Analysis
-
max time kernel
179s -
max time network
141s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
23-05-2024 12:32
Static task
static1
Behavioral task
behavioral1
Sample
Danak-v0.68-qa.3.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
Danak-v0.68-qa.3.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
Danak-v0.68-qa.3.apk
-
Size
8.7MB
-
MD5
10b7ee902313e9e321c88c8cf4d27f19
-
SHA1
51b3dc1dbb4909ec628f02b5b612b0df415bcb73
-
SHA256
59bd63c6e74dc3df3e141ee28c61d4330ddb90c9712ff3c505baba50d1187f73
-
SHA512
7d79a0a428c551ec4112b06d5dfaf4264194ec9a5437c600e886649e384fb7d12fa990c8fcb1ad7fc80d77bd0e12a31f9a166586ec6d28307c5329d6ec9a1f84
-
SSDEEP
196608:vjr+rIzHL9y6nQxncZPSHCWpVfCCL1RGQppHy+RHer4gb2:n+UTLgsQxnqSHtnL2QppS78gb2
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
org.kcis.savadd.child_fa:Metricaioc process /system/app/Superuser.apk org.kcis.savadd.child_fa:Metrica /sbin/su org.kcis.savadd.child_fa:Metrica -
Requests cell location 1 TTPs 2 IoCs
Uses Android APIs to to get current cell information.
Processes:
org.kcis.savadd.child_fa:Metricadescription ioc process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo org.kcis.savadd.child_fa:Metrica Framework service call com.android.internal.telephony.ITelephony.getCellLocation org.kcis.savadd.child_fa:Metrica -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
org.kcis.savadd.child_fadescription ioc process Framework service call android.app.IActivityManager.setServiceForeground org.kcis.savadd.child_fa -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
org.kcis.savadd.child_fa:Metricadescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo org.kcis.savadd.child_fa:Metrica -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
org.kcis.savadd.child_fa:Metricadescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults org.kcis.savadd.child_fa:Metrica -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
org.kcis.savadd.child_fa:Metricadescription ioc process Framework service call android.app.IActivityManager.registerReceiver org.kcis.savadd.child_fa:Metrica -
Acquires the wake lock 1 IoCs
Processes:
org.kcis.savadd.child_fadescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock org.kcis.savadd.child_fa -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
org.kcis.savadd.child_fadescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo org.kcis.savadd.child_fa -
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 2 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
org.kcis.savadd.child_faorg.kcis.savadd.child_fa:Metricadescription ioc process Framework service call android.app.job.IJobScheduler.schedule org.kcis.savadd.child_fa Framework service call android.app.job.IJobScheduler.schedule org.kcis.savadd.child_fa:Metrica -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
org.kcis.savadd.child_fa:Metricadescription ioc process Framework API call javax.crypto.Cipher.doFinal org.kcis.savadd.child_fa:Metrica
Processes
-
org.kcis.savadd.child_fa1⤵
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
-
org.kcis.savadd.child_fa:Metrica1⤵
- Checks if the Android device is rooted.
- Requests cell location
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/org.kcis.savadd.child_fa/databases/danak_db-shmFilesize
32KB
MD5aee270d61771bc0a3fc8f22eac45da28
SHA1c6f689d1598a73413e0cfe64c02eeb6163a79853
SHA256bd348b5c1b00e3b2beea22dd285a8aac08e8bb37d29bb64a5a49e704b0368583
SHA512af729c35873344c57aed66adadaad5a778c71abcccf780fce2fd71d2dcd8804e8fb26c005297fd6efaffae013300515e43aaaf0305b89557fbacafc6007cea15
-
/data/data/org.kcis.savadd.child_fa/databases/danak_db-walFilesize
64KB
MD52b710b7d2f266234231cae0bdb39d383
SHA18f1a49265bd5340d9a50461f00fa0e5de7829f90
SHA2560bcf938c27ecb0a0c4757d4c069d12e5cffdc07ba8ff81279a706fe889ca7d72
SHA51220fcc37bc70a79ecf9c29154d8a06432302bf22ef528c7731e7b5175fed35bf9e4a30ce56e3bf64d26245a8bf7db6d08a6e59c2417c2e33c2a4a99f1bd1df2a1
-
/data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdbFilesize
96KB
MD5135889d5de3fd15d691358cf6db81733
SHA1e4e8068f94c3fe50e02fedb2d23c3aebc7cba901
SHA2563fd19aa480efc12beed08c9cee668a170701bdbf6bdf722b7819c59a70353ba9
SHA51217a91a6a85af2d184865204adccf6eae6462e08a1102eee3501bbce1d385a71d01770f2df850d6749013eedb9d31ed8030f81d0491886705ef4b64737a2f79df
-
/data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdb-journalFilesize
36KB
MD57969e9974f698fb8c3d1186a035e3be0
SHA14fced5f0003a8b97074988f9d9d512b8fe999ff2
SHA25682975e1c5fcdab8b2b46850ff68e7195d2c9e0d676a9d3f27758171d3176414f
SHA5122fd74c9269d614f0b5729ee1ac77a54ddde712ff87aa902f1139f366f0a45b3489491c18ae64bf8bb75cda8e41ff5625edab57faa2eea6c9a1dee4c4f35ad5be
-
/data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdb-shmFilesize
406KB
MD58065d730b8a3359c08cf2e35242a46f0
SHA1ffcf0ec5dbf4c89009aa8cd50239ea0356faf3a8
SHA256de429aec79581343d4ffc8fb3b7e068c0912967a7b475233b1f1ca2a0c29c083
SHA512eb5068abf80384e38917d46e823054bb26cb92aa9c16041cd1ad29c34f304a6512677f3f2ffd0d99b8cd1ccdc7c07fec019dbc0f537c58f851e0af0cd3cae811
-
/data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdb-walFilesize
16KB
MD5fc3f52bee886831d89a70d703d07b0a9
SHA195f9c36e4b0e91c6ed1b180a4fe18343781088b5
SHA256e80967cd990179254d99a76e19afbe5a739a118bfae4156ead56685011019f57
SHA51256f85db970e2d56b91ad91f42dc74be3841fb0eff5308498f710d73e4a956698a1d3bab1a80d2605b4a577ec6bb8b06aeb769e7b3d011c776991f86129fa91fe
-
/data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdb-walFilesize
108KB
MD5b9c10b13ef41fd09622cd096f4d5afcb
SHA14bc8e069cc1d515b67ad803c1e5fbc8a8167ee7c
SHA256b09d74dff01fa019de340982626e8371d076a3462dd63c87940e34105226570a
SHA5125b99520fa18a73abafed904ec2c2d2bd11ec50a7150f3eac1bcb3fbdfb69b79df798930fca86283a1f908c34474dd00e5bfb9323894502aeb50866258abe24f6
-
/data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdb-walFilesize
301KB
MD5d5aa28a8b131a8410537001c1d4e8936
SHA1f6a6aba042ca1bfa9cb88eb1a1ffc71e61db852b
SHA2568c55bda082a2de00626f9930d606138315a7afc5cfb04037160d660f16695913
SHA5126debcf1720c6a17c3c1f21a60e7866195c61df9b27e839eb505f42fa965dfbcf5c911dc9cb303f96d2ec0d891d132aecea89e1887c78f93639f268101756c86d
-
/data/data/org.kcis.savadd.child_fa/no_backup/db_metrica_org.kcis.savadd.child_fa_20799a27-fa80-4b36-b2db-0f8141f24180Filesize
36KB
MD53f241a273eb77a07b63296b4b2716909
SHA1c28057513c0b5d53ddd169ef31b4e427330aa35f
SHA256e1d00c83a62d35493646e00ee85a5fc7b12610fe3cf0011b882f29ac7b1dccb7
SHA512e803b17d2c50870e6464a3b2b15d57b5ae155e7ad2786b8b793c0db9a4a76d4478314f42d47681d8639100dc393725acde89a9c7f5aa29613f088207a2d09345
-
/data/data/org.kcis.savadd.child_fa/no_backup/db_metrica_org.kcis.savadd.child_fa_20799a27-fa80-4b36-b2db-0f8141f24180-journalFilesize
410KB
MD5f4b535f4960abbbac5a9aea37c16df83
SHA1ff671ee30420d77390ce79f16ab106c99253b1dd
SHA256074cb84ead989a2073150c28134a1780e5897e44bebb64369ab03c880e6a1ce2
SHA512be4b719df0f15e4e025b90442ec878df360cdd1a334c1a9583dc9e3d54e959d2a2341a90045dce1d70f9ed0b8201d8d1e50e28e61d5f7418c846d3563489fe65
-
/data/data/org.kcis.savadd.child_fa/no_backup/db_metrica_org.kcis.savadd.child_fa_20799a27-fa80-4b36-b2db-0f8141f24180-shmFilesize
32KB
MD51c4274aa7a9a5cac8c6d1df71e4588c6
SHA1abaecd685e01cc68801292e3dc7085654a22feba
SHA2563f6cd5f480ae69859b7841450f3d032c528ba385ebf9f371b9c8fdc6eb4231be
SHA5121adb95935798607bd36cedcd183924d3068f50097d017b278da7caee7771532b61ec3606f6189b6dec8426eb038fe40be75079ce35894b1a8e0d1d815261150c
-
/data/data/org.kcis.savadd.child_fa/no_backup/db_metrica_org.kcis.savadd.child_fa_20799a27-fa80-4b36-b2db-0f8141f24180-walFilesize
402KB
MD57a0a999947388a8a1762674480cfc573
SHA1196febbbb239ead5661560e54c40e4b2a413cd0d
SHA2565783d727aab7881610887d267f2c1a584fcccfb581fd87dfe6093f57616acc2e
SHA51278bbbb4df23935d888c1ab322f1586e8b9b0302f96a5d04cc2c2a166f7f53efd93b921cc56f904e593a5d41dde546b03aa0e6236b87107925516e01ffae4953e
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_aip.db-shmFilesize
32KB
MD5d2935d274a09cd71972dd8f95bb0beb0
SHA1714ae563e20f233e93ab8b35a2ca714102d82921
SHA256de16953479853e6aae17a2f35c34b230be657a673b37e4601a87430464042890
SHA5127b6cee3fabca16624b0e0890f3f72f3289cb7da2c055acf2b057ad732ad0f22633104eb4166ab75eabbf6eec8565b8a9626914e36648ce369bd00b2a648bc43a
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.dbFilesize
20KB
MD554a9acfb9926bea293b0408891b4c396
SHA170a2061304d8749f2d28971d382a8a8072ee8dda
SHA2562917504ced0dbe7980cadaa2878debf88f61e1370b2e902cf4e770fb28a12de7
SHA5129e178dfb1c23bd5a14dca7c35b0800becdc6dfe47a5e3a85256bd545bfe243bfebe90747fd945a93d48c5a191c4d7f917b02f4cf849e958d7db090a20cc4ff61
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.dbFilesize
20KB
MD5f0b6bc7f614bd4e7f218a5a00216405a
SHA134b7b630b5b258720b73a5f105f30c624782df21
SHA256f11e5948bee78f844577aed1503896fb0af866aabaf136e9708060809040138c
SHA51232c9eccbfc543649f1b2640b4369451d0924125b5f329aef8bc1845f6514f36478038edc23b083fcc0522897a8a575981332519f5068c7dfc71247675f634fbe
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.dbFilesize
32KB
MD5876d624b58253b84da4dc1af165785aa
SHA1a1cedc9a25879e59ee0fcb841b094b3c0860240b
SHA25666d5d760cf6f74487cd51e88419c217044c1c34a51f6a3400db756b3a8ce85a9
SHA51267c080520dd25f6310c87a71bf8e7637215d90370e9c7e0720f6d7726be22c8d801478fbfd0c46c4e3bff786b09e089f895bcb7fd4e280764198c5131ec8b488
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.dbFilesize
20KB
MD5033b1661573ff10ce6787b2c2a69aabf
SHA1d2cc739e23ea533b843d1b338e4d34005303aeba
SHA25664c835b87d9475424c25ba5c04cb758c53b7cce4c0a362f5140ba70e13f53b08
SHA51212f650561a6967d0abb5423fca30856431597c4fd4124588414d980fceb70379f6b98bafb6de63dc695ffe8c7345439b92d19a95aaea7a275706e2ec01bda02b
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.dbFilesize
20KB
MD585945ac5c61a372173bcbe2485a8563b
SHA11984deb5296f20ad2c818393ba3a4fc2aa19cbc7
SHA2563e6d323db370eec94fb9a4b7d58fba10cc2a6b2de00a35b2916be94edaa04696
SHA512c3fb57e5c3beb9e63ac3ceb2636e0e8c8057d8edb8e7684ce194f52642980a22c3d47d6eb4179f83060d91817dea10243345ffb95ae2ba617efad2281ba50092
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.dbFilesize
20KB
MD533d76922ec66c6ad3010607fd6822cdb
SHA1bdae8326e5061426c7207b1cb67530889f19a683
SHA256f9169be9d5f9c29b47b4ea85fdf617dfb2c0620d1086f9964d3d3170057f7bb2
SHA512eac7de383085524ba454740abef4bc60cd0a8d80a0c6e1b61a6c9600aa8d3f5f2548a50942cbc6c100541ef077138e477b876742cbdba6e5effed76785991457
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.dbFilesize
20KB
MD5232699140328ab9a4b43368200929bd5
SHA1904033c309a6936eb08f980c0f747792bcc4efbd
SHA256d935b23b0b6078dbb7846b05441b83d5c21da3000a6bd3f29806e25f02c96a65
SHA51260aad107644fe24af98e2ac215e3d9a5edeeed60f3944091102e3ea2417d8d0632bae10ae0480bdf51d52bfa09a93d3e102aff65c61a98af30271a1e0ef49298
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-journalFilesize
512B
MD572403940506a91d2b6fe1537763e1b12
SHA1d25f0b7276c6d48c529f86a3ba2671d65f7526b6
SHA2569cf04312e484f66d62d41de18739eb91a04dfbff6aaaec530d6868abdf53e654
SHA512c63299dce9fbe4be802fad49387841a6374e7fdd6e364ece20c3538c498ab9787510dad2d801fa3e5f8b877786e006167f4e30bee4dd3f65a8bef8d7117f98d3
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-shmFilesize
44KB
MD52e0334d0ec776bf1c0b8f830fc43fbf0
SHA1467fdedca17a3ab538893cad465c7e32a0487f03
SHA256c356842178e87b16b1be465a5f75f4a8a7940466a27ecc73776ccd43492e0e4b
SHA512b053604054a494a267290b3dc35a8ff3064cb6ce34f2c08670fe47a2b3ad23f6ec728553059304619f4b23789e4ba6f462ee3b642c49c3eb44d9d05485971b74
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-walFilesize
8KB
MD57d5a35bf995998ac87f4553fd2404c77
SHA1efb839228c4e2aab8c56f2aa6f75c29da1a66a6a
SHA256b816b286d6d93f301904e6477bc0149b1325dd6fc8393b5226e09742fad00870
SHA51218b6f19d2c99f2c49dac03970d8320af31a8ad3081345ce2f2fc44eb94db3afb8f6c218dbf4a774db51260845ea003642d09643826c4601a4b2587673a6c8ad2
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-walFilesize
8KB
MD5f40d8a4173b0eaad82571091541540ac
SHA167ca219177a565cef6402f442a1df1ca4299ccef
SHA25628dd6106231f02ae566b91fc74955789385ea7ed947e456fdd394223a0a25cf1
SHA51248331bb7e327ba97b198b5b4b4724aad1159fd8a2c932994b102732cf5fcb7678218f24440d77f9903767b3b7380ddc40897a78d8e3585c9296b222d55fb4c7a
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-walFilesize
8KB
MD5b3c8958348e2923c33feb575f4e13a79
SHA13d364c05d245b710fe8b3712834ff3c96cfab96a
SHA256355b43ce53063b61506cc12b2e557fca72c855a362677a5502fc7f99f5754022
SHA51250c6fdfa61d6b4962f1af39021a355e7c7aa49043a4dd82e5dd30def0c44509ca362eb7437149987923cbe71ca81a6f664ee2a2e0bfff4df02adb3d626b2abab
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-walFilesize
8KB
MD551e8111fe8e8af9af46d5ed69be960f2
SHA19059af8903a421edc7eab8ea9efb58e074a7cc4a
SHA256a35ee298ad65ce246a355ce200c5af20604bfa83b048b52da3d7741f2e835346
SHA51209cdf80e59949aec4561cd0306c075bc70a3bd8a0b24251bf75acebeeb989289506d1923830e712ea9a7cc3830506e0675a1a74992250c4aef10a62fe483c736
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-walFilesize
8KB
MD52fdec8aa8e34946db21915219b3cf477
SHA153d1fd1d77708ac1c82908182e11e2287e68449e
SHA25613fa6f00b9b4c74a353a68d50092063c89e7a343abf3db742200c1a11cac381b
SHA5129ac2a60cdfe6c2afe5981742c12c9b7a75c85b25e01e3092d7263589e1e94073e53f989ad439a925898ce35f038b2bb436e4fffd6a90454d207f1cf8175d4e0d
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-walFilesize
32KB
MD50e75d40fa2d772f1e044c9e68c0978f6
SHA15cc1de6788fa7ce67c9107afc8aad5e9b3fd4db3
SHA25669ace59569e5ed1e4ff9a3d199e7620c5f1b00ee7d8f1062c608a2835b2bc9f1
SHA512f0a7ea2941fececc458d9060563d92e9dc60d87a0dc01006037cc8a94e9b60f54637e9fff100b7d8848484b0dba7d609f6cf565a62f771e7c20ed66d96f0ea02
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-walFilesize
32KB
MD553ca60b9e7e7731a890f52130df4e775
SHA1a4f0b48ba7f9af571acd6de81e35c5fac74d24f0
SHA25610c896e556d278dcc05f53771fc31d8270d4a335770ae31696e25b0546f23d0c
SHA512b5013f6cec50f9c878372cb183e255926c11ca8ab9078c33b71f51254e0e0dd053ea54a1dc60d62b3d6ebb340eda5ae7774241a869923963207e2f67c0cf670d
-
/data/data/org.kcis.savadd.child_fa/no_backup/metrica_data.db-journalFilesize
512B
MD5df0bdd75ae37dd80966c9cb90ee52ba2
SHA1ea84fc7ae674f93de4f267c668319b128756ce2c
SHA256e4f63b22c863920986f67b2786b39937509265e543e8ed4ee0cb81d1ff94dabf
SHA512f78daeba256bd948c7aa347d5208607aab3263e84fb6f252ba72c551706f9c740c421ab6543733a69da2d827501d162d561469cebd0725bd95fb8d018b008921
-
/data/data/org.kcis.savadd.child_fa/no_backup/uuid.datFilesize
402KB
MD5003efe333f638094e44466db00495b0f
SHA1ec4eeaa8b8177509d0aba50b7afbe8fe53e3a73f
SHA2569084987a229d7fb843da7942072128bcab84b8e7dd421d197200dbd8b3a30eb8
SHA512856975695d58753350e92990da82ab802733d881545ced02e5126ab6f6c84c73b25cf2abc1e36e6d7c25277a6bd0ea1d918c542b03ce5f417dc62e70eb2092a0