6992d6b808ac12fdb9c8d7cb20575471af492f9662b9eabb2d2c544ec65b4535

Analysis

max time kernel
169s
max time network
154s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
31/05/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6992d6b808ac12fdb9c8d7cb20575471af492f9662b9eabb2d2c544ec65b4535.apk
Size 4.7MB
Sample240531-3bsggaaa54
SHA256 6992d6b808ac12fdb9c8d7cb20575471af492f9662b9eabb2d2c544ec65b4535
MD5 1c3eb7f1c57d2a030dfeee0f19593b90
SHA1 0e57074d6494b5877b2982da973ea66360c83a6a
SHA512 400a462ba43a4f30e5e57bdaa0772924fcd6a8c5af399be55699913c4bcbd492cf543cf06923cd92412c1f83e0029a28d7f7c48c6813185000be31e50cb9ea48
SSDEEP 98304:tI9T0w94jm7KSpomjsdr5DSbup0qhat9tFhlurC8/dqeCmzPW8T1mmLS:iTG4xoAsp5ebuPkhhluOqJrY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wnpower.autogestion

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.wnpower.autogestion

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.wnpower.autogestion

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.wnpower.autogestion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wnpower.autogestion

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.wnpower.autogestion

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wnpower.autogestion

com.wnpower.autogestion
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:5168

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.wnpower.autogestion/databases/com.google.android.datatransport.events
Size 56KB
SHA256 23f3f617a63d786f930dd7be90f068c5e611009fcc7a6f739e776770984a6789
MD5 3333262853cf9de5edb17c25da2814f4
SHA1 fb7cb49dbc2fc66a5f3a299cad9fe4518027d437
SHA512 7706aa5270e199f29482395f399b6ff2261a5cd2d80d74e3b063a47bcce7b52bcef4977ad089cf1ca9a4d48b612b9e52cbb79d4dd2d49a030286be549f48067e
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSNq:8MEX0wIyNjaNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.wnpower.autogestion/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 9ea42c95bd68d4a0825a3a60c95c1dbf727be232389ea87e72d2a13f4665e98c
MD5 bc14086a31fe98c19c258740b12d96a5
SHA1 ee5382f17d1caaae7805412f8f803cb90eb02236
SHA512 328057e299868c68cecb039f1ceb6f8df6c350b0b67bc74814b6d45b61666778f22c5b8a7950ad23f0876056e47c21b756adb84d527e934eacfcde602d9694d0
SSDEEP 6:7+/l9c3SFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKPkt/EdF:7+tK4qLJdTRmBEyPbik1EdF
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.wnpower.autogestion/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 15d785170e7543e0128d9d6704d79121c1501d21b3e7cafd83ab97965018d348
MD5 9d522acbbc3ca1ff4c00ba2cf1c3c40d
SHA1 132bebfcd1d67d29d995b0f68b7e7cc8fb060665
SHA512 15171f8fc38cc7785d83b8e5dcdab526f7c9b2d8d97351b9f280fb335120712a93c0f6ec8510358904cfa2e98bffbe1291cf63a69a96ec8bcec4676cbd51e572
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.wnpower.autogestion/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 889a43ae147c65d1da187d16815bf860ec9aea7bc4fb3a9d795d6810b599de56
MD5 56815ff982a7592f9a624807fd90f731
SHA1 005333dfb8cf69d5147624570ecd1d75fc506b6a
SHA512 4984882f12ebc5078d82b05bf07ee6d5fcaa6d7bc450f2646dd05f896ba16100df59d2f1b4a59072a00b612a6f0d18a0631683d52744e0895375ae3cb98cdd5e
SSDEEP 6:7+/l92gn1+//vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKz:7+tYn/vqLiuWdwRmBEyPbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.wnpower.autogestion/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.wnpower.autogestion/databases/google_app_measurement_local.db
Size 16KB
SHA256 1b3f284666ce9048004feded59ad1336ca791aaa9e289bbe8942cfc0cf712b5a
MD5 1aca8d213e9f243536f124b073f60357
SHA1 f9201d9dd18bb816cc66783ac1663ba85104efb7
SHA512 59587fd50283ef95625f1b4551ceac2efef16ff4180165ba2b4a440b0b9a16fca495ed14cf9a9368d624155fe53123615cef1bda47034249963681c5e6b69bf2
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6ewu:TLiEy9zmzrfRmBEyPbP/P+/0Fl6nUj7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.wnpower.autogestion/databases/google_app_measurement_local.db
Size 16KB
SHA256 24d4fa1fe6ea6c9feb32fa61e5d54a99cab57c1674b2909f74db4ad1e46dd7f6
MD5 3f343c083a32ab58fd373932c4e9ad3d
SHA1 b49576b277f011f3c13be493af78af91871e3c3a
SHA512 5617e3421448b707a274bd89b5d2ff164d86c5adefe76243b905de7046b9ea8675c82f5e8542d85d94f94b83af32cf113400c7a875e373a454ff0de74895952a
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlpER1PV+/0Fl6nUj7:TLQpmzr0GSP/h1499FYT9lFmu
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.wnpower.autogestion/databases/google_app_measurement_local.db
Size 16KB
SHA256 8e6a90d8a7c5b648bb719681b8a4a0700f6eacc0bfb1b89f8f62355a602a4075
MD5 b1a4e78d4c0ea4d3c686df6b43b35272
SHA1 3b0d61aa61f2d4aeb4f4bde2bf396cf01d4055f6
SHA512 3730389c2ba4d0d82df807a95b9a4862b4baf51b686b8d516e56e107172d2a767a2f05cb3665d48dfcb4123220b948fc37f5462a2441dd7105d9aeee86539659
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/hOLa/+AUX9MWluIF49blqYFlpER1PV+/0Fl6nUj7:TLEvpmzr0GSP/hKaGhHx499FYT9lFmu
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.wnpower.autogestion/databases/google_app_measurement_local.db
Size 16KB
SHA256 d36bee4e8914ce0e00c5434e68e79c4e5dab815e1ea6ca64c7ba8bd1f3636c9e
MD5 c448f798f1593a3ee3913433612e6303
SHA1 60346cfaebf356b2b8c75b049cfb970ae7a3dd84
SHA512 ebfe96caf7042852fc7b9c89a04be81a62aaf48ebccfb10b68c479d272459eb76a3bd7d404b5b6693cdd3c89d391fe32b02b21d318f76e767884a90b7e49d20f
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/qOLa/+AUX9MWluIF49blqYFlpER1PV+/0Fl6nUjv:TL6Xpmzr0GSP/qKaGhHx499FYT9lFmq
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.wnpower.autogestion/databases/google_app_measurement_local.db
Size 16KB
SHA256 5882f223f8efd66ee0fb9894da64a5ad97e5b2335754d84282fbb3800b0036bb
MD5 47e3758681010979dc9bfde03b5fe94b
SHA1 03589ced46a6833a3d0b35d5b4918d57512c3676
SHA512 6832b47bbe6a041bf1b15aa110fdbe1d4c71c5f21ced59bc21b62f8d811f7f932add471dfe7525b7e748874d1b8b9e80851c0bdd1e83cebaeb4c60d69c89949f
SSDEEP 6:l9bNFlgls1qlvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WW:TLuEev9zmzrfRmBEyPbP/WW
MD5 SHA1 SHA512 SSDEEP

Submit Download