Analysis
-
max time kernel
176s -
max time network
131s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
24-05-2024 12:36
Static task
static1
Behavioral task
behavioral1
Sample
daa8d41db8b17c2a107d17fe15cd5a310142bf8c62d6177bffdecefcd7522765.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
daa8d41db8b17c2a107d17fe15cd5a310142bf8c62d6177bffdecefcd7522765.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
daa8d41db8b17c2a107d17fe15cd5a310142bf8c62d6177bffdecefcd7522765.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
daa8d41db8b17c2a107d17fe15cd5a310142bf8c62d6177bffdecefcd7522765.apk
-
Size
1.9MB
-
MD5
1cdadc772cf659725cb2f8a2bb9a9d89
-
SHA1
69dd08febb44efe9c0d2393e4f6cbce131bc0c35
-
SHA256
daa8d41db8b17c2a107d17fe15cd5a310142bf8c62d6177bffdecefcd7522765
-
SHA512
3a2cce05c3dbe24be404976092ce99ff7596a0566cc4fb311d97b1b5062c4aeb3cbe088b08eab85eddb5c1f1b2a415cac3d581405adb20d24671b4acc9dc7f57
-
SSDEEP
24576:Qok/Boh8Y78QDuqTWqRQ4kQQOVa6ox7nPWgYJWrwkc7OhpMjg4OFgiWV7r+tmX9W:Qokpoh8Qr/TRxC8YMJ0VrOpLh+tmUeS
Malware Config
Signatures
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
quasar.bistrocookioc pid process /data/user/0/quasar.bistrocook/files/bdbfefb6.dex 5329 quasar.bistrocook -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
quasar.bistrocookdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone quasar.bistrocook -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
quasar.bistrocookdescription ioc process Framework service call android.app.IActivityManager.registerReceiver quasar.bistrocook -
Acquires the wake lock 1 IoCs
Processes:
quasar.bistrocookdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock quasar.bistrocook -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
quasar.bistrocookdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo quasar.bistrocook
Processes
-
quasar.bistrocook1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/quasar.bistrocook/files/BGEaUZrYFilesize
471B
MD55cb9c565bce657226e3261c7f619d4f2
SHA1ff3b2b7e212bda3f9fbd59083d0f5b5aee740fb2
SHA256d5cf91809ee37661a2efee44083601503706f2c61e3bef1ca426e8893b05b8d8
SHA512539496eb7bb2bc7abb2abdec9acc4ea53290021fe2fba86bb429931519f2c7b018469c615cbac4aec78a3e45d55495ab6056d95c0d1bfc09a4162798bec02b03
-
/data/data/quasar.bistrocook/files/BGEaUZrYFilesize
725B
MD5dbf3143e9bf3ad44b46f3b3cebbd10f8
SHA168dbd694a03eda5fcc60da267ed442bee1c762e4
SHA2566d4c8f0442a24e15aa1d92c8f648ef4b6485bff7d46c5a16a1d8db26dee0162e
SHA512b56276772a158ca6437373c04bd9e5ee619b8c5f6de72a30ca9094fabe09a5a70fd20be3e424e7c095fc6a11cbda59169610d7c7622997dc2d1105b6554801a6
-
/data/data/quasar.bistrocook/files/TrPJFdsNFilesize
336B
MD5f18e795c884d82ea168b02b4ccb8ed1b
SHA1d92db564938225ba463bb667c5f6963ed1e0a4a6
SHA256bc1f5ef16449dae1348473a5ebf18f1a1696a161c0c1d04580189ef35c17ebde
SHA512c6b51d0e57f4f829e2d8eb4b89094b6fda65a11927a7f2e68a9105a26db7225d0737cc5ea6c8e8ae8fd16a6ee32035fadbcba80457a902a88fa017b03db92f00
-
/data/data/quasar.bistrocook/files/TrPJFdsNFilesize
336B
MD512884584997963fc4fcc59fd80593056
SHA133d6c65883af3148e80c7480ead71339a6812ada
SHA2562e4616243306e6f677b1fe88de26208acfd298537869506e86e480d6ff2f2389
SHA51246be0437fd0c6bf333bf2a47ca27e1adf28bdcd647f6a1bb33f2098338dae4aa3e1590a5e5687a8bdf32434d77ec7d209af70f4ae308ad8a178a2ef7349c91b9
-
/data/data/quasar.bistrocook/files/TrPJFdsNFilesize
336B
MD5cfd935be78594e68939503f8e0e4a0d5
SHA16808b5dabb9030cb616ec63319943d995d53805c
SHA256fb8fda815d1e7fe620d1c8f32f133e99aea2d2a1ac9f2d6c5a7124402f163f22
SHA5128e74aa0817bcc9efdefef2253de9133d136c63ee8856959513ba5f7a9d81246cedda26c3357cd35f3daded34c52ec74cb9171953ce759d3bf7fefaa4cce5e6cb
-
/data/data/quasar.bistrocook/files/bdbfefb6.dexFilesize
261KB
MD541b8243edb9b9dde73ab207644e7e53b
SHA1675de278447f6b585eba1db7460e599a30596d46
SHA25614df0943e0c93d98b078e8bb6557ad887781f0337e54250184a8df5ff22e61ea
SHA5129e86bfd169cc48e2b0a917884d38ed79bc0975420effaf336f1255cd61349b02a78a601e23722a7b2178578a73a23d8881872cbe619b6d58e84b48a43955117e
-
/data/data/quasar.bistrocook/no_backup/com.google.InstanceId.propertiesFilesize
2KB
MD5f1412aa74bbdfd64f22a4f0dae847f26
SHA1385d98d41f5fb75ee50fa10b4e131dbc4596459d
SHA256dc8aced4b33efa660f78e28f178e2947d120a9cd5e3789296598b20b0ba15f5e
SHA51228f2adffc454470a9d597084cb252816a4a3e9aaf0452070342f3c69f6f16eea629d63195349d3e1309959a256f331c0eac4bab4d0d6f2b1cce5f93604038259
-
/data/user/0/quasar.bistrocook/files/bdbfefb6.dexFilesize
614KB
MD52c7772a4236490f59e7f642a7a3a4cd4
SHA12e2bfb350a98af968a284a971751abaf99678d9f
SHA2563a79a298753fce30d4a773d80e4ecba6a90149d201aaaba56ea0edba3be541a6
SHA5121ac26087b78da22a346597bd86b9a1cffa467c3f90aa0e22e9fc2528e7bfeaee48f4cf16a4a364053125da851d347613afcff78277dbc2752aaba52be9f67e89