a09c904195d3922b8cbed16d90776ec0a7dce22210fd4ed0e71f52efa8c75080

Analysis

max time kernel
78s
max time network
320s
platform
android_x64
resource
android-33-x64-arm64-20240603-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240603-enlocale:en-usos:android-13-x64system
submitted
04/06/2024, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
diamond.apk
Size 22.9MB
Sample240604-fxp7xaec7w
SHA256 a09c904195d3922b8cbed16d90776ec0a7dce22210fd4ed0e71f52efa8c75080
MD5 c5bb54114972cd525d2649068a8af1f0
SHA1 ca5e488336d20acc67dc667594b26c25702066f3
SHA512 8270851e9d2badd7a4ae5c6a4db790f417a17a4b0e4735b20c152339ceebd5fe5dd25d04943a4377efc6df8ffa83ab9b278dcdd8c530f3c9d999b6d7e88e9bb0
SSDEEP 393216:36kGeY7TgMzEkNC8ta8enuugcSOAuWGT/E81beURKNQt96g2net2wN2oo6p/cydk:x4Ufv8PusOXWGT/E8rF3N5oY/co1Fo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	in.liiv.app

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	in.liiv.app

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4251	in.liiv.app
/system_ext/framework/androidx.window.extensions.jar	4251	in.liiv.app
/system_ext/framework/androidx.window.sidecar.jar	4251	in.liiv.app
/system_ext/framework/androidx.window.sidecar.jar	4251	in.liiv.app

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	in.liiv.app

in.liiv.app
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
PID:4251

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

16db3dbc6e0931d5b29149581808cb6401ad41a9.temp

Path /data/data/in.liiv.app/code_cache/flutter_engine/45f6e009110df4f34ec2cf99f63cf73b71b7a420/skia/0d31aa1f49cb8cfd790c44d92a9a023839524865/16db3dbc6e0931d5b29149581808cb6401ad41a9.temp
Size 1KB
SHA256 c45f6f3207784ced1f3e448b16f8984d9c0f4737b4c0047bedaa0f67221cb93a
MD5 704f742c3e6db5127ec323b68e95ea55
SHA1 1e042de526ee5fa18efb6d79924931da2b76f9a4
SHA512 c5d6655338a1b01db9193f6f285d314759ad88a1e8de21a2d15da11e1bfb06101327bdf730bbc3592b5a3eaf6a5265d230578d25de31f28ee0b38ca778a3b79e
MD5 SHA1 SHA512

Submit Download

4039e3a9c5ecfc4cbfdc0a786d5d84cda12e7206.temp

Path /data/data/in.liiv.app/code_cache/flutter_engine/45f6e009110df4f34ec2cf99f63cf73b71b7a420/skia/0d31aa1f49cb8cfd790c44d92a9a023839524865/4039e3a9c5ecfc4cbfdc0a786d5d84cda12e7206.temp
Size 1KB
SHA256 bd5e1db8c304a5393356f2f6f4d20de0aec3ab6b3b677a159081bf3c5610e3b4
MD5 301f2dda8f1a3ac8feb8f552d1e501bf
SHA1 fa3dfff5835c9678198aee06b0e531afc89792cf
SHA512 3221b303f96f3fcc342f8b6b46c4f538bcffdee5d8b1ce220ce1dd8e9e4ead2601efa4f35f88d6b5ee80ffa3a5a7724977b8b58dbd2d45709684c698d6a50c9a
MD5 SHA1 SHA512

Submit Download

705add3ecd0197f2b88943a82db10f640105cfb2.temp

Path /data/data/in.liiv.app/code_cache/flutter_engine/45f6e009110df4f34ec2cf99f63cf73b71b7a420/skia/0d31aa1f49cb8cfd790c44d92a9a023839524865/705add3ecd0197f2b88943a82db10f640105cfb2.temp
Size 956B
SHA256 e6bcbeb142dce6713a3cfdf1360098589e58d65eab6a17ab7567be7d57d8ff42
MD5 8db2543a353af510cbd8dfbd3275bbd5
SHA1 154a10cc23be473c5e725ae8c22945f9431a9561
SHA512 ab3210b37ab2d365320c62794b796570ea9776e05506d15e99476f51c50ddc517956455ad3fbc6a71dbd0bec6faac12bba090d376dda073736468301814c3740
MD5 SHA1 SHA512

Submit Download

87144fe56e578d5f4af2b3007a0319c145f30d7e.temp

Path /data/data/in.liiv.app/code_cache/flutter_engine/45f6e009110df4f34ec2cf99f63cf73b71b7a420/skia/0d31aa1f49cb8cfd790c44d92a9a023839524865/87144fe56e578d5f4af2b3007a0319c145f30d7e.temp
Size 1KB
SHA256 7252953517f3968ee1673e28531a5ac1cf6ab73751b2f1afa3658f737ebb5fd6
MD5 3f08930a428b4145f6aa02c823ef6148
SHA1 aedc4eec25f1a99409a91e69bc9b2678037db385
SHA512 5c79afc7270589b20abcd7639f8ddaa61e39bb8d0a2051a3074f91610bc78954dd233c953beeab961d714791b5e1de8635000322159dfd27f35b4fb6095de410
MD5 SHA1 SHA512

Submit Download

9914cdac01b83908cf184d3f2637a496bd19fe37.temp

Path /data/data/in.liiv.app/code_cache/flutter_engine/45f6e009110df4f34ec2cf99f63cf73b71b7a420/skia/0d31aa1f49cb8cfd790c44d92a9a023839524865/9914cdac01b83908cf184d3f2637a496bd19fe37.temp
Size 1KB
SHA256 c83fa53add863a676e29ad96586c4513301aab6fa6c9b3e9404b26d5620a6d9e
MD5 c8c41b21e91f5323176efcc45692e644
SHA1 e1185e9d6e8daa8f8af01399518c9f21726eaf9a
SHA512 3317b74c41d8afa29f5bac61a231fa57428b60e2c045d10c55eb943f384e0b183a7ba6c3fc4220f68bedfdd3f88b7edd89abaebc7ea22c554b425028e79f3da4
MD5 SHA1 SHA512

Submit Download

a34b99d0fea7226c46aef76bd20757e826c064d0.temp

Path /data/data/in.liiv.app/code_cache/flutter_engine/45f6e009110df4f34ec2cf99f63cf73b71b7a420/skia/0d31aa1f49cb8cfd790c44d92a9a023839524865/a34b99d0fea7226c46aef76bd20757e826c064d0.temp
Size 1KB
SHA256 7fd892167ae5c43595b9274cc31220a5e73656cb2ebf87a841451e82d39b64a0
MD5 4fc9fd81321a9c8a838ee50bde332cd4
SHA1 2197118613ef9286680ef5c40719c215177cf05d
SHA512 9bc29933c04a169e4a3327ee71ec42e7304cc9cdbe24f8acd2e08a54879bbcc191612bfb2c4131b360035a40aa6764eda88e7a502bdf89c871333f51e1cf6b9f
MD5 SHA1 SHA512

Submit Download

cf53764ca64cae32e63d1c793957ba36874b96f6.temp

Path /data/data/in.liiv.app/code_cache/flutter_engine/45f6e009110df4f34ec2cf99f63cf73b71b7a420/skia/0d31aa1f49cb8cfd790c44d92a9a023839524865/cf53764ca64cae32e63d1c793957ba36874b96f6.temp
Size 1KB
SHA256 4163431766a083a998c0004d6f38afded1a399596fb19ceb06f1603e0bd19d72
MD5 a539f573478ba0c556f98b6808658135
SHA1 554649e849f0d3330a92091dd6975d43fcd8af9c
SHA512 a374f24938e8781f384de6e86f2d7754e7b24c48a5c8e928f9d75143f59e72a02a3bb991c934128db662ca5a0ea0f8d2184ba32c17ff9879c219ac10942ee8f5
MD5 SHA1 SHA512

Submit Download

d9c844a26c04df204181621fb0f1ece21125aa63.temp

Path /data/data/in.liiv.app/code_cache/flutter_engine/45f6e009110df4f34ec2cf99f63cf73b71b7a420/skia/0d31aa1f49cb8cfd790c44d92a9a023839524865/d9c844a26c04df204181621fb0f1ece21125aa63.temp
Size 1KB
SHA256 758b5437419805c12979372beb770116beaf70597dfc9d2757e831d7f24b1d40
MD5 4050eb1c949d9fd95f1312168ff8a753
SHA1 3dd48423dda1fba8ebd99606770721e5f708c946
SHA512 06b9cfe7ed6a13baf83b5ee9f73d7f0451afe04eddeefced8764bc932e5e817fcae604eb8118da8b2e32509222b7366bb5b58b46db8313f759a9e0d84515ca1c
MD5 SHA1 SHA512

Submit Download

profileInstalled

Path /data/data/in.liiv.app/files/profileInstalled
Size 24B
SHA256 717a477a036f486784a79ee81cc6abb9761fe6cbe1500983b46b5d4b6a2eb88f
MD5 305405806a812189411826d1e50246d6
SHA1 f86386e9448f9ef158f336e079f0c7043c8b575c
SHA512 d1f3f90d29d59b567f66d2c2635cb29d8f44801579199faf727fce646d7840a5f181d92e80882cd575e9e03ee175c9d6e4345fa7eae88ac017e8eedc2c38a3fa
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/in.liiv.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 19f7704ae463ea0bfa1add0fe7ca4359e4b220b57d7584cecf458ac79d54211d
MD5 9de44589df4867c0083f7e94a5de4ab6
SHA1 0193806a5febd06b092aa4702710690148419ae9
SHA512 ec1d04be0f5f387ba9d04b1f790150a96f49680463b32f85c4e9fe182068b1ebb5331b6a4ea2e4c2966609a165d11d254a299f60cbb098188ac24ac5abbbfab8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/in.liiv.app/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/in.liiv.app/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 fc2f97306d4984f5e7536d3fc2102e317f4fc9e32b9a1e50c5bd74e43d2d18e1
MD5 e0b6f26d0a07bc32104b47ac6f414df8
SHA1 fefea3a38b691b8a26ece289a6f6556f1fe1bfce
SHA512 817cffec9c506788de4381192e898b96d6bd045764af70474b6ba6ea5b7dc8a1e6aa0981aad692c12147c8a3d46b9cd4df1333c446db21c58390d5102e9d1d3e
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/in.liiv.app/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/in.liiv.app/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 146d05b9cecb5f70e72a44f6f5e6a0d172869e7919c60b40fc239844d20f5fdd
MD5 e766fb8f04cc67b061d91605245c44d6
SHA1 ed94dadd96a4f8d9857d057b88e67a31a7e06ef0
SHA512 b27c53cb8c37967397edb976a3ca8edeffc3c13b16890459e8fa1e8b7bc3f273a4d8f9b822f1130214ac164398ac3f40c477c9c4bdabbe522b7eee47520a1957
SSDEEP 6:K4U1mgU8H9FZdKEAlOERX4PBX4ogLugMBX4suuK+/+UfDt2gwDMq4t12qzT9iOw2:KZ1mRqzdKBRmBEyPbP/rJJtzHQOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/in.liiv.app/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 c95c6b485f80a713dd64d6600d5959cab80d03e484abd9e41fcb7b9dcef9209d
MD5 cf22dce5d3a4f4455dc2e082fc64bfde
SHA1 cacb5c06cd173e8a5ebe6e7eaadd8d530452522a
SHA512 60c000a464f1916e8bc5f771db4b91183c4eb0cd98223e3248aaf606b302be420cbc3dc27de0b8be1184260acceb0748eb8e8a949e87c0b9e646fd26f02c198c
SSDEEP 96:fRKGWODP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:fRKGjndjnHt9S/f8JzSV+6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/in.liiv.app/primary.prof
Size 1KB
SHA256 7a36c41817334d65aad34e87e68ff6080a7f704915b5812c850c1f734c53cf1c
MD5 e1259459f0968e4c067588f18d84b0c3
SHA1 7f7c07998cdba820a5019346924c66baed351bc9
SHA512 f1a255b93c61d11e679a91b290f30e88d95ed48b414418a78de6c2beff288429af4dde81c2675db6b3e72d0e905a26b87a30da7e6f346b1213164842e190018a
MD5 SHA1 SHA512

Submit Download

androidx.window.extensions.jar

Path /system_ext/framework/androidx.window.extensions.jar
Size 123KB
SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
MD5 3056e1bdb7d4e19789d0319eff484bd0
SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
MD5 SHA1 SHA512 SSDEEP

Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 25KB
SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
MD5 29469324e59dfcc052f24b5af4e7b2c4
SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads