Analysis

  • max time kernel
    179s
  • max time network
    141s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    23-05-2024 12:32

General

  • Target

    Danak-v0.68-qa.3.apk

  • Size

    8.7MB

  • MD5

    10b7ee902313e9e321c88c8cf4d27f19

  • SHA1

    51b3dc1dbb4909ec628f02b5b612b0df415bcb73

  • SHA256

    59bd63c6e74dc3df3e141ee28c61d4330ddb90c9712ff3c505baba50d1187f73

  • SHA512

    7d79a0a428c551ec4112b06d5dfaf4264194ec9a5437c600e886649e384fb7d12fa990c8fcb1ad7fc80d77bd0e12a31f9a166586ec6d28307c5329d6ec9a1f84

  • SSDEEP

    196608:vjr+rIzHL9y6nQxncZPSHCWpVfCCL1RGQppHy+RHer4gb2:n+UTLgsQxnqSHtnL2QppS78gb2

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Requests cell location 1 TTPs 2 IoCs

    Uses Android APIs to to get current cell information.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • org.kcis.savadd.child_fa
    1⤵
    • Makes use of the framework's foreground persistence service
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Schedules tasks to execute at a specified time
    PID:4300
  • org.kcis.savadd.child_fa:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4359

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/org.kcis.savadd.child_fa/databases/danak_db-shm
    Filesize

    32KB

    MD5

    aee270d61771bc0a3fc8f22eac45da28

    SHA1

    c6f689d1598a73413e0cfe64c02eeb6163a79853

    SHA256

    bd348b5c1b00e3b2beea22dd285a8aac08e8bb37d29bb64a5a49e704b0368583

    SHA512

    af729c35873344c57aed66adadaad5a778c71abcccf780fce2fd71d2dcd8804e8fb26c005297fd6efaffae013300515e43aaaf0305b89557fbacafc6007cea15

  • /data/data/org.kcis.savadd.child_fa/databases/danak_db-wal
    Filesize

    64KB

    MD5

    2b710b7d2f266234231cae0bdb39d383

    SHA1

    8f1a49265bd5340d9a50461f00fa0e5de7829f90

    SHA256

    0bcf938c27ecb0a0c4757d4c069d12e5cffdc07ba8ff81279a706fe889ca7d72

    SHA512

    20fcc37bc70a79ecf9c29154d8a06432302bf22ef528c7731e7b5175fed35bf9e4a30ce56e3bf64d26245a8bf7db6d08a6e59c2417c2e33c2a4a99f1bd1df2a1

  • /data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdb
    Filesize

    96KB

    MD5

    135889d5de3fd15d691358cf6db81733

    SHA1

    e4e8068f94c3fe50e02fedb2d23c3aebc7cba901

    SHA256

    3fd19aa480efc12beed08c9cee668a170701bdbf6bdf722b7819c59a70353ba9

    SHA512

    17a91a6a85af2d184865204adccf6eae6462e08a1102eee3501bbce1d385a71d01770f2df850d6749013eedb9d31ed8030f81d0491886705ef4b64737a2f79df

  • /data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdb-journal
    Filesize

    36KB

    MD5

    7969e9974f698fb8c3d1186a035e3be0

    SHA1

    4fced5f0003a8b97074988f9d9d512b8fe999ff2

    SHA256

    82975e1c5fcdab8b2b46850ff68e7195d2c9e0d676a9d3f27758171d3176414f

    SHA512

    2fd74c9269d614f0b5729ee1ac77a54ddde712ff87aa902f1139f366f0a45b3489491c18ae64bf8bb75cda8e41ff5625edab57faa2eea6c9a1dee4c4f35ad5be

  • /data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdb-shm
    Filesize

    406KB

    MD5

    8065d730b8a3359c08cf2e35242a46f0

    SHA1

    ffcf0ec5dbf4c89009aa8cd50239ea0356faf3a8

    SHA256

    de429aec79581343d4ffc8fb3b7e068c0912967a7b475233b1f1ca2a0c29c083

    SHA512

    eb5068abf80384e38917d46e823054bb26cb92aa9c16041cd1ad29c34f304a6512677f3f2ffd0d99b8cd1ccdc7c07fec019dbc0f537c58f851e0af0cd3cae811

  • /data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    fc3f52bee886831d89a70d703d07b0a9

    SHA1

    95f9c36e4b0e91c6ed1b180a4fe18343781088b5

    SHA256

    e80967cd990179254d99a76e19afbe5a739a118bfae4156ead56685011019f57

    SHA512

    56f85db970e2d56b91ad91f42dc74be3841fb0eff5308498f710d73e4a956698a1d3bab1a80d2605b4a577ec6bb8b06aeb769e7b3d011c776991f86129fa91fe

  • /data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    b9c10b13ef41fd09622cd096f4d5afcb

    SHA1

    4bc8e069cc1d515b67ad803c1e5fbc8a8167ee7c

    SHA256

    b09d74dff01fa019de340982626e8371d076a3462dd63c87940e34105226570a

    SHA512

    5b99520fa18a73abafed904ec2c2d2bd11ec50a7150f3eac1bcb3fbdfb69b79df798930fca86283a1f908c34474dd00e5bfb9323894502aeb50866258abe24f6

  • /data/data/org.kcis.savadd.child_fa/no_backup/androidx.work.workdb-wal
    Filesize

    301KB

    MD5

    d5aa28a8b131a8410537001c1d4e8936

    SHA1

    f6a6aba042ca1bfa9cb88eb1a1ffc71e61db852b

    SHA256

    8c55bda082a2de00626f9930d606138315a7afc5cfb04037160d660f16695913

    SHA512

    6debcf1720c6a17c3c1f21a60e7866195c61df9b27e839eb505f42fa965dfbcf5c911dc9cb303f96d2ec0d891d132aecea89e1887c78f93639f268101756c86d

  • /data/data/org.kcis.savadd.child_fa/no_backup/db_metrica_org.kcis.savadd.child_fa_20799a27-fa80-4b36-b2db-0f8141f24180
    Filesize

    36KB

    MD5

    3f241a273eb77a07b63296b4b2716909

    SHA1

    c28057513c0b5d53ddd169ef31b4e427330aa35f

    SHA256

    e1d00c83a62d35493646e00ee85a5fc7b12610fe3cf0011b882f29ac7b1dccb7

    SHA512

    e803b17d2c50870e6464a3b2b15d57b5ae155e7ad2786b8b793c0db9a4a76d4478314f42d47681d8639100dc393725acde89a9c7f5aa29613f088207a2d09345

  • /data/data/org.kcis.savadd.child_fa/no_backup/db_metrica_org.kcis.savadd.child_fa_20799a27-fa80-4b36-b2db-0f8141f24180-journal
    Filesize

    410KB

    MD5

    f4b535f4960abbbac5a9aea37c16df83

    SHA1

    ff671ee30420d77390ce79f16ab106c99253b1dd

    SHA256

    074cb84ead989a2073150c28134a1780e5897e44bebb64369ab03c880e6a1ce2

    SHA512

    be4b719df0f15e4e025b90442ec878df360cdd1a334c1a9583dc9e3d54e959d2a2341a90045dce1d70f9ed0b8201d8d1e50e28e61d5f7418c846d3563489fe65

  • /data/data/org.kcis.savadd.child_fa/no_backup/db_metrica_org.kcis.savadd.child_fa_20799a27-fa80-4b36-b2db-0f8141f24180-shm
    Filesize

    32KB

    MD5

    1c4274aa7a9a5cac8c6d1df71e4588c6

    SHA1

    abaecd685e01cc68801292e3dc7085654a22feba

    SHA256

    3f6cd5f480ae69859b7841450f3d032c528ba385ebf9f371b9c8fdc6eb4231be

    SHA512

    1adb95935798607bd36cedcd183924d3068f50097d017b278da7caee7771532b61ec3606f6189b6dec8426eb038fe40be75079ce35894b1a8e0d1d815261150c

  • /data/data/org.kcis.savadd.child_fa/no_backup/db_metrica_org.kcis.savadd.child_fa_20799a27-fa80-4b36-b2db-0f8141f24180-wal
    Filesize

    402KB

    MD5

    7a0a999947388a8a1762674480cfc573

    SHA1

    196febbbb239ead5661560e54c40e4b2a413cd0d

    SHA256

    5783d727aab7881610887d267f2c1a584fcccfb581fd87dfe6093f57616acc2e

    SHA512

    78bbbb4df23935d888c1ab322f1586e8b9b0302f96a5d04cc2c2a166f7f53efd93b921cc56f904e593a5d41dde546b03aa0e6236b87107925516e01ffae4953e

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_aip.db-shm
    Filesize

    32KB

    MD5

    d2935d274a09cd71972dd8f95bb0beb0

    SHA1

    714ae563e20f233e93ab8b35a2ca714102d82921

    SHA256

    de16953479853e6aae17a2f35c34b230be657a673b37e4601a87430464042890

    SHA512

    7b6cee3fabca16624b0e0890f3f72f3289cb7da2c055acf2b057ad732ad0f22633104eb4166ab75eabbf6eec8565b8a9626914e36648ce369bd00b2a648bc43a

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db
    Filesize

    20KB

    MD5

    54a9acfb9926bea293b0408891b4c396

    SHA1

    70a2061304d8749f2d28971d382a8a8072ee8dda

    SHA256

    2917504ced0dbe7980cadaa2878debf88f61e1370b2e902cf4e770fb28a12de7

    SHA512

    9e178dfb1c23bd5a14dca7c35b0800becdc6dfe47a5e3a85256bd545bfe243bfebe90747fd945a93d48c5a191c4d7f917b02f4cf849e958d7db090a20cc4ff61

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db
    Filesize

    20KB

    MD5

    f0b6bc7f614bd4e7f218a5a00216405a

    SHA1

    34b7b630b5b258720b73a5f105f30c624782df21

    SHA256

    f11e5948bee78f844577aed1503896fb0af866aabaf136e9708060809040138c

    SHA512

    32c9eccbfc543649f1b2640b4369451d0924125b5f329aef8bc1845f6514f36478038edc23b083fcc0522897a8a575981332519f5068c7dfc71247675f634fbe

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db
    Filesize

    32KB

    MD5

    876d624b58253b84da4dc1af165785aa

    SHA1

    a1cedc9a25879e59ee0fcb841b094b3c0860240b

    SHA256

    66d5d760cf6f74487cd51e88419c217044c1c34a51f6a3400db756b3a8ce85a9

    SHA512

    67c080520dd25f6310c87a71bf8e7637215d90370e9c7e0720f6d7726be22c8d801478fbfd0c46c4e3bff786b09e089f895bcb7fd4e280764198c5131ec8b488

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db
    Filesize

    20KB

    MD5

    033b1661573ff10ce6787b2c2a69aabf

    SHA1

    d2cc739e23ea533b843d1b338e4d34005303aeba

    SHA256

    64c835b87d9475424c25ba5c04cb758c53b7cce4c0a362f5140ba70e13f53b08

    SHA512

    12f650561a6967d0abb5423fca30856431597c4fd4124588414d980fceb70379f6b98bafb6de63dc695ffe8c7345439b92d19a95aaea7a275706e2ec01bda02b

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db
    Filesize

    20KB

    MD5

    85945ac5c61a372173bcbe2485a8563b

    SHA1

    1984deb5296f20ad2c818393ba3a4fc2aa19cbc7

    SHA256

    3e6d323db370eec94fb9a4b7d58fba10cc2a6b2de00a35b2916be94edaa04696

    SHA512

    c3fb57e5c3beb9e63ac3ceb2636e0e8c8057d8edb8e7684ce194f52642980a22c3d47d6eb4179f83060d91817dea10243345ffb95ae2ba617efad2281ba50092

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db
    Filesize

    20KB

    MD5

    33d76922ec66c6ad3010607fd6822cdb

    SHA1

    bdae8326e5061426c7207b1cb67530889f19a683

    SHA256

    f9169be9d5f9c29b47b4ea85fdf617dfb2c0620d1086f9964d3d3170057f7bb2

    SHA512

    eac7de383085524ba454740abef4bc60cd0a8d80a0c6e1b61a6c9600aa8d3f5f2548a50942cbc6c100541ef077138e477b876742cbdba6e5effed76785991457

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db
    Filesize

    20KB

    MD5

    232699140328ab9a4b43368200929bd5

    SHA1

    904033c309a6936eb08f980c0f747792bcc4efbd

    SHA256

    d935b23b0b6078dbb7846b05441b83d5c21da3000a6bd3f29806e25f02c96a65

    SHA512

    60aad107644fe24af98e2ac215e3d9a5edeeed60f3944091102e3ea2417d8d0632bae10ae0480bdf51d52bfa09a93d3e102aff65c61a98af30271a1e0ef49298

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-journal
    Filesize

    512B

    MD5

    72403940506a91d2b6fe1537763e1b12

    SHA1

    d25f0b7276c6d48c529f86a3ba2671d65f7526b6

    SHA256

    9cf04312e484f66d62d41de18739eb91a04dfbff6aaaec530d6868abdf53e654

    SHA512

    c63299dce9fbe4be802fad49387841a6374e7fdd6e364ece20c3538c498ab9787510dad2d801fa3e5f8b877786e006167f4e30bee4dd3f65a8bef8d7117f98d3

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-shm
    Filesize

    44KB

    MD5

    2e0334d0ec776bf1c0b8f830fc43fbf0

    SHA1

    467fdedca17a3ab538893cad465c7e32a0487f03

    SHA256

    c356842178e87b16b1be465a5f75f4a8a7940466a27ecc73776ccd43492e0e4b

    SHA512

    b053604054a494a267290b3dc35a8ff3064cb6ce34f2c08670fe47a2b3ad23f6ec728553059304619f4b23789e4ba6f462ee3b642c49c3eb44d9d05485971b74

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-wal
    Filesize

    8KB

    MD5

    7d5a35bf995998ac87f4553fd2404c77

    SHA1

    efb839228c4e2aab8c56f2aa6f75c29da1a66a6a

    SHA256

    b816b286d6d93f301904e6477bc0149b1325dd6fc8393b5226e09742fad00870

    SHA512

    18b6f19d2c99f2c49dac03970d8320af31a8ad3081345ce2f2fc44eb94db3afb8f6c218dbf4a774db51260845ea003642d09643826c4601a4b2587673a6c8ad2

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-wal
    Filesize

    8KB

    MD5

    f40d8a4173b0eaad82571091541540ac

    SHA1

    67ca219177a565cef6402f442a1df1ca4299ccef

    SHA256

    28dd6106231f02ae566b91fc74955789385ea7ed947e456fdd394223a0a25cf1

    SHA512

    48331bb7e327ba97b198b5b4b4724aad1159fd8a2c932994b102732cf5fcb7678218f24440d77f9903767b3b7380ddc40897a78d8e3585c9296b222d55fb4c7a

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-wal
    Filesize

    8KB

    MD5

    b3c8958348e2923c33feb575f4e13a79

    SHA1

    3d364c05d245b710fe8b3712834ff3c96cfab96a

    SHA256

    355b43ce53063b61506cc12b2e557fca72c855a362677a5502fc7f99f5754022

    SHA512

    50c6fdfa61d6b4962f1af39021a355e7c7aa49043a4dd82e5dd30def0c44509ca362eb7437149987923cbe71ca81a6f664ee2a2e0bfff4df02adb3d626b2abab

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-wal
    Filesize

    8KB

    MD5

    51e8111fe8e8af9af46d5ed69be960f2

    SHA1

    9059af8903a421edc7eab8ea9efb58e074a7cc4a

    SHA256

    a35ee298ad65ce246a355ce200c5af20604bfa83b048b52da3d7741f2e835346

    SHA512

    09cdf80e59949aec4561cd0306c075bc70a3bd8a0b24251bf75acebeeb989289506d1923830e712ea9a7cc3830506e0675a1a74992250c4aef10a62fe483c736

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-wal
    Filesize

    8KB

    MD5

    2fdec8aa8e34946db21915219b3cf477

    SHA1

    53d1fd1d77708ac1c82908182e11e2287e68449e

    SHA256

    13fa6f00b9b4c74a353a68d50092063c89e7a343abf3db742200c1a11cac381b

    SHA512

    9ac2a60cdfe6c2afe5981742c12c9b7a75c85b25e01e3092d7263589e1e94073e53f989ad439a925898ce35f038b2bb436e4fffd6a90454d207f1cf8175d4e0d

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-wal
    Filesize

    32KB

    MD5

    0e75d40fa2d772f1e044c9e68c0978f6

    SHA1

    5cc1de6788fa7ce67c9107afc8aad5e9b3fd4db3

    SHA256

    69ace59569e5ed1e4ff9a3d199e7620c5f1b00ee7d8f1062c608a2835b2bc9f1

    SHA512

    f0a7ea2941fececc458d9060563d92e9dc60d87a0dc01006037cc8a94e9b60f54637e9fff100b7d8848484b0dba7d609f6cf565a62f771e7c20ed66d96f0ea02

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_client_data.db-wal
    Filesize

    32KB

    MD5

    53ca60b9e7e7731a890f52130df4e775

    SHA1

    a4f0b48ba7f9af571acd6de81e35c5fac74d24f0

    SHA256

    10c896e556d278dcc05f53771fc31d8270d4a335770ae31696e25b0546f23d0c

    SHA512

    b5013f6cec50f9c878372cb183e255926c11ca8ab9078c33b71f51254e0e0dd053ea54a1dc60d62b3d6ebb340eda5ae7774241a869923963207e2f67c0cf670d

  • /data/data/org.kcis.savadd.child_fa/no_backup/metrica_data.db-journal
    Filesize

    512B

    MD5

    df0bdd75ae37dd80966c9cb90ee52ba2

    SHA1

    ea84fc7ae674f93de4f267c668319b128756ce2c

    SHA256

    e4f63b22c863920986f67b2786b39937509265e543e8ed4ee0cb81d1ff94dabf

    SHA512

    f78daeba256bd948c7aa347d5208607aab3263e84fb6f252ba72c551706f9c740c421ab6543733a69da2d827501d162d561469cebd0725bd95fb8d018b008921

  • /data/data/org.kcis.savadd.child_fa/no_backup/uuid.dat
    Filesize

    402KB

    MD5

    003efe333f638094e44466db00495b0f

    SHA1

    ec4eeaa8b8177509d0aba50b7afbe8fe53e3a73f

    SHA256

    9084987a229d7fb843da7942072128bcab84b8e7dd421d197200dbd8b3a30eb8

    SHA512

    856975695d58753350e92990da82ab802733d881545ced02e5126ab6f6c84c73b25cf2abc1e36e6d7c25277a6bd0ea1d918c542b03ce5f417dc62e70eb2092a0