0bcbefd0236fc1d9a531add77f22e034ecffd9e8bf401ec7497db572b48722f1

Analysis

max time kernel
177s
max time network
185s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
30/05/2024, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

indusIndBank.apk
Size

1.5MB
MD5

7114e0481b9a454e3d61132ce3808b3a
SHA1

0e5c5adb6b67b3562ea7a17c3423515fad88fb56
SHA256

0bcbefd0236fc1d9a531add77f22e034ecffd9e8bf401ec7497db572b48722f1
SHA512

867d99be181e17de53842b47e8aab075a68eb6b5f819400fcaa8e1f0eaade67f2142e5edccde00b981a99b68e468704ea4d4f6047ad1dbf10c8d35b8842c4814
SSDEEP

24576:SxiQE6R8OhcDE8rutWkC5Uh3L/UVdl4EB1blw0e7v4y71YUvHV:SAM8OhcDUtlfh3LcVdzbyx7r/V

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.example.sms

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.example.sms

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.example.sms

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.example.sms

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.example.sms

Checks the presence of a debugger
evasion

com.example.sms
1⤵
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4234

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.sms/files/profileInstalled

Filesize
24B

MD5
32c0cbeb2cd91449127c18924576aa01

SHA1
a9fd3f3fd9b36ca3c3a0989231b6a706cb6071b9

SHA256
1e7d63c346400c62e426fbcbc998b963d21bab2d8db7dd99c52aa102fa7a3b3e

SHA512
0c6007178c6b2cb83e1feaed72eb7c8454a4b497f013083a294a91b62908c737f820d08a85c2c5a373f539cb40679cb868167c2e41277b38e606c05ec19e0808

Download Submit
/data/data/com.example.sms/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
d3ce1e27c76c9a7cfd58b8d40561aaca

SHA1
147e159b2f32dcf9086a15bd1e834e0b4e4cd90c

SHA256
56e13ca41b3f63dcca247d608b811ed4d584709e09fa6821dfd99ed24bbafc2b

SHA512
557c19354dc9bc5eef8f17584716f562ac75b3b4610fd8cc755feec8245a87ad8606dadba2db80fe56be7c22febe247e1bdc0e15fb9bc3a63506630f1ed7f635

Download Submit
/data/misc/profiles/cur/0/com.example.sms/primary.prof

Filesize
1KB

MD5
b53461c78f1281447ffee33f343a7947

SHA1
e0afe5ff27e0e96c8181ad8d7b9fb87be28d3849

SHA256
14390e9160ae956d99390444a1fbfbe8331e65614e6a7615a4067b9aee140810

SHA512
2153f5234d68c08bd5fbff4484125ba00a92e6f99dcabf6b3b5c40c89be9d3154ccbd0499b8b369f9425ca5064e3a79e20d8adbcb7e33cfec3c8a8a14db42aaa

Download Submit
/data/misc/profiles/cur/0/com.example.sms/primary.prof

Filesize
4KB

MD5
0c7d95ff0e98358a496d3f6328fe521e

SHA1
2df179ff1182a0e57e9a5ca69c61272b22606e3a

SHA256
a0c74ae3b58270f0c9152eae0c7498db960a154ef404cb58f95d058c489deec5

SHA512
ae4a80a328da07730aa9d99d467f227c08d4b53713f4d039500ba3a6b89a4e7035bfa3b27b8a23dc5a8e6a6cf6c7048e714aa00bf50e265a98a355f93893f9de

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads