389a7d67e24a5515510c15c8c52d73a545dd15cce47fd0b9e02c2fa2a6fb9044

Analysis

max time kernel
179s
max time network
140s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
04-06-2024 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f8be17068fe3b45918f551a433f5f02.apk
Size

4.4MB
MD5

8f8be17068fe3b45918f551a433f5f02
SHA1

51c6d53a2e2ab96efe57403eeb32098fa00c9eb7
SHA256

389a7d67e24a5515510c15c8c52d73a545dd15cce47fd0b9e02c2fa2a6fb9044
SHA512

cb2343f4e350e20b4864edd5ae4bfcbc54ff433a3d71f1264943b6c46ccc828fa338a03fa201e5b50d54017fb822eed9010684fdfae0faf464af862e8717db54
SSDEEP

98304:zEOfaG+jG3umJeI355L9cmyFvAhBlbdMlvAA37+LlGgzO7p7AUXrAHjVrPw2F/:J35DuT7+Llk7pts

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.iq.khwaz.besh_dollar

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.iq.khwaz.besh_dollar

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.iq.khwaz.besh_dollar

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.iq.khwaz.besh_dollar

com.iq.khwaz.besh_dollar
1⤵
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
PID:4226

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.iq.khwaz.besh_dollar/files/fixedRoadsFile

Filesize
302B

MD5
b730446866770f1a4e5b94f79676cdb6

SHA1
7ec6b5c2c31a28149549d8c9de748c0e34543240

SHA256
80935bdc2ac300b98a6c7c463c14624a9009a44a3f143dfd1dfcd7077ede80d4

SHA512
58d855c398b714ec28468d22c0c040b7ee24cb580f81ced9a3eba6dbc8ab9100b766a043a1a9f1efa963da5bad6ffdd462ac271a785aecf7cdb27e0ba30774ed

Download Submit
/data/data/com.iq.khwaz.besh_dollar/files/gtex2

Filesize
10B

MD5
85755a22e22ce20732c88e6a6e5ec2b5

SHA1
b2b75d7f5e889de7bb5718b3a713559321aa0b40

SHA256
42678183fd2ec573cf35ee05941b9a37547997b7fcd0d8879dd152931d5ff6e9

SHA512
4cb5a2a91a1e6e0cb15ae4a7ee9dfa14d68568408fd5c8b95bef90d263e243bccb4f61a0ce69f30235c6a70354c1db87a4a8435b89468d20bb05b410749ac763

Download Submit