fd19e5cb0128aacc237d3f6e3434916ea1fc197a27208bfd252f894b3f62cedd

Analysis

max time kernel
168s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20240514-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system
submitted
23/05/2024, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gmod_Mods_Mods_&_Maps_for_Gorilla_Tag_8.0_apkcombo.com.apk
Size 40.8MB
Sample240523-3pcceadf58
SHA256 fd19e5cb0128aacc237d3f6e3434916ea1fc197a27208bfd252f894b3f62cedd
MD5 3a6830de74c6dd975e0160c7b9f359a6
SHA1 c7449c1259b17a5bcc0655b4b8a315ca4c021835
SHA512 fa89d593c9ef8bf06987038fe8c507b1a18e7fc200d16d8f587276440410f8bf9889cccbce09474595b790683de720a1f21fdd64fe88b64eea8efe0f2cfd0222
SSDEEP 786432:tdtZ1Ael9uf9X33ISSPSqpE/Vlp5vpNLN/d6NFv7btZTSNHmJir27pnI7hJWTi1:td1AenUx33r/Vl7LRd63v7pNoGJiq94z
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.gor.modsmaps
/system/xbin/su	com.gor.modsmaps

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gor.modsmaps

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gor.modsmaps

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4363	com.gor.modsmaps
/system_ext/framework/androidx.window.extensions.jar	4363	com.gor.modsmaps
/system_ext/framework/androidx.window.sidecar.jar	4363	com.gor.modsmaps
/system_ext/framework/androidx.window.sidecar.jar	4363	com.gor.modsmaps

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.gor.modsmaps

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gor.modsmaps

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gor.modsmaps

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.gor.modsmaps

Checks the presence of a debugger
evasion

com.gor.modsmaps
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
PID:4363

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/data/com.gor.modsmaps/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

StatusBarNotificationIds.db

Path /data/data/com.gor.modsmaps/databases/StatusBarNotificationIds.db
Size 20KB
SHA256 36d83810e54058bbd1bfbe33635616ea7994eb72a411a3fe3028cc437266a18e
MD5 eaf335f6026f434aa1a23428e3ba1394
SHA1 5274f98cbd057c5ba53b4a40fd32c40c27bb824e
SHA512 19e86b562ee39b2525209789b281a3d1ca95ba057313290c7689d9440fdf78684d1df33382ca467650d996cf52767d5d1a649e33d6db1a758082752a83b1924f
SSDEEP 12:TLyKUorWfWAwWxjrJFnEW3WiRmBEyPbAVOw:TLyXaWfWzWxjDnEW3WxGSE
MD5 SHA1 SHA512 SSDEEP

Submit Download

StatusBarNotificationIds.db-journal

Path /data/data/com.gor.modsmaps/databases/StatusBarNotificationIds.db-journal
Size 512B
SHA256 390058ea933b6c6d426b9a33b5a20f299b833ed527ee7428f2f57c0e642571e7
MD5 fbf91f1bcb6811a052ef1599d0cd04ef
SHA1 8a55b76064268b4c7ddf345a3a24e67c714e29ce
SHA512 01bc81a4e1698d48cde4e9176c80f86f3881a11eecd62429643d892162d93c016a21d6f6337e9d95924e04c5a43927dccb06123c0a24e4204a39a92533e55dd6
MD5 SHA1 SHA512

Submit Download

StatusBarNotificationIds.db-journal

Path /data/data/com.gor.modsmaps/databases/StatusBarNotificationIds.db-journal
Size 8KB
SHA256 2937ca40a53b16f7749c1c49841e3d6e3d4db71d4f999a077e73d35b3133e840
MD5 38921de76905724e566abb41972ab069
SHA1 4ad8167fc76807fc1c3f0047ce5e0f02432fbcec
SHA512 26dd9e618abf1707e37920ac7049ce76bfd16bc07cdec43de4973b63f2f7760785a1db921b218326614cefe144f0d7d5e949374e20495dfe32851a54ceaab190
SSDEEP 6:7+/l9aVOn1Ilfg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKxn:7+tUJqLiuWd7RmBEyPbi
MD5 SHA1 SHA512 SSDEEP

Submit Download

StatusBarNotificationIds.db-journal

Path /data/data/com.gor.modsmaps/databases/StatusBarNotificationIds.db-journal
Size 8KB
SHA256 705c3eb0dad6fca73ce354345c860ba8c624df9d89f9e45953f55511937d67c2
MD5 5715ba2b047b4c5e7601e9b5c532dab7
SHA1 df5ca13455c5a3fc4514af517ae4155a30d4e5f3
SHA512 31b9f634ca3ef55a9570bbecec52b097758ba44f085e8fd22321aadc251343b969f43ef8bf2602ffea6c0c094a4af393d8b8b1eea826a4dcb091d4e96b774083
SSDEEP 6:7+/l9bllmHPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKglM/kq:7+t1mvqLJdKBRmBEyPbflskq
MD5 SHA1 SHA512 SSDEEP

Submit Download

StatusBarNotificationIds.db-journal

Path /data/data/com.gor.modsmaps/databases/StatusBarNotificationIds.db-journal
Size 12KB
SHA256 9bfc91725f93a3dd054967b4bc992281e3e3844101115c1a0db1c2c4f3f4bd52
MD5 20b1544b73e5b093f3d896a6c895c99a
SHA1 e9c6786c3f7375bf4cc052297f5f39c94a6b131f
SHA512 12f752f365da697f8c379b4924994a6372bd5dfd9c0cfd88f5955d436f52dd2651d1b63b3360f4c674548f2a41c8a3603f52e95c782c17782e80cd3e0f879b5a
SSDEEP 12:7+tvEZnRqLmbforWfWAwWxjrJFnEW3WiRmBEyPbD:7+tvYqLcaWfWzWxjDnEW3WxGSD
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events

Path /data/data/com.gor.modsmaps/databases/com.google.android.datatransport.events
Size 56KB
SHA256 cbefa87af3b991f9c5d843ad480e5266e5c73d59712e7d54ca26467d5e6ebec8
MD5 b9d6a6eab26d72921c2e0dbb5dfe79f6
SHA1 dc3e08035d5edc28c81e0826da91d26e1b2756ad
SHA512 eb7bb90b4391e0e054f1b95200e201fdf1a51eda6d2d5e4f4fe1d59a03fe6711e8407fddd1bf0cfd0e99d8b5e46a071348ff0c4af69c5ed4723a3a755b20eb64
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSc:RMEX0wIyNjac
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gor.modsmaps/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 612bd047fc97303afbc6676d23f3c70577614c82540065729d417f0b0560b151
MD5 7aaf386a5950175a8e14a0209e229582
SHA1 cc87d1eb0b821959235f9d949426aff123cf9b87
SHA512 f4708d950be3fc1083a2a61ddf99d2f63cfecc530f74674f1b50733336e1b9ea4be8cb550374012ff683466317e04fdaa7555c2578dbdae59c75099bd154cb68
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gor.modsmaps/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 67ee5077543e5e1aba74eff0a5881fd36df6de34240d3bc0ea32b2bb715036e8
MD5 0865d920bcf73267428c79fc08733b62
SHA1 564700d30fad87e64779d268ffaa91eaf35376a3
SHA512 546d85ad8356f0604b2483fe6b8a13a733d87b2148454d325c225ea54314c73d07ad152f6013957bc63f43648fd2f12b8f89f56a0491736b3e0eef96576f3d4f
SSDEEP 6:7+/l9Un1jg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKQv:7+t0qLiuWd7RmBEyPbr
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gor.modsmaps/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 88c32e6597ad6039ae4f5f946fe75d4a956a2bd24d7cd7ca02727a598313d95e
MD5 ff03d5545d8e0eb6dc475aab86c06fd3
SHA1 7cabe4a19236fe60d3a8efcf8bb38acd9728e043
SHA512 c4adb1b8706166afac98b23656918c83bab809c517f924b547376a9a22a6bdfc2f529dea232b8fc82a37702bc2c1532d3e4bc9f93a6776ad4769702cddab9436
SSDEEP 6:7+/l9W/gPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKFnM/q:7+trqLJdKBRmBEyPbCsq
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
MD5 62ad4a05cbdca7f47b3206b7dbda487f
SHA1 4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3
SHA512 0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6
SSDEEP 6:l9bNFl4/Sls1BElO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEBE9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 d880b598862a159a6cb1a1e5ce4ee2a50cb0186c9333772903f3ddd98696e734
MD5 1b0629de00ea7ec3bf4b3d45eccdedbf
SHA1 83e2b70a332e4911ca1fa475ca9212a23c9b02ee
SHA512 6f2a0d5e37d086967649247671e4655f8ace5f233f59d3732c7504ff04f4d21e98ad879daa55fbd600404d5f2b14e4c45c0d9fd1067a90e259e7d134913a4586
SSDEEP 6:l9bNFlsls1XhlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6/z:TLiEx9zmzrfRmBEyPbP/P+/0Fl6sfo7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 a10e31a7849b46b7565bd219f27226e71dd8ba106de48a71409df5efd768e70a
MD5 279042de050df8ec0c6cf5b8e56cdfe2
SHA1 7c5f7dff769aab6fad98ee8ed062cb90b7f03ac0
SHA512 48060a26b3a3637a8117048616fb599638f422c239406a95a188031c96f5b52d58b3c76d82c8b8036a88ef13dcd9525a6bef3d6a0c7f2947ce5507c483f1d4eb
SSDEEP 12:TL1Es9zmzrfRmBEyPbP/hr/gW49blqYFlvb3V+/0Fl6sfo7:TLvpmzr0GSP/h1499FJFlFRfM
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 f819ac0e8f3efbbe3b2a8c17b26ba92614298aab6aab2df7066ccc21c48920fe
MD5 75f13e26439443f5b497b05742c0355d
SHA1 73ec5aa8e2230d3879fe06951348fe5c390624ae
SHA512 e9613d3d98f75a2eb54c73c9963122cdd053314b9b3e027ec35a9d4fdfc0eb52e326cdafd34c2e18a8cd67205cbb2a2a5c2fefbbf5c1940a9bdce15744b91517
SSDEEP 12:TLIEsE9zmzrfRmBEyPbP/ZRhOLavnOAUWLyWleh49blqYFlvb3V+/0Fl6sfo7:TL/pmzr0GSP/nhKammK499FJFlFRfM
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 54abb09fac4a5cc03ec5c3a5f767e3133d7dea00faec6b20d4476efc77e845fd
MD5 d0c566c8cd1beb9dd80d38234494713b
SHA1 358d33d0d94268f00f1a0ab3e8ce107a248a344c
SHA512 01346f274e95344228ca5a3cd0db1860ba442d8f06fd70a425e22dc8147d60d3c16b7227b49984e0058e3ad50eaef2a1414b41a24708d6b188c34bbda9275904
SSDEEP 12:TL6uEO9zmzrfRmBEyPbP/MDRhOLavnOAUWLyWleh49blqYFlvb3V+/0Fl6sfov:TL6kpmzr0GSP/M9hKammK499FJFlFRf0
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.gor.modsmaps/databases/google_app_measurement_local.db
Size 16KB
SHA256 3a81faa3678e36262d525ad84724b732590046e645e422ab8d080ec4f9c90da3
MD5 888c035a334b5e09bd2da73ce80c2c7f
SHA1 99991c7d356836a583627b37a33d708f48840f49
SHA512 15dbd936042fbf028e3a1b3a22f86356259d62ab8d5e93289333cc8c7de95c467e287cab1cbb1d19993f4f62165b4f6b4b2d3f7e272fdb6f49e2a2f8f2a148f6
SSDEEP 6:l9bNFlkls1mElO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WIzvCvllll:TL6EmE9zmzrfRmBEyPbP/WIullll
MD5 SHA1 SHA512 SSDEEP

Submit Download