338307d6e2aad7c9b3548e72ed051742aaddddb9cf825db2e3ab64c4d5a48128 | Triage

Sharing

General

Target

cloudflare.apk
Size

6.7MB
Sample

240523-qgw1mace3v
MD5

f30c7216a3a8802a2866d0e3e24ba6a5
SHA1

c5d22590327432d4232fd00136e35537d9caf48a
SHA256

338307d6e2aad7c9b3548e72ed051742aaddddb9cf825db2e3ab64c4d5a48128
SHA512

a617089a69ffcc73c67968d12ef5f92ae700fb64fc294015e7ca78db98d2aa8611982d2d28f8fe66388c75c0207974c96643dc2a330e5e3cfc83672d8520ce86
SSDEEP

196608:glqaPfKmDzdw1bZKFDeBaeSXLYS1DdKK15y:glhPCczdw1HBaDbYS1Dd+

Score

8^/10

android discovery evasion persistence

Malware Config

Targets

- Target
  
  cloudflare.apk
- Size
  
  6.7MB
- MD5
  
  f30c7216a3a8802a2866d0e3e24ba6a5
- SHA1
  
  c5d22590327432d4232fd00136e35537d9caf48a
- SHA256
  
  338307d6e2aad7c9b3548e72ed051742aaddddb9cf825db2e3ab64c4d5a48128
- SHA512
  
  a617089a69ffcc73c67968d12ef5f92ae700fb64fc294015e7ca78db98d2aa8611982d2d28f8fe66388c75c0207974c96643dc2a330e5e3cfc83672d8520ce86
- SSDEEP
  
  196608:glqaPfKmDzdw1bZKFDeBaeSXLYS1DdKK15y:glhPCczdw1HBaDbYS1Dd+
Score

8^/10

discovery evasion persistence
- Checks if the Android device is rooted.
  evasion
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Checks the presence of a debugger
  evasion
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasion