Analysis

  • max time kernel
    5s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    30-05-2024 22:41

General

  • Target

    86fd0b4a0731cbbe38241ba277f98a4c7c3f88a2585c4ab88dba80fdf9418b99.apk

  • Size

    3.4MB

  • MD5

    1577e6c6c1f38c25d6e1b2ee6fcde30c

  • SHA1

    2716d45d033cc761079e17bdaf95bd03dedd9857

  • SHA256

    86fd0b4a0731cbbe38241ba277f98a4c7c3f88a2585c4ab88dba80fdf9418b99

  • SHA512

    e70e51f0103dadaf3380fd139cd1d7ee0f59c9c3263bb169388e7b17ce259609817bbeb6465082bff1296d5e6713bd8a8a042eed5d035d6b7d72ff582ef964be

  • SSDEEP

    49152:NLZ/VatSV2Bo+4tdc/ThZMH4ToTwr5jE0rljwvsrhEZGDQ69kw9kK1iD:PVmSwX4qToTwr5jTlU84GDHX9k4iD

Malware Config

Signatures

Processes

  • com.drnull.v5
    1⤵
    • Checks memory information
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4280

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    c0a7cdcd9a2222a096280f40b85f1110

    SHA1

    c2a98c70e5a2b3f136e19a164aec5047b722dfac

    SHA256

    cfa662eebcf2f11f427631dad67ea81c1ebc5f24c2f5802a3b9f9c555911e1de

    SHA512

    314088eefbbe43f42921a65d586ce951786f1f08b0fbcca91e7f615b9bdffd43372a93d0bb72061f100e9eb8657e92204320a9e25d547097dcbe67d79247bc1d

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-shm

    Filesize

    28KB

    MD5

    cf845a781c107ec1346e849c9dd1b7e8

    SHA1

    b44ccc7f7d519352422e59ee8b0bdbac881768a7

    SHA256

    18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

    SHA512

    4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

  • /data/data/com.drnull.v5/databases/com.google.android.datatransport.events-wal

    Filesize

    68KB

    MD5

    47dedbf0b3aa802c958d75d39dab8ee3

    SHA1

    9e929bfd8468f5f55bc0fbf2d49bdd844892c79a

    SHA256

    5e23c8d8b24a873ea18062a73242e69cb8445a8248b47245f025f76842560c14

    SHA512

    5ba740f789ad429d5bb853dad4cf89e7ea6f62d5499d68a77195cb6cdd2b6562b2013700386b2f058de7a12c715eb2a9d47f659ecf609ca91ef0f2c32674214e

  • /data/data/com.drnull.v5/files/PersistedInstallation4237883834700861723tmp

    Filesize

    566B

    MD5

    01ff130e90291447cdad1e26cca9a493

    SHA1

    a2cc18708601fca23954d1612e2769f2ca9ca13f

    SHA256

    4c02971e7dc92da92c0240555ba36ff02909733191f9a82ff6714f09a6283a32

    SHA512

    233d434ee3a1b15d325b6f968d608bb6614d01904596653d5234eb687aaa18f7ac63df3e35f615916c9295dbce4d85965fcee412b73fc2712efd3af75510b329

  • /data/data/com.drnull.v5/files/PersistedInstallation9147971146995082509tmp

    Filesize

    90B

    MD5

    7076ebdc48a4b40ad026e7687bf9a3be

    SHA1

    c116d4b4e51ed95ed86e2060b1aec598cdeab6d2

    SHA256

    d0b94f3684cc73bd2c0684ca4f7a92a812fad7378b292cce1e084522a0217b12

    SHA512

    6a090bfe75fa9d065c45a71d302303fdc737990a10469bbd2ec5897b3ea23176f976968aa97a8adbfa3824dc00e850b98066fd1bbb1b982bd243e94611faf8c6

  • /data/data/com.drnull.v5/files/database.db

    Filesize

    102B

    MD5

    7d921420d6e77c32f5e1973782b412e9

    SHA1

    1eb13a7e8315e4d6a530dfabf5f66dc8e4844bed

    SHA256

    ce6aa7bce6bd7cb926aa99bb663c82ad6393b2cd73f6d66ca7be128905d30db1

    SHA512

    e3f421a4e4a88a1703b993ad01cc741b4e2c78701cf89a21a23c0e1b925be5e057a45590a3f6a78413e5941804aab98b1ead254e38697b254714827db4b5bf29