fd19e5cb0128aacc237d3f6e3434916ea1fc197a27208bfd252f894b3f62cedd

Analysis

max time kernel
167s
max time network
149s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
23/05/2024, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gmod_Mods_Mods_&_Maps_for_Gorilla_Tag_8.0_apkcombo.com.apk
Size 40.8MB
Sample240523-3pcceadf58
SHA256 fd19e5cb0128aacc237d3f6e3434916ea1fc197a27208bfd252f894b3f62cedd
MD5 3a6830de74c6dd975e0160c7b9f359a6
SHA1 c7449c1259b17a5bcc0655b4b8a315ca4c021835
SHA512 fa89d593c9ef8bf06987038fe8c507b1a18e7fc200d16d8f587276440410f8bf9889cccbce09474595b790683de720a1f21fdd64fe88b64eea8efe0f2cfd0222
SSDEEP 786432:tdtZ1Ael9uf9X33ISSPSqpE/Vlp5vpNLN/d6NFv7btZTSNHmJir27pnI7hJWTi1:td1AenUx33r/Vl7LRd63v7pNoGJiq94z
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.gor.modsmaps
/system/app/Superuser.apk	com.gor.modsmaps

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gor.modsmaps

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gor.modsmaps

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.gor.modsmaps

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.gor.modsmaps

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gor.modsmaps

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gor.modsmaps

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.gor.modsmaps

Checks the presence of a debugger
evasion

com.gor.modsmaps
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
PID:4332

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/data/com.gor.modsmaps/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

StatusBarNotificationIds.db

Path /data/data/com.gor.modsmaps/databases/StatusBarNotificationIds.db
Size 20KB
SHA256 ad8c4c21fd0710adafb80d6f071c0f8558b37abd85313d81043b90a9b275d624
MD5 d3266dc7ec7388e190859cdc19772029
SHA1 d1e0671fa97106887385cfa2fd79a0f391f55d97
SHA512 b4c2662a963092c8553d65e89f2a2dc9e8d0f656d1bd2fe61f997baafa5dfae2fecb48ef768d704feb82abc74effa6e7ce964a378ce3120079a2e81ed8d3373e
SSDEEP 12:TDZorWfWAwWxjrJFnEW3WiRmBEyPbAVOw:TFaWfWzWxjDnEW3WxGSE
MD5 SHA1 SHA512 SSDEEP

Submit Download

StatusBarNotificationIds.db-journal

Path /data/data/com.gor.modsmaps/databases/StatusBarNotificationIds.db-journal
Size 512B
SHA256 fa7db8aa959cbed112c4432b3c47f4cba8d852b93ba82ed63e21dca897e4ca82
MD5 555e7dcf00abe2ec1f7bcb2bf4931d66
SHA1 2bf9f37fd862ce78ef83ba3be18906988f506423
SHA512 8c89ca675453a6879c86c879faed92d0fc9a3854bc4a22d67328ead257047a1bd28dfd2935e67895696a6680abf3d6c2dbaed64f5ad703326be78a5b5f82d6f0
MD5 SHA1 SHA512

Submit Download

StatusBarNotificationIds.db-wal

Path /data/data/com.gor.modsmaps/databases/StatusBarNotificationIds.db-wal
Size 40KB
SHA256 9fcedafc1eaef5884822957ac85c3d4282279442220e7669edc31002b796bcdd
MD5 a666939030e3844cdccefff12e487eb6
SHA1 f15842960611e44ed3ff4d98a791abfb7b1ecfdb
SHA512 2ccaecfa6cc63f0d4568d7150dbc633cfd94fbfce1f2e1eb79c779373d7df144a5ece18bbaf77add0f8575fa72bc86da5a1d657299fbd46d39742bb8609ff306
SSDEEP 48:4Kr//zNSP/BdZnb7g0kKjgUrSP/BRCFn0:/0Plg0kKjgUOPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events

Path /data/data/com.gor.modsmaps/databases/com.google.android.datatransport.events
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gor.modsmaps/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 65f35fe9e712a327c8dd74477ea55a79898ea20959a34575a1fa3828ac03573c
MD5 bfda3dceb9f1bb2edadc94289a966168
SHA1 7153665029d4a07a9d603ad61a6cd9049db72037
SHA512 b023e96598944b9dc86aa80201594f35a78d2ec62b6ae938bad5bb6feee7d4d3b445d49ec0469892bd1c0cda93a608a4c3b4ecf7144f7ace9a2d0ad844bd6caf
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/com.gor.modsmaps/databases/com.google.android.datatransport.events-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/com.gor.modsmaps/databases/com.google.android.datatransport.events-wal
Size 68KB
SHA256 1f68eb6543b6984d4f78434bff886590f7eb2b6a4ce6f6793fbbfd8108e9d2b9
MD5 752e85cf1407519bf32c25beb88465a7
SHA1 e8b359240e752d8e9bebd9b582ccf21040ef3b84
SHA512 44085e0f358a51b1b5b835c44f847349f3d218ebb1a1e9b2a865438e84eccd396011059728b474d46386bc7d1bb1470938abd0d682c3a640764aedf5f0564c3b
SSDEEP 48:DSzNSP/4Ltg1g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP/4J9WGNGj:Di0PaMEX0wIyNjaPG9WGNGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
SSDEEP 6:l9FCls1ulO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TgEu9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 e4055645cab3bc7943f6fa35d6b532b182ffb2b936fa69e73b02943390e3be8d
MD5 a8258d8360a4b241eca5d22baf0a3caa
SHA1 94c940b67129852a0a385656c36be5c09152b603
SHA512 efc6e6ffb57f31d1b6bf8181804d0bffad001cc541443c5666ac6df30709bd897f5434f3187aa5479370d118e249b95418695b7fbb04b7728606d45f5a31cae2
SSDEEP 3:qqb/NjghzY+/lzyliMlTXm99psHqOlRzMlklKllgIn:LCM+/lulvl69sKOlRQlrf
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 6dc8285eb071ff8ee9484486cfa4f32271da51da85f6a9f5d185bf9d2c9dd846
MD5 1d756def982004bd2f3d4f5898a26e95
SHA1 19871e3a1af74e34dcd0f7cd8896c9d58d4064d5
SHA512 c8943ef07d76709821350ee284c7793f321f7e91168310996eef68b37e54e74937355eeab45c3cc2b39c9a657d9076af34fa8b8c33d76eaf9644b789dab9bed1
SSDEEP 6:rLP/gEhV71m/9blDqlrElvlKQlr2fsFjCM+/lulvl69sKOlRQlrf:rr/gW49blqYFlh4sFV+/0Fl69sKOo7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 d0e648ab7dd6d56c56644e0692acef84a30f27d1e6d9d0f0f3e1400385349ccc
MD5 d500f46ba57c00ce6e2bd4a5a6fb04fd
SHA1 fcd4729eae89ce09dd87e57277eb74d021e73e7a
SHA512 bd1c219bf393dd6e87c4a743c55cc040ea4eee64258008d8d9f2a5954551d3060a4ed8d9215fe203f4ad9806adbd627f1668a521b2f0cbdc51f5533c57fe2c8a
SSDEEP 12:7RhOLavnOAUWLyWlmGj49blqYFlh4sFV+/0Fl69sKOo7:VhKamm4O499Fo8lFmJOM
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 78382fd6d05447691eef96eb04042c5a8ae40540772bb7546384459164e6b37a
MD5 21288c6bb2dd0de785e6fc864e24c7ce
SHA1 52e393246632b18f9722af2f8b7d56ab2f82a3b9
SHA512 84b880f3e1b872293566a17e822dfb54f91eb667e7a4a9b921e6ae8ab84bbf12ae26899f61f5673e698d2d71fd4cd4710383ec4c487c64e377845dd3d86ff114
SSDEEP 12:WDRhOLavnOAUWLyWlmGj49blqYFlh4sFV+/0Fl69sKOov:W9hKamm4O499Fo8lFmJO0
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 c8125105124739c29bf9fbda92913ffe8baf18d18fec7f3831f0adfd8e06a05f
MD5 c4c3fdad926564c211afce68312c74a5
SHA1 c594f2640777caede10ae6c8cce4ac6fd843cb7b
SHA512 094f218b0649e023eb51799815b55eaa91767becbcd59bd7a62bab9e5b0f93dd96612a7921cc6192f69910fb6e24bd11aac6a11d53f9bc3f56f03a1c42e017dc
SSDEEP 3:o1Izv7/XGlXTlllll:oIzvCvllll
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 3e1d4f6451d1360e115bfa90d9416adc3a7b78140df2be72210b9551d06f4b70
MD5 753a34ab7bcd6c541ca11c49dbd53481
SHA1 5bd25f2aa240ece58e90897b8c6708ffaf23fa05
SHA512 fed86712a6f0649dafd8ca6f2ed6df6b11bc7f184593e4e63ffd33425c03a670d080d5992f916bac8ae0d83080d0a421bc8fdae47b704c6d540097f67d39c2bd
MD5 SHA1 SHA512

Submit Download