dabd27db7125df7add24fa016a826e9683d9680cbe24d63d38f77ad099057387

Analysis

max time kernel
177s
max time network
130s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
24-05-2024 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dabd27db7125df7add24fa016a826e9683d9680cbe24d63d38f77ad099057387.apk
Size

1.6MB
MD5

b92d6293a171226e6b932c71a1dddbbf
SHA1

79664108e90d144fa109143f91a5e297ba20da80
SHA256

dabd27db7125df7add24fa016a826e9683d9680cbe24d63d38f77ad099057387
SHA512

3965314e69d4c52758b76fbe605bc1be6cc70b191fdb50be0c6d55f3fe1fbfb6af603cc3fc72fdeb53e8d686e186d0d6574e3b44961b8217f8bb1d8f30b095a4
SSDEEP

24576:32PiBPX83UMau1jKjbjEgyI/zV0C3FyqoEhpMjQ4OFXiWV7ALtmX9bFd:3LX8+uYjbjLyY1miLCLtmBr

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.greencity.highdive

description ioc process

File opened for read /proc/meminfo com.greencity.highdive
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.greencity.highdive

ioc pid process

/data/user/0/com.greencity.highdive/files/7a5955f0.dex 5243 com.greencity.highdive
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.greencity.highdive

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.greencity.highdive
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.greencity.highdive

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.greencity.highdive
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.greencity.highdive

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.greencity.highdive
Acquires the wake lock 1 IoCs

Processes:

com.greencity.highdive

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.greencity.highdive
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.greencity.highdive

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.greencity.highdive

description	ioc	process
File opened for read	/proc/meminfo	com.greencity.highdive

ioc	pid	process
/data/user/0/com.greencity.highdive/files/7a5955f0.dex	5243	com.greencity.highdive

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.greencity.highdive

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.greencity.highdive

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.greencity.highdive

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.greencity.highdive

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.greencity.highdive

com.greencity.highdive
1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:5243

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.greencity.highdive/databases/com.google.android.datatransport.events

Filesize
40KB

MD5
15d5b92dcbda7ef7f9ca327a903e46e4

SHA1
ca153b66028a58d90346ff8abadbdf01b95c37b1

SHA256
e802fdc1ccd833b91d80bb1d8f54cab2b585393e6a07622c4d9feaab07633370

SHA512
2352f167ee5aa37cb3438a0a7df8f632771a1d019c5cd120fe62313fb73aed6d0e09186a9bf306a564371b846a8da020f6acd7aede0cc47ca50701611fa84aca

Download Submit
/data/data/com.greencity.highdive/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
a64ea9c366964438a99a2dfcda2d6df8

SHA1
d83a4c87b95faa6932406638b7a6c2ee2eaf5721

SHA256
6c8e15f0fbb23b82fe5a21d9cc8bc3e3dd9668a243fa939766a14c8564995dc9

SHA512
7ee856d72f0ebf37a077dace96277e089d773184896ddc57bc5dc1c22cd1864feefc6beb4735aa287db72e919a24d1dbe62a963b96d28594e4d36e5f467f8845

Download Submit
/data/data/com.greencity.highdive/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
338be9c5fe6af14f4e4cd2557e3ee953

SHA1
3e72744e598bf42aa3dfb3ccd42b4a07eceaf4da

SHA256
343061f697af49443b29f03485030a4131ed60e9c57f4a6f8d59f50c991693f6

SHA512
8453eef9eb866fa3a61be0ffc80a27996b7649c5c39346201f2e8720b5d6ff4b79da3909ac2f863d3864e3a61bf5d3191521b44dd5d8b0cd49bc6c9a79a06deb

Download Submit
/data/data/com.greencity.highdive/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
d3a98fbcdd745d2ec633779c9084092b

SHA1
86b0fc85b7061178a9b3c273b910682eb3355da9

SHA256
d43003ab47ef3cb222472f2a673a9aca438da2a147b93e4c9fd1aad7dc633b89

SHA512
cf41cca48f81000449c1c0146eaadf27d23cd08121f740bba03c3eebc699c62e32fe0c4c747472969530092598f0223b847e99c6ae254307a4d657b421693f0a

Download Submit
/data/data/com.greencity.highdive/files/7a5955f0.dex

Filesize
261KB

MD5
6541f54e96e194c048387b57f9422f28

SHA1
d5e6cdfa18ff910ee848e498edcb57190a346770

SHA256
c25c28bd3de1b460f42aa6210f77df7f605f7e1bf4ae78d72531d9dbd453bf31

SHA512
153e393a1631e4bd06a5147ff004a8d854805da71d7325cbe586edc6ddf1499a408b63cd0f1217231fefa532003f347d0fe076d199cad7a52ce3b0325e7cf5a2

Download Submit
/data/data/com.greencity.highdive/files/BGEaUZrY

Filesize
496B

MD5
7f8ebb6f78084346e5f192087b374a71

SHA1
e1b29455048f8119e3cb11ed9e87a2e74514deb3

SHA256
cd1926f5e6c7f49d9678f8a70656d95265c95563d313e893686bc32b86779d10

SHA512
4b17fc459c4ff560ba7dc72fee9ed3a106ae367d14055c4cbd66993d641d37a6ec0bd565783a9332b123f7679f28a44d98d3c38828b01f688f406781d0f92c18

Download Submit
/data/data/com.greencity.highdive/files/BGEaUZrY

Filesize
744B

MD5
3d6992de9e5566acd8e7c3330f89b645

SHA1
24a482bc9919703de5e09b4f6d6250f35c285e3b

SHA256
18bd9c1ecaee066ac6a185fa22c4d8e65d9cbaf9539250b258fafee05e3cfac8

SHA512
8b8e324beb0c7495b9f4e6c920de99ccc49081028ce15d3064a455152f54efc0ce5da9660ff0beeb5fb877fbd09c8ba75618efda981e5a49d513a9d895fd2048

Download Submit
/data/data/com.greencity.highdive/files/PersistedInstallation7212441127616595095tmp

Filesize
90B

MD5
b0ab70b5c23c58dc0d3499affc59ccc7

SHA1
e8a81afe9188c2f9612c2d967382c3c0d5a3c0af

SHA256
1c6eca459005210c618837214f1e8949d3cfe7c6553486def9d2e84650a53011

SHA512
6e10e355c2d44080a7dcce94f5e38c52fb1453c3615f30bb9275833d261d932957ab054333bc3d246bb1cc12b481ee95481aabbfa3301e9b355abe4dd5a3ea42

Download Submit
/data/data/com.greencity.highdive/files/PersistedInstallation758882731005138770tmp

Filesize
567B

MD5
c6bb7ecece17305bff454b031d469448

SHA1
bf0baea342c3b8420363b6bbc166ab69a4e2324c

SHA256
7f09b0601f4109acf08271648dff5b8ea7b0772d501715ab93d9e1842f273683

SHA512
7af1373d483e6ab69b5b0058cead41b72606cc3c4ff1dadf2f0a36a97d6bba4005c2984c44d74000581df716b71a06da4741d7022bdce42687116cc45db5a2d7

Download Submit
/data/data/com.greencity.highdive/files/TrPJFdsN

Filesize
336B

MD5
f40f41fab49c37da3337eb3879cb581e

SHA1
4d3810de202e80c6e000390fed7e27516fe0f641

SHA256
4509de2011b8b3a65491b2b9abd5b2fdf25af7dbf67c07c6d9b51858d0607f3b

SHA512
bd4f6406d9ed170fc53d174d634c4eb91832f343386aefc79dc5392f2384c2760c10d635259584138373c2a0337832b46aace80db5357e4e56436eb1924df846

Download Submit
/data/data/com.greencity.highdive/files/TrPJFdsN

Filesize
336B

MD5
59d442b9b29a31d1f0b38cedd657eee5

SHA1
cce2848a6803c8c94a5fa0719f621472fe494de8

SHA256
22a17970737ccfb9f3dd43988e7b1160a43959eebbfa8268c8648ed4e375b5c5

SHA512
23e9359946a0e38014904ab1effc7ab2520a80f0438ee9cc4bca2fdc9ed21af98e7981b9685c763efaeec9a02d6661f3d05366a31f5aebed9a072f26a653894e

Download Submit
/data/data/com.greencity.highdive/files/TrPJFdsN

Filesize
336B

MD5
fe82428f5fbd8333db2c402e7155b615

SHA1
ed6a98c535a8b331da9017ef5863ef47f9732d95

SHA256
cce6e1e1e955e03f35d1693502e6d4e12e72037f7caeced6d85a30bcf694f4e1

SHA512
371609a9aa60ba49e9104ccba492070a6de8d66f51f2d25d3917c8ce49ea747b3ae3304a4fe0d27bce098d3d302ebeb04cf0f2fcc759a26fddacbaa410906459

Download Submit
/data/user/0/com.greencity.highdive/files/7a5955f0.dex

Filesize
613KB

MD5
fe14e95f31460cd2332e4ffb8e4957f5

SHA1
04caa3638ac98987e15070a97f8789b7a62ed0c6

SHA256
65cb45562d19755d4e7b4828389f4ac6df804d80188d43759255f50ef72a0b5d

SHA512
403b053a3aa7314f928cd6cb89a36346e23edb074f72064607b3d2c6ad419a3679b5110ad63a06a25b5df0ca30b78f025301d218d7eb204e719577318b12f2bb

Download Submit