b6cd78d2dfbf8c5cb285ff5843d9f840c25c5c6a0f4d20a66ad492849fa11be1

Analysis

max time kernel
51s
max time network
153s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
24-05-2024 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app-release.apk
Size

6.7MB
MD5

f09627217b4ca1f93b56266f013ee174
SHA1

8c796ce5affc20a4a1f494dd7d2b0a141c263c30
SHA256

b6cd78d2dfbf8c5cb285ff5843d9f840c25c5c6a0f4d20a66ad492849fa11be1
SHA512

3664d60461dbd0e4569905fb9dc835c91e5b4ba5efa2b44ea9d3a9bc715e30d9e8b3258c3b1803012cc79b64a7dd36fcfbdef26362c09fdb84db215a94d0c04a
SSDEEP

196608:Jq4mrUCkzxdlm9IdMeMAfMCTx0qWEOOdlICV1H:Jq4m7kVdlK4Mc0qW9OhH

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.elmecano.fleet

description ioc process

File opened for read /proc/cpuinfo com.elmecano.fleet
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.elmecano.fleet

description ioc process

File opened for read /proc/meminfo com.elmecano.fleet
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.elmecano.fleet

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.elmecano.fleet
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.elmecano.fleet

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.elmecano.fleet
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.elmecano.fleet

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.elmecano.fleet
Acquires the wake lock 1 IoCs

Processes:

com.elmecano.fleet

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.elmecano.fleet
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.elmecano.fleet

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.elmecano.fleet
Checks the presence of a debugger
evasion

description	ioc	process
File opened for read	/proc/cpuinfo	com.elmecano.fleet

description	ioc	process
File opened for read	/proc/meminfo	com.elmecano.fleet

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.elmecano.fleet

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.elmecano.fleet

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.elmecano.fleet

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.elmecano.fleet

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.elmecano.fleet

com.elmecano.fleet
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:5105

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.elmecano.fleet/databases/com.google.android.datatransport.events

Filesize
56KB

MD5
c7043a1ba8b445e24d8a4cfc90127a3d

SHA1
0aeef0a9132b0a7d0b649399bf3c6447a3af3294

SHA256
62811ea67281a81d2d1f75c054bd1d46f6eda3feff7c3945cfadd2840c9f9ca1

SHA512
2abbe9632ce42048d694be9ffd2afc682b73a0bdc09fa28e352aa8a25483dded9c795088bd7b46f11f8e21b5b14a15551d79bd04595e97f3dfa31db29bd45332

Download Submit
/data/data/com.elmecano.fleet/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
58349f8e2323ef516f7ba16239ccbd42

SHA1
ed1d5663e883bfa04bb8b38a4c2f0eb1c0bdefdf

SHA256
26d7f7a2b7f511d1056d8426bcc6541f1798198c24e0c7aa304fe00578b5e5c0

SHA512
0ee1e4d1498bea92139d88bb4f5ac2404f0cd2c225f0729c3b4a4d678090e756b84a6d6f50730d7e89086fb53ae8bce534388834c0ffb0d5cdf3127109514aab

Download Submit
/data/data/com.elmecano.fleet/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
f34108e6136dc3b67b9422b7cdede7ff

SHA1
ea2c8608d1b31330c5fe00edabe13f84feb82d0a

SHA256
f8af3e8fac3bd838bad79c522e99a5146f92443d4fa5ec8cc3e0959312222b80

SHA512
42e45189960034286d99bb8b011c1ff221d037db42f000a8dc6a207b0d62c8bc8ae34a6bec2a91a9c6bc1cc1798575872f71f73485382aef82d8c7bf86dccb76

Download Submit
/data/data/com.elmecano.fleet/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
579b9293f9b9295df2cc331996414a24

SHA1
9a9b765e921b709f91dc72baf7aa9877b5223e2c

SHA256
563a273376ca52234fb47e854ad714fc3e1d4ccd1b30120eea58f0d30b21c044

SHA512
78e362242cf3ea7b3836cf02bf10df274f9aae6ccf5b47742696e8bb02ccd70694483e8acfb591377889fc0d217ad94087d7876d73d7483a87968aa3dbbf0c7b

Download Submit
/data/data/com.elmecano.fleet/files/PersistedInstallation3606947449263247123tmp

Filesize
569B

MD5
c6bf6d84fd3adef4f224850451cb9c0c

SHA1
a94205cad493127f72e81a01725910ce1d0dd828

SHA256
3314b1cf65b4571341aa9fbadd7f7e79f1a27554c836a8976d87213f2638f164

SHA512
ec97d77c47deda5694f568379fb1fb5db5313cb7cabf20fb5aea4e06fb7801d43e9c653d6c53a4be41ca65a7a390fd0c3330d170457b3a9db8036d0b42b26955

Download Submit
/data/data/com.elmecano.fleet/files/PersistedInstallation5069402575807893260tmp

Filesize
90B

MD5
92ab4026beaffea9cd3e9702358379a8

SHA1
442adf729dba3e8b5cf17df2307095b0b9a47817

SHA256
6d6e651ddc87c73429bee0621f5375516bcb83e793d0a7ad33774ef90d610e86

SHA512
a3dfcb9d337e220a0167ca99a8b648e904a39bfcd586083e581fc7efd6923fb1548eb07503839f7797347a8368845d5dbcc2768b9b5c1fe44141c63406e43f30

Download Submit
/data/data/com.elmecano.fleet/files/profileInstalled

Filesize
24B

MD5
4283b213f7ad54a0b813d767f64ff2c8

SHA1
f23c3935c269f0108dc48fb66c17425948932989

SHA256
b20d2548efe1d67843d112cae7f8a64f788ebb152983c2dd894415cc40278ecf

SHA512
6874568a55a615d57ff433f77db8505f5f1001de77c29901317f44af14c144b4fd93b3ce3a9457f547458d8c61c78c453540a0e1e3da659e10c13dd0c1734bae

Download Submit
/data/data/com.elmecano.fleet/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
9f65e9896cbc549ffbc9bb348eee4fa5

SHA1
20362279b8edadbe0c01317e5e310a7aed4a62fe

SHA256
20d7c01789d5fe56e650acdde5ea5f299f74c3dfadcaac09ff27ef68baebe461

SHA512
dadade1f481dcdbc82e2604e1c3b81a05e6920aae84a8defc8c53363edba84a2dfe888df4ef7d20edc5fbe175658b1c47908a094b73d6b8206c6bde3e0a949f1

Download Submit
/data/misc/profiles/cur/0/com.elmecano.fleet/primary.prof

Filesize
2KB

MD5
89aa87754c70a0ab40db027133c8a296

SHA1
dcf61e3423a31635298d6af542c731ccf3ae9253

SHA256
85a8a2c0b5fd719632987a1836878daf5f24f28b1afc9ede9dc907a7825b191d

SHA512
7705706793f989e2621804bbcccb9ce8e11ff19a3a49f0df83866250899d766e104c99f2da52d1734ef22d28cc278eb9268b210317cea9601702a62bc2d22610

Download Submit