  • /data/data/com.drnull.v5/files/database.db

    Filesize

    102B

    MD5

    222084e1713b1e397b5ba1903848d7b5

    SHA1

    eb131c5b0ae2e233e123a639840abe3ebf98cb1a

    SHA256

    1029c56a22efff18915844431de7ddb92118f5cf9f3ec406d5560616c251f10d

    SHA512

    0722ebdac7becfcac880afa41a028f8ff39f0febe6572e9a401615822789c3f0ceebc6e835b57e1fd8e984fad6ddef92b0e9dff0ee9afe14d9f315a927e5f203

  • /data/data/com.drnull.v5/files/database.db

    Filesize

    102B

    MD5

    18215874cac4441d54309b0998384fde

    SHA1

    50bc31aa6955263e2b8b01b8612ac60597269cb6

    SHA256

    dae2fa8625b0fe022cbb5d3e56e62e21cd8b60fb7154a62e3c05f7c9e8d1295b

    SHA512

    39c83c6b12f32b64fb012513d99d59de7b6ee6199558452842b048e1b481680d775bc9c2be15bf7b92575ad3c2c2b26a4de1d8194921a7990e07836e25a2b148