7ffdeae807464374de0a9cc13f6aad68cf92007f929b053ffd3af425fa520377

Analysis

max time kernel
18s
max time network
155s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
24/05/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
freeplay (freeplayapk.com).apk
Size 4.8MB
Sample240524-pcsa7sac97
SHA256 7ffdeae807464374de0a9cc13f6aad68cf92007f929b053ffd3af425fa520377
MD5 9115cbe8474787c923481907dd0c7715
SHA1 eeafc498eb77aa72ebe46038cc1c17b852f22354
SHA512 77e9bd8d79bf282b5c04191db9d3d82c68ce4ea52acae8b95181e79a665418050073f92712108aca5f396655018e0382cce55f8dfd81198fcedca1ce665077b2
SSDEEP 98304:6tOPP1SgLfrT5J8kf48a43X3YAekkrIohakavIHdA4itkvE2rrgDgsmEjRYrReW1:u2cgTjgK3nRkrIohjaSdAV+vE5DgsrNM
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	freeplay2.app
/system/xbin/su	freeplay2.app

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	freeplay2.app

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	freeplay2.app

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/freeplay2.app/cache/1598581401714.jar	5169	freeplay2.app

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	freeplay2.app

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	freeplay2.app

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	freeplay2.app

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	freeplay2.app

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	freeplay2.app

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	freeplay2.app

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	freeplay2.app

Checks the presence of a debugger
evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	freeplay2.app

freeplay2.app
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5169

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1598581401714.jar

Path /data/data/freeplay2.app/cache/1598581401714.jar
Size 9KB
SHA256 d44cfb6b41231f150cf310c7c4d399be9587294e3727197e046db4a1c2c3ca3b
MD5 03ee9d194982da8259d81957162c9795
SHA1 f05ab5cc908262c4dd51f3e8ca49bc346dc136b2
SHA512 241f97312aa3e4547ce7f3195667301872bded70880ce33641a26292530ec2c22614a85c7e2437c5a88fff0e6359ef9c253caa79fa49a025869ae5dcbae524ff
SSDEEP 192:MMBYTGbpOG7EIEVLwJriXpUB8UQcoG/y6oRsxH5VRsujME9h:ndQIEVL6wpG8UlD66B5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

6aed531063c76e3a910a7c0ab155b2e7.0.tmp

Path /data/data/freeplay2.app/cache/6aed531063c76e3a910a7c0ab155b2e7.0.tmp
Size 563B
SHA256 9407fe54796db88c6b9f2108d114ed9c64266c10e78a3305f89a837ff67c83c8
MD5 4708baee19c8045d3ae0562b340af2b5
SHA1 f1fc64114a329c7be14af36f339acfb9b9b8bd10
SHA512 791b3016528db3a23c8d2d3b01d36601a26799a6f86cb27cd476dbee32baf0d08a9a910535e8304bb416a7a96c41fdbb8626accd17ceffaf8c8a4d9118c4fe0d
MD5 SHA1 SHA512

Submit Download

6aed531063c76e3a910a7c0ab155b2e7.1.tmp

Path /data/data/freeplay2.app/cache/6aed531063c76e3a910a7c0ab155b2e7.1.tmp
Size 501B
SHA256 9b061c4a7ec8675a85cf95837b860f2a3473d9dc30fb6b4e8bf15495651f259e
MD5 adeb8eb54049f88899d5e1d48fcbb134
SHA1 95e734eb141e0333f6b443f3b095ac6dacdeb194
SHA512 d8bda16917c094d0399ce2c51073dea6de79610021cfc39db5eff1260b3a8d6cb5bd0ec0bb2aed390ce84b4f174f74b249e3cc44bd7e89db315c1638a379e696
MD5 SHA1 SHA512

Submit Download

8d6ebde16756d5a2db254a777dfd783f.0.tmp

Path /data/data/freeplay2.app/cache/8d6ebde16756d5a2db254a777dfd783f.0.tmp
Size 549B
SHA256 cfe57b0ab6555f49fb9ff9351486fbf1d4b49f70c65968f82da5fb2e58aca565
MD5 979ca51ba6d843b741c6b7483d6460b6
SHA1 a0b280e59ae98c432df65df2f28ff6e7d899bec1
SHA512 0b880279c4f5b4a7b0aa14a297bba57173a79d8ae921e38da806bd5fb04a19f2a6a8640c8e6ed3a81df4372a2e0d0746f5a6bbd9382220288f125f1e3416b63a
MD5 SHA1 SHA512

Submit Download

8d6ebde16756d5a2db254a777dfd783f.1.tmp

Path /data/data/freeplay2.app/cache/8d6ebde16756d5a2db254a777dfd783f.1.tmp
Size 487B
SHA256 1baa7d7d9b965b1c173cca16a0412c744269783dc02842212ae794bcda1fe4e9
MD5 e6909e3bef1fdcdf1b0ff6b164bbed27
SHA1 5335092157f77b22f365fed393bbe80c972e2c01
SHA512 cdf97670456033b3d1c4981c667a9488140ce4ed0b2b238dcf2e0e8d5048b0db9d3e3e47fe83bcf4cee6920f74f44fa19e00a0196f670c6a98f12e07668bb379
MD5 SHA1 SHA512

Submit Download

journal

Path /data/data/freeplay2.app/cache/journal
Size 122B
SHA256 ed4275674794ddd82dc336a7601c4316c753e95dd359107a2b15b5c9e457c37a
MD5 fe649b4df19382c46c1b1e5b77b5ce07
SHA1 795c2317cd02de3650be39a6984a5bb4d265cfc1
SHA512 647e81f969dbd6d6f54668478b86d2eedcc8361cf5364162c92e19e779a346c7bcb8d98009964425e679b11fe2ba97cd7c7a40e32ac685e67c74080d30d20d0f
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /data/data/freeplay2.app/cache/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/freeplay2.app/databases/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/freeplay2.app/databases/androidx.work.workdb-journal
Size 512B
SHA256 aa324be2e88c2ce4e81953f25b6feb6bc8cfdceedda5f38ce69afcf79fa5ac56
MD5 b767bf0dbf0f600c81149bc3fe7cd1a9
SHA1 f42120bd49208ce734e20f106d907ba0b4b12ebd
SHA512 1c85d797c918699dc3a28a31e744ae564c5cd815c7ec953010f5fe9556b3af273d94f7e73596124d644e22b9c5d8a589f54007e8feb839558e06369a2087a45f
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/freeplay2.app/databases/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/freeplay2.app/databases/androidx.work.workdb-wal
Size 16KB
SHA256 700062ca78bd9740e2e2aa9e2b3eedf7e361bcdcf317631f9de86d1e0c9d1234
MD5 930e05bc0bee351d9d599259963f9ce3
SHA1 b1e5595bfd6c839f6b6c8d817ffe6756a71994e8
SHA512 f345cbe129b51b70b3d770f82b8cd706c8c0749bbeb18f9c351445fdc990c1a16087e93be1ccd64670042c69dbe7164db1c624eb6d80302a6eb06b9548e4bf12
SSDEEP 6:KYox7Um9FZdrlOERX4PBX4ogLugMBX4suuK+/zNIVyjo3BSZota3BSHtYEiOw2:KYo+gzdTRmBEyPbP/zaVuq4p4JiOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/freeplay2.app/databases/androidx.work.workdb-wal
Size 88KB
SHA256 a6e327c888f8c3a879fb5967c9262a7c7ba960857d44563e9bcfb68e328ef413
MD5 dd2843943648b0409d612794d04a9f69
SHA1 103feaf24fc73442b978984783bebe24e704cbf8
SHA512 efe07372f4edacd864236fb0d90417c2d2eda58da8e5c13eaa4de4b28806240d62c611a4b6c606e4b8d56810c514e3e04815c8111e3486ad1c1530a6731e7ab8
SSDEEP 48:5P/ymmumWAhrBlOymdlWJWKuWwN6xl73JcXSMmchI9a7WKZ+Pjw2cwgO69g82lu8:lRMpf83wS0+aD8Nn6266mPw1
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events

Path /data/data/freeplay2.app/databases/com.google.android.datatransport.events
Size 176KB
SHA256 200cb3b40e56c8cea61f77f860f9b56fcd6f83a87badca32a9c2c25e66c1194f
MD5 7478e4f8b8b81fd6cec488705c0374ef
SHA1 94895e61b6d7ffbb103181d11be98670005c8968
SHA512 ba5673e85729e2764ebd872d4b1246cc675c30815676622881a5cb3578f42cfcede9840adbaa538024ae21145c7cfd04030e0b68439b6e7f5c43128c290d6290
SSDEEP 192:U32CarpB/BGp3fiCsLECLAxCnCVCRCELIC8CPCS1LTcCiCoCtC3CxLdCUCSo0ACm:yarTBiEbVkHfjBapLuMdyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/freeplay2.app/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 5007d1e3a9cf336667d04ed77d42dc38bf044810690099d3e460e25cdae7dae6
MD5 6915b85fd2d8d242df116a0a198ed449
SHA1 e27c25d516d4a3971464c1dde8f4bd7ad39c93c2
SHA512 f65fdb1e3f8cb9860a14551edd1fcb439dd7484d12cf3cf47d0d9233f75e9e6fd472e2dc20df2a0c9281f4a48b4fc9ab4d2351279c226dc520aabb0b0e9e7630
SSDEEP 6:7+/l9FPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKV0//2:7+tLqLJdTRmBEyPb12
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/freeplay2.app/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 70c68d15c4312e36f058c16f9699565d84053ed0fd7e0f46393e05a33215b9e8
MD5 a3a439f5f6aad62cb2a612aef9ae15a1
SHA1 41fb8eee772dddc76f1d34d9245444c1197bd7c3
SHA512 4a5af60d95c24756839ef61073161baee3d528447c0fe59f99ac76051ab3c32dc77d84564671e8930c988e302253505aac194e1434f5f614dda18c46857c4dd0
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/freeplay2.app/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 4b8c6656a7c93b96716afba98cbeaa8469014da252680f1f3113201d709d2456
MD5 c71cb002b023bc0fa7a94c09b2a4bd3d
SHA1 f10fa67ba8dfc3681447a871cb9513d94e9f6694
SHA512 79cf76eaae9c7e2279a155760eb1d2e540eabf129a5cd039008a1158bbad0feabc75787fd333c0ca640ebbd5fff7c3842087a3f9c14ab2f0ea994a593953972a
SSDEEP 48:7M2Wx0uPgfqf+3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPSD:7tWx0uPgfK+3KMEX0xIyNYMaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/freeplay2.app/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 3e86028ef79685a62965e1a81b58eb628f4a6268d37fe22b7d92b8b048943b32
MD5 5fcc899f5c6581a3055ba7450d3dc255
SHA1 12c8f02653cbebd94d4672edbe53dc86bdbb9598
SHA512 51dff59b0bde9756ea04a5a95874896d0b377449e308ddd51544e5d8a394aa1a4ccc3c960133f196e24c1899fe996fd6da0b94b633df5e377be9a425187ad99c
SSDEEP 6:7+/l9dpn10vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKue:7+tkqLiuWdwRmBEyPba
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/freeplay2.app/databases/com.google.android.datatransport.events-journal
Size 36KB
SHA256 87836ccb32b8f3a0a48d7549f1ba9fb0b790382871b0294b672c971d7241b575
MD5 3ca332c6f3c21b2a5f0054bc206879f4
SHA1 3587105e29259a4ef877bd8584d277ffd0adc1c7
SHA512 0f39014179d737d4328bfaa7086bd9b93b260d6ecc1c54726041749201e5c6167d6a59eb2f70585dd41caeb0de1f40f93d6ac2bc4501e689fc5f30fabf1ddae9
SSDEEP 48:7M70oFJkF44A+nqW0c3u59MENZBdUdndVd/7T9IvdldHlq8/JqYpqPSM2w0vFAWl:7IQ70c3KMEX0xIyNYMaFbrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/freeplay2.app/databases/google_app_measurement_local.db
Size 16KB
SHA256 93847d79b16e79b0c497c2b33803e2e2eea12b2ca86c6e9e1c0a24918ada71de
MD5 c37b04e1c5341ba6ea283ba0f7964664
SHA1 c13868849b1b85de3232d5677ab62908bcf94897
SHA512 69f56aadf8e8b731431f535a09500f18c73a734905b0c3baa86e1f03cc1efbc98aff04339dea8fd672025c9eeed759c8d4f945e2d3b2e4e779daa5c054ce9392
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOw:TLWuEOe9zmzrfRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download