9953a318d8fa00111ee58e8ea1728718457ca070b2377e81db97553c80efbf7c

Analysis

max time kernel
164s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20240514-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system
submitted
24-05-2024 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app.apk
Size

6.3MB
MD5

f0033d4b3bad0340894cba29650a6464
SHA1

4cde57a6e116e41b7dad0d3dbae104b554c227cf
SHA256

9953a318d8fa00111ee58e8ea1728718457ca070b2377e81db97553c80efbf7c
SHA512

976caf9f016196c1cb9d661d3b250b1868c22404c0349f9679f9b39ede14e32d803f65d9daf0f936d2d43bfa763a075fc307cf96fe91de5ed9e1de00cb11ad70
SSDEEP

98304:WXrIAvEBdXdOlqZlYfoDhrbLIB9TYIZ7DSJE6PIRUgArJ2bQeoQY0OsPWxDrXIoS:WXkAvEBdXgZEd/hk7DQgArgQYPW94J5

Score

7^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

io.ionic.lmm13

description ioc process

File opened for read /proc/cpuinfo io.ionic.lmm13
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

io.ionic.lmm13

description ioc process

File opened for read /proc/meminfo io.ionic.lmm13
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

io.ionic.lmm13

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener io.ionic.lmm13
Checks the presence of a debugger
evasion

description	ioc	process
File opened for read	/proc/cpuinfo	io.ionic.lmm13

description	ioc	process
File opened for read	/proc/meminfo	io.ionic.lmm13

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	io.ionic.lmm13

io.ionic.lmm13
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
PID:4303

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/io.ionic.lmm13/databases/_ionicstorage

Filesize
3KB

MD5
570fea72d91130cdf05c12f6ab5c4431

SHA1
315dcf354cdeb4c454cbe93148680c3f0c11a6bc

SHA256
5bb65919bed02970d07ae31c79f6d66ff63a63f8d58b25ddc8fbf3d8dc91f73c

SHA512
393b4e66d33768303415da29d6b021bc473f6da43baf1e63995f8994f01bdaed580afb65bf9ba949fd7520d6a81a9555d5475ace5d1673180189eabbc52bfc85

Download Submit
/data/user/0/io.ionic.lmm13/databases/_ionicstorage-journal

Filesize
512B

MD5
d486d14a137f39dc456c044d914aca30

SHA1
023e36721b16056255c12634c7e1250bc4939ec0

SHA256
21889f7d8b9bc5422b44d136a3e9064a0a040122bc38f2aa7eed6b552f30238f

SHA512
ea329d6b52c7cac139aec07ec45886bbbf8377e9ada85c3e9397b5023226f452cbbb77a66080cff4e034060bb9b6f2d6b6ab3b0ea7387a513aac54405cdf1962

Download Submit