d08680ea29f518eedb5b30a396de3f4b0e94295287be23c855b02456506ec39c | Triage™

Analysis

max time kernel
67s
max time network
180s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
31/05/2024, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2FH6TY0DcnPFA3RNDK3I7xS1chuzf3c0qXo8.apk
Size 91KB
Sample240531-cfdwrscc63
SHA256 d08680ea29f518eedb5b30a396de3f4b0e94295287be23c855b02456506ec39c
MD5 dffa9cf6a582b40430240d5e127b30d1
SHA1 e9738212b68c5f646137ee7ea3e2d5a2cbd2d32e
SHA512 cdb855c5882724bfbb5fab6069611252996b6dfa1b1a2d035beb65b14abeba00fc02f7f797852a993bbe42d8f47b43a023ad72c6b16d0e13f7d57cec9d6da6bf
SSDEEP 1536:pHjNDUn5KRilTNXD8xNm66MmHiHiBisisvspspsMVMZ877I5jNY8+cdJ7P3HFaQa:l9Un5KslxormG843TJ7/HoyJwk5r6R
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

System Information Discovery

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tyodcn.xovrhjs

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

System Information Discovery

description	ioc	Process
File opened for read	/proc/meminfo	com.tyodcn.xovrhjs

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

Transmitted Data Manipulation

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.tyodcn.xovrhjs

com.tyodcn.xovrhjs
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
PID:4551

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Discovery

System Information Discovery

Lateral Movement

Collection

Clipboard Data

Command and Control

Exfiltration

Impact

Data Manipulation

Transmitted Data Manipulation

Replay Monitor

Loading Replay Monitor...

Downloads