389a7d67e24a5515510c15c8c52d73a545dd15cce47fd0b9e02c2fa2a6fb9044

Analysis

max time kernel
179s
max time network
159s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
04-06-2024 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f8be17068fe3b45918f551a433f5f02.apk
Size

4.4MB
MD5

8f8be17068fe3b45918f551a433f5f02
SHA1

51c6d53a2e2ab96efe57403eeb32098fa00c9eb7
SHA256

389a7d67e24a5515510c15c8c52d73a545dd15cce47fd0b9e02c2fa2a6fb9044
SHA512

cb2343f4e350e20b4864edd5ae4bfcbc54ff433a3d71f1264943b6c46ccc828fa338a03fa201e5b50d54017fb822eed9010684fdfae0faf464af862e8717db54
SSDEEP

98304:zEOfaG+jG3umJeI355L9cmyFvAhBlbdMlvAA37+LlGgzO7p7AUXrAHjVrPw2F/:J35DuT7+Llk7pts

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.iq.khwaz.besh_dollar

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.iq.khwaz.besh_dollar

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.iq.khwaz.besh_dollar

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.iq.khwaz.besh_dollar

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.iq.khwaz.besh_dollar

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.iq.khwaz.besh_dollar
1⤵
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
PID:5015

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.iq.khwaz.besh_dollar/files/fixedRoadsFile

Filesize
302B

MD5
b730446866770f1a4e5b94f79676cdb6

SHA1
7ec6b5c2c31a28149549d8c9de748c0e34543240

SHA256
80935bdc2ac300b98a6c7c463c14624a9009a44a3f143dfd1dfcd7077ede80d4

SHA512
58d855c398b714ec28468d22c0c040b7ee24cb580f81ced9a3eba6dbc8ab9100b766a043a1a9f1efa963da5bad6ffdd462ac271a785aecf7cdb27e0ba30774ed

Download Submit
/data/data/com.iq.khwaz.besh_dollar/files/gtex2

Filesize
10B

MD5
d48378ccea72aeeddb7157b18d127ac9

SHA1
bb40d76d470a25c39a885b622ebf3abafa7236e5

SHA256
79ad6e6340f9f330341fbff6378233c32a06b4cc2e6efb544aced74aace80233

SHA512
264faf868211c9a0f55f4ad5811ed2a0935a6544445bcbb4bb32e6689907c88e48f44d10ddd613da026197ec01fdb4a71d58322d74e8c99b0b29097d5b586a3c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads