Analysis

  • max time kernel
    27s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    24-05-2024 13:03

General

  • Target

    app-release.apk

  • Size

    6.7MB

  • MD5

    f09627217b4ca1f93b56266f013ee174

  • SHA1

    8c796ce5affc20a4a1f494dd7d2b0a141c263c30

  • SHA256

    b6cd78d2dfbf8c5cb285ff5843d9f840c25c5c6a0f4d20a66ad492849fa11be1

  • SHA512

    3664d60461dbd0e4569905fb9dc835c91e5b4ba5efa2b44ea9d3a9bc715e30d9e8b3258c3b1803012cc79b64a7dd36fcfbdef26362c09fdb84db215a94d0c04a

  • SSDEEP

    196608:Jq4mrUCkzxdlm9IdMeMAfMCTx0qWEOOdlICV1H:Jq4m7kVdlK4Mc0qW9OhH

Malware Config

Signatures

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Checks the presence of a debugger

Processes

  • com.elmecano.fleet
    1⤵
    • Checks CPU information
    • Checks memory information
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    PID:4318

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.elmecano.fleet/databases/com.google.android.datatransport.events
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.elmecano.fleet/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    b21549198dd8b3f3f8e2678a0a9808b7

    SHA1

    2a55212783446c6d42d5f71b45dfac05a8bca379

    SHA256

    46f435f159ac91193aa494cfe7230bb631d3a760db41579281ca803b9f2fb5bf

    SHA512

    6d01e1ded03b49719ab7f25545f77c985da0db2205d8a6456460bb15d3379036b8e5bcbc937bb0719a80e3322687a7a05a6686cf03f29d276cb0464ae0d886c3

  • /data/data/com.elmecano.fleet/databases/com.google.android.datatransport.events-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.elmecano.fleet/databases/com.google.android.datatransport.events-wal
    Filesize

    68KB

    MD5

    80722cd0de3ee09e0b2f138b274c20a5

    SHA1

    5521f8690daeb3a81326dee4ad537e4909132083

    SHA256

    41530be528714a893e5cf72fc328be882d2be7e4aebff36feeebdbbbf3d4207f

    SHA512

    b18d4815b86d7120a19c2a8d8ed69d7699bc27bfd38b183cdffb37f343a3285487b4346529e63d3ccf2d2266e23c7160a44b0a30cd390add6f8e0e242171355f

  • /data/data/com.elmecano.fleet/files/PersistedInstallation2513655909590500262tmp
    Filesize

    568B

    MD5

    7b3e6d87d9689c0884581190145638ca

    SHA1

    f7f211f776c8fea974f604e0cd0fe85b80cff14a

    SHA256

    9dfe3c01ca15b98c17402e147856e275e2fd729e13d139b09c732ce1899b9f6e

    SHA512

    dca1f27454796ffe19c2640447dcd5c0ff373a01345b54b24a065671c3918b6d10c54ec6a88f337d520ff5726a594d8eb95f5fc8d46375918743d39634899498

  • /data/data/com.elmecano.fleet/files/PersistedInstallation5216997935452304798tmp
    Filesize

    90B

    MD5

    224634ef344e770a7ab21487727b08ea

    SHA1

    b1d9fa3fcf2ae457729ca0edcc9922452df3474f

    SHA256

    5aec719cdc9129b5c90ebbdead0387a7a3f86592ae9897829a9fa04174a80526

    SHA512

    d21aed617cc1fd9c93fdb6c554b15933380131d696a862871d43a56481fb3e9a7a737a90c72fa14c953cd53dbb3aae7c8cff595aa5cc4050d8c37786af52006b

  • /data/data/com.elmecano.fleet/files/profileInstalled
    Filesize

    24B

    MD5

    46a64bcb33a78a20f745663fcf9a2dd8

    SHA1

    95ee21854b43510825b3187a7d2b01f3f5056ee9

    SHA256

    9284604c8e1e75475a905cd8f033f5affffb60f99d7d3ef739d1811f724cc9b9

    SHA512

    5c40fc469cd0389d71fe5cb165867c6530af4457ffa6b043cebaf817b1012613f8b55e8d694aa04d13db555aa95668331b1ffafedb2e0e035a64d652b955f918

  • /data/data/com.elmecano.fleet/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
    Filesize

    8B

    MD5

    6062ddf0596dda8f74581855b934d4a3

    SHA1

    731966b544d85b30048daeb8d5b4d569f7fa650b

    SHA256

    01968c1ff8bae611c1e99546e619f54fc60ab963a64a5378e9f2d769ddc8e775

    SHA512

    d32145d4791bda4541d03395c9a4f5790eecddfaa7e527d3e436db29fb859972edb9fd13e15a770384deb2277ee29f3a8bcfec6c7d38d528cee96397aa4bab6b

  • /data/misc/profiles/cur/0/com.elmecano.fleet/primary.prof
    Filesize

    2KB

    MD5

    89aa87754c70a0ab40db027133c8a296

    SHA1

    dcf61e3423a31635298d6af542c731ccf3ae9253

    SHA256

    85a8a2c0b5fd719632987a1836878daf5f24f28b1afc9ede9dc907a7825b191d

    SHA512

    7705706793f989e2621804bbcccb9ce8e11ff19a3a49f0df83866250899d766e104c99f2da52d1734ef22d28cc278eb9268b210317cea9601702a62bc2d22610