Malware Analysis Report

2024-07-28 14:45

Sample ID 240529-2v7vtsda2t
Target c2e8ace468cfe7c8860e55c03af46e32c9bb69f213a52a145854317e209e6a75.bin
SHA256 c2e8ace468cfe7c8860e55c03af46e32c9bb69f213a52a145854317e209e6a75
Tags
banker collection discovery impact privilege_escalation persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

c2e8ace468cfe7c8860e55c03af46e32c9bb69f213a52a145854317e209e6a75

Threat Level: Likely malicious

The file c2e8ace468cfe7c8860e55c03af46e32c9bb69f213a52a145854317e209e6a75.bin was found to be: Likely malicious.

Malicious Activity Summary

banker collection discovery impact privilege_escalation persistence

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Registers a broadcast receiver at runtime (usually for listening for system events)

Queries the phone number (MSISDN for GSM devices)

Reads the contacts stored on the device.

Tries to add a device administrator.

Checks if the internet connection is available

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-29 22:55

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-29 22:55

Reported

2024-05-29 22:58

Platform

android-x64-arm64-20240514-en

Max time kernel

13s

Max time network

187s

Command Line

com.Soqlqjst.Purityid

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the contacts stored on the device.

collection
Description Indicator Process Target
URI accessed for read content://com.android.contacts/data/phones N/A N/A

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.Soqlqjst.Purityid

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.14:443 tcp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 192.200.199.117:80 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.180.8:443 ssl.google-analytics.com tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
GB 142.250.187.196:443 tcp
GB 142.250.187.196:443 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp

Files

/data/user/0/com.Soqlqjst.Purityid/app_config/config

MD5 112c743331c7353c93c314a155e49b24
SHA1 e98a41e96a4b6ca35cd5711ef5f15b298cbbc373
SHA256 5c8fefceb71215e1402307f68ee98d1b3df56a9a2233672bd478b08244c1e46c
SHA512 0dbccae8f35f2d77f6a93d839ca6d40d609159f3937bcc72d5cf6a4fdadbe2695310fafd06e7fa1cfbcc5d8af464d9eab97cd27657bd8ccb7cff1f6336bcedac

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 22:55

Reported

2024-05-29 22:58

Platform

android-x86-arm-20240514-en

Max time kernel

9s

Max time network

184s

Command Line

com.Soqlqjst.Purityid

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the contacts stored on the device.

collection
Description Indicator Process Target
URI accessed for read content://com.android.contacts/data/phones N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Tries to add a device administrator.

privilege_escalation impact
Description Indicator Process Target
Intent action android.app.action.ADD_DEVICE_ADMIN N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.Soqlqjst.Purityid

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
GB 216.58.204.78:443 tcp
GB 216.58.201.98:443 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp

Files

/data/data/com.Soqlqjst.Purityid/app_config/config

MD5 56813e38119e924d8ea8897f68b525e7
SHA1 1568c1e615ff0bc8c97f8b5af13eb93be0afa9cd
SHA256 85eb99cc615cd2fa1c6658341f5b696c281ecef63996acdeaca47f774f746715
SHA512 289ef5df82a2e14ebb3563f515b60d9194f4fcce5fe21a1c3b571da4b3a7a20aeb895758435fa6428ae93238462199c26b3cd556044763b1f49939ab61bf2b39

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-29 22:55

Reported

2024-05-29 22:58

Platform

android-x64-20240514-en

Max time kernel

10s

Max time network

186s

Command Line

com.Soqlqjst.Purityid

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Reads the contacts stored on the device.

collection
Description Indicator Process Target
URI accessed for read content://com.android.contacts/data/phones N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks if the internet connection is available

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.Soqlqjst.Purityid

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 192.200.199.117:80 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
GB 142.250.180.8:443 ssl.google-analytics.com tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
GB 216.58.212.226:443 tcp
GB 172.217.16.238:443 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
GB 172.217.16.238:443 tcp
US 192.200.199.117:80 tcp
GB 172.217.16.238:443 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp
US 192.200.199.117:80 tcp

Files

/data/data/com.Soqlqjst.Purityid/app_config/config

MD5 46bd4a1acb714989b7291cd22c940dfb
SHA1 c11475090903a4af642d634b1b95b6c25a58f1dd
SHA256 9727e884530eee0331609047d04b469069da51ccaadec609463098b59c749649
SHA512 4377e3e59a4a0446201a4c6a3352f0ec01bdb26a0d064f38bd73ad0a5c601c989f11e7e146963ae9134e2a1c25b6ccd2b0143ff5d4b3af283377301ba99df0f7