b819bf3a924101526ae9920421f0b33c74ae52aceb71c2ef657301ca9da69c56

Analysis

max time kernel
29s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
23/05/2024, 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

op_abs_smp_1_2.0.apk
Size

1.1MB
MD5

4f3b28515ded43b3e5aa9bb5214b35a1
SHA1

ba50478e1870b13b7296049c07922a5c2a4f0136
SHA256

b819bf3a924101526ae9920421f0b33c74ae52aceb71c2ef657301ca9da69c56
SHA512

d3c772f252bb3709ac4f8c1f8d6f94ec70101e2f4f94d39005fef0206e0815a748930810bfe12dbdbd5323101547b49b948d802e95b77a02b4033b0073e351d0
SSDEEP

24576:8Qs2aWlK+SC9iYXFzgzXn9Lf0rL77Y31mD53eOwTIYhpfGdi:8AbtSC9/XFgphUEOwTIf0

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.goyal.op_abs_smp

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.goyal.op_abs_smp

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.goyal.op_abs_smp

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.goyal.op_abs_smp

com.goyal.op_abs_smp
1⤵
- Checks CPU information
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4326

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads