29e028d52b0a5b8e7b3d627028828cdf2e0b4ccae1dfaaeb3884cc7babbe17ce

Analysis

max time kernel
178s
max time network
154s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
29-05-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flash-Browser.apk
Size

1.0MB
MD5

8b183c787aa69873965d24d67abeeb9a
SHA1

b80d5ed35d5cf7df5ebdf9169ec71dbb7a411a1b
SHA256

b4617f5735eec873ee271a8642c5fc29f293d2d6efc3f8504f808c5e1176816d
SHA512

d81b3cf096e6a89b700193389da1a792990207e1ed92f9aae54a340598c54b13db3ade1b315c342789e73e3697f5e02b40a436377ff4d4ec3823314f5c59ca1f
SSDEEP

24576:/SG9qt2Cfu0iusUs2RGLEJTZNrzljfUJLkHOO9t6J:/SGVCfKa+EJNNpyC6

Score

8^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.tech.browser

description ioc process

File opened for read /proc/cpuinfo com.tech.browser
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.tech.browser

description ioc process

File opened for read /proc/meminfo com.tech.browser

description	ioc	process
File opened for read	/proc/cpuinfo	com.tech.browser

description	ioc	process
File opened for read	/proc/meminfo	com.tech.browser

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tech.browser/app_ttmp/t.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tech.browser/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&com.tech.browser

ioc	pid	process
/data/user/0/com.tech.browser/app_ttmp/t.jar	4339	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tech.browser/app_ttmp/t.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tech.browser/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tech.browser/app_ttmp/t.jar	4265	com.tech.browser

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.tech.browser

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.tech.browser
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.tech.browser

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.tech.browser
Reads the content of the browser bookmarks. 1 TTPs 1 IoCs
collection

Data from Local System
T1533

Processes:

com.tech.browser

description ioc process

URI accessed for read content://browser/bookmarks com.tech.browser
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.tech.browser

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.tech.browser
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.tech.browser

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.tech.browser
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.tech.browser

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tech.browser

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tech.browser

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tech.browser

description	ioc	process
URI accessed for read	content://browser/bookmarks	com.tech.browser

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.tech.browser

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tech.browser

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tech.browser

com.tech.browser
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Reads the content of the browser bookmarks.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4265

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tech.browser/app_ttmp/t.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tech.browser/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4339

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tech.browser/app_ttmp/oat/t.jar.cur.prof
Filesize
361B

MD5
1f00ac868da3c6c402c1e2f7a5f28d33

SHA1
4986fdaf39b009ef69a4239f6d08de48c8f7997c

SHA256
4ace29158538e419cd1361ae3bf70be8d6117c18f2a26be92f00fbc4335bb052

SHA512
2e08991127f4c85080c1f7efb877bc6d615344f70d4310698febe7db7902dceee4067be12ec64c125a21a1c9d77ee1298cedaae310678501848013edd6a02de5

Download Submit
/data/data/com.tech.browser/app_ttmp/t.jar
Filesize
172KB

MD5
39f7c5d4a7962708aa7d98bf2fadfc27

SHA1
cb348f750596b2e54705eb7d20b9fb2cc9d8807f

SHA256
e303dc3a3e31e4d525840e20486b6a99821e330b75c11e61c0f78d56f5dd9558

SHA512
55267b2721b056f9dab24c9f29df40db648cc3bd2eef0f4464da5545e6540f3f18cd8cdd9b7e7c77fe7a4fe37a08eb1bde482edbdd7eb364dd840f7f83740caa

Download Submit
/data/data/com.tech.browser/app_ttmp/t.jar
Filesize
172KB

MD5
cf9c7fb39d30b43019bfac428a3269ab

SHA1
912d7b2f83d9d0eae24d5b4cf1a5033cd2b8a283

SHA256
9031644073855d5bc7ad4ac8f211b472c7b52b8a5b743e85b40d1864f95a09af

SHA512
2450ac53f0f2ecec5d32ce0fb90ce4ed051d25319965d6758d90e0ede8cc813d445911e7511f140510d3ed19390a1effb9c1758861a95cecde8760abe127590f

Download Submit
/data/data/com.tech.browser/databases/com.tech.browserb-journal
Filesize
512B

MD5
634c8046fa73de60b8e315ccf431cd13

SHA1
801b1e1dadf94a1afa9cd8a6ca1fbe7e6cbdee0f

SHA256
788bab594ff71a6af26de02bbe2bb584f8f3dc297ecfd9d9beb354d26e34e038

SHA512
4d5c4e42e766d0c371fb603bc029d9804be06b3a9d20c62d33b0b166966db840fb571ef6e94e150225781a27da7c2ca1382492edf23aa6fd2f8fa5e8623eca41

Download Submit
/data/data/com.tech.browser/databases/com.tech.browserb-wal
Filesize
84KB

MD5
d2b899fa2b933d850e08baa7428bbefe

SHA1
e044a8f6a7c3d969984029be60f5e41ea9acf22a

SHA256
522330ed2b4245c03d676314c29a7c07e8ed28c950de9cd8b01657207afb02a5

SHA512
58c45cf89f6a28113cbe175bb71865627ae0e0ea9438a781d27e719a317d5c57d8a8b9f8612053e0b52ab87c7f28b64a590686736c377d9c6d8858b08b3615de

Download Submit
/data/data/com.tech.browser/databases/historyManager
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tech.browser/databases/historyManager-journal
Filesize
512B

MD5
1f258cca6e386f9663b940dc05e48609

SHA1
4c08e97abbc6324606dfa1cefb7f32363e05b265

SHA256
fe256a233559f1a39dd3df80aff862798a9c2fee778eeba26633a4268a380422

SHA512
4a2ec5fb7ea6ec3da1ca62138565388db244a7208ee8072c325a1c711d19faafc720ce26168f2cceef0a299690e4789552ea4fa426e26501813941893a1b3e2d

Download Submit
/data/data/com.tech.browser/databases/historyManager-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tech.browser/databases/historyManager-wal
Filesize
32KB

MD5
a52c8be2a6b56b351026b94ecaca5284

SHA1
7bd159cf673cce6be9e9af858a4fe472d12af0f3

SHA256
d15a832308b6d23bb96d8fc12b52d35b330715b4ec5f7b1354667ef25046b31b

SHA512
62a763821a4f5ba696bfda57fb138bcb2d8ac291ce178912119535c45d2c863354177935bb96fc856ac0d8c1c9b100dc203e73902402deb70b6dd7c8d970ed7c

Download Submit
/data/user/0/com.tech.browser/app_ttmp/t.jar
Filesize
363KB

MD5
4d50d49666dd4a7aab4ba4c4152abbd4

SHA1
b0ed22f4b8b27c2c20bf081eaf7f95a9dfd9cdfa

SHA256
67ee73418973fbe2d071df13f4e340c8951157a1594914b987605df034063963

SHA512
7979989b4a22c23d175052478c75c9884f51f85fde38dc440c42a76202e81bf51622fa9fd44a58748c0b562111cb54fd8e4fc0aac702b506a58ced2db2e680ff

Download Submit
/data/user/0/com.tech.browser/app_ttmp/t.jar
Filesize
363KB

MD5
71f79ba9526f0b6a04ff423212d75238

SHA1
ff505b3673f566a812ae925acc84157a1b6f34d7

SHA256
ab9672e93263e2459e8381f5216b8d8ce928c7bff5fd74cca8ae6f32977e557f

SHA512
b8df08dabb951a4881c0bb7cba6b80b76eeef9776fff51730daa8672f0afb6fa514b9c8bb8981b93db698698a83b77391e16aa612b55cf1150d6c18881aa2253

Download Submit