cfef439e4d4fd657e81e204c606044c8a787e8f2115feea7a3a7e4223e4d29f0

General

Target
cfef439e4d4fd657e81e204c606044c8a787e8f2115feea7a3a7e4223e4d29f0.apk
Size 3.9MB
Sample240602-2l4rtahf81
SHA256 cfef439e4d4fd657e81e204c606044c8a787e8f2115feea7a3a7e4223e4d29f0
MD5 599c36f4477eb782845308cbbbd2cd7f
SHA1 12c5decb1c10e65583e68d443f4098ec17880606
SHA512 7538e40679e199be49a69c4d8cb5af462f8241b4123237f5257c14905859a1c6d818daf363ae8cdbf1b9177c5565a4e99296ab821a4c5a0dbe57330fda872530
SSDEEP 98304:74pgPY2Y9pYQdx0FpMYsWW0wtkhst7Esr3+1:Mexgn0wOn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	grocia_shop.in

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	grocia_shop.in

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	grocia_shop.in

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	grocia_shop.in

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	grocia_shop.in

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	grocia_shop.in

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	grocia_shop.in

grocia_shop.in
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:5198

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/grocia_shop.in/databases/com.google.android.datatransport.events
Size 56KB
SHA256 58917864b6c848286bf661f990207557d29082508417c5e88b8347b59c0cbc5e
MD5 3f3a833f00529c62af7f19c4b9c1e50b
SHA1 fbe6d813f2f22907af801fd36670eb5902562632
SHA512 2d0e2e1d91bb3cb728474178654566aba0b9719c8be5b5a1d2f58f1346734e34c72013946f5a8b8b592262c1ad2ac54ad38b002e6a509873098342d0075aa798
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPS0:8MEX0wIyNja0
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/grocia_shop.in/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 93e029fc5446e1735f5e928a212d8d19a57a44687e1e4631e66b4c099f9337d7
MD5 c80bbdaa24d3a6927c30b084a029bd45
SHA1 597959e58df0df02433dd5ed11bf0d3daeaf87f7
SHA512 90c547238cf2856691d56882539a1044c2b4a3494d5389a7e640ee434c6a6ca567a2630c0f54f7f4897704ab916efd84e1b220f8f0d13eb76154298a24491918
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/grocia_shop.in/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 cac6b541cc5c98b65f31d7f35b7fcb2d355d738f42c262e7854d9d035f1f220e
MD5 9f5c0d0ceea36f2dbc5f5a1869dca9a7
SHA1 2dd88274c0d8e038f294547201ad72852ec10295
SHA512 25ab96ad1b3fc4cb9727bc5f0230e3ecda2e9dfccbabdc2ec0acbceac6cd2ef9a5a4bbf32117a36d9f1e48ef97c149a97f7e56600a4d812bd547fd7042f75bf9
SSDEEP 6:7+/l9Un1zg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKSBn:7+tgqLiuWdwRmBEyPbxB
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/grocia_shop.in/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 ddc9229b66461d858489927e6725c17c783a8cf0224e584f6d84fb84bcd1df3d
MD5 34e98a85e851fa37082d573142950ede
SHA1 be0548f99e0ec4af3daa2a4deb07873f8b08b6c7
SHA512 c6d272d74cd62b9d32b82f20659c6424ab17c04b0c5420fd6ca7293f8f266291a0d51ba7302f1857fa2682ec873788ff116bbc9df9784046eb88dcfff58ba856
SSDEEP 6:7+/l9CElqFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKTl//Vn:7+tYFBqLJdTRmBEyPbOXV
MD5 SHA1 SHA512 SSDEEP

Submit Download

PersistedInstallation424871366881987393tmp

Path /data/data/grocia_shop.in/files/PersistedInstallation424871366881987393tmp
Size 90B
SHA256 4adfbd579c77c812f1358f342f71f1dd45f8dec1410abd940c543ac1aa11a0a0
MD5 e7d73a5c40009ef5887d512507d19406
SHA1 c7326fa01b18a2f524cfc2df0a078a1ab1aadec3
SHA512 4e701a5856d48e1e04f74edd88fd7f75bb4ae351ff88c29ae0fc999950ddbbd3a029ed91dc5c6ea17336cd42bf9dc2bd891dff98f6977172f9d9b0b8ed34f022
MD5 SHA1 SHA512

Submit Download

PersistedInstallation7804771859944191718tmp

Path /data/data/grocia_shop.in/files/PersistedInstallation7804771859944191718tmp
Size 567B
SHA256 8c412cf42be8ad3c3f5db8087886d77a7f0284c4eb173c8eb51741ca6e2d76f7
MD5 cff34627dcb3f674dd8602ddb608dc1e
SHA1 e222bfa1155a85e68d50ffa05181d2d73991bc5a
SHA512 7293278852ba5c481cf60952ca9db46e775d51a0de28488803067f0b0503bea039c3514e5d2581974ff7b38657a90f3febf29bd15b85256b05d5e8841b54fee2
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads