de40a7bebe5b903abc30d2b028899afccaae9d6f1dc5c5e82424f16b30877c6e

Analysis

max time kernel
126s
max time network
171s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
04/06/2024, 09:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e-digital-kyc.apk
Size 6.3MB
Sample240604-lhdhfscb41
SHA256 de40a7bebe5b903abc30d2b028899afccaae9d6f1dc5c5e82424f16b30877c6e
MD5 f17266aa3517cb2353c477a83a48715e
SHA1 1a85bb4861ba9d99aa9465082496f7c092c7ae84
SHA512 63456f8374ff711b65943cf27b1fb2b8d4fb007b73f35f5f4639c5e126cd7a87a97d1cf2b272c6b993f2415c2a446fa54eead2c97bbb4cfcdaec66defb220437
SSDEEP 98304:CgUfkcgSvyVSBcqX5d2ZrBD+k9Zm4yAJ53oN6xPNDhRT07JjrIwcr0/j6nA2tzP0:SfkKveSBcP+8gc4ItND7sjrIwcrY6npW
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4948	com.edigitalkyc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.edigitalkyc

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.edigitalkyc

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.edigitalkyc

com.edigitalkyc
1⤵
- Removes its main activity from the application launcher
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4948

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.edigitalkyc/databases/com.google.android.datatransport.events
Size 56KB
SHA256 ef30a022a17f8266d1c59086399295f1fd86457aeb9e0fec094f1b27e84e64d3
MD5 cae0c8c4b4f9d4dcc4d80231d65b54fe
SHA1 6a95c64d6445ef88bb79fbccfee27b2cb857e892
SHA512 1f9bfd945e8066f7e2969284248d8928e503e96d184d4b6976dfca92d774b0a3ec8735ebe2b44449f5ebaded12e83602888286717b93a490416b59efde5e60a2
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSk:8MEX0wIyNjak
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.edigitalkyc/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 80f8f14e4c7d6219df6b68834e2340a42025f000bca5e5474c09a34845d8509c
MD5 41a73da31383b0195bddaaae004317d8
SHA1 2c5f7e0ac1724bc011948b2cd94da948a2eaf614
SHA512 6b92cee14044fe540394fa1f57816a31322a70e3a1d7a4ab7472258c641ae899055f4ab6bba67de00a9b51dd576382d009e080ea4ef2f89d3a0079e6e4d17d45
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.edigitalkyc/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 559e8229d2409e2c89c2dcd637179b72adbc03a04f4487248437bc2a8cec3fde
MD5 a7e1321008528ff82cdc9c8d5b7dbcc8
SHA1 7d0fc18d30484334b3ab7ff1432f955125c0b3e7
SHA512 303a81dfa408ffeb592e3c0bcf218e71581295e30074a4646fd33d76883f50679517620a55632a6df5dbf3487999671f73199626113c1f3b8ecf22b02bac5258
SSDEEP 6:7+/l9lEhn1Tg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK+b:7+tQqLiuWdwRmBEyPbPb
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.edigitalkyc/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 47ba04b2edab1885fbd2df59739e44c9802d63809609d039713ccd57ae40bf3d
MD5 b930fe2a288274a9df8c0d42f68e1795
SHA1 35f1e112a81684ddd9ca82f961336725fb08ca79
SHA512 d348f3549067df8a965fb8cfd122daee772d6fb631cc58c137a5c798bbcd60cbb51307b1e15e851d9fe564a556cd1ea3ceb895dc98e5a5363578edf787394ab3
SSDEEP 6:7+/l9Bj/gPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKiM/Jx:7+t3b4qLJdTRmBEyPbTs/
MD5 SHA1 SHA512 SSDEEP

Submit Download