1cfbce677f2b28f0135e9270a676fa30d930872b3a974be7481d566e6f2e52b2

Analysis

max time kernel
107s
max time network
131s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
04/06/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stanbic IBTC Events-v11.0.6-appsonwindows.com.apk
Size 14.1MB
Sample240604-pn4tdage39
SHA256 1cfbce677f2b28f0135e9270a676fa30d930872b3a974be7481d566e6f2e52b2
MD5 92c1cddef1187865a04b2b500d35f0c6
SHA1 91dea787574cdd06d05a82a65fc7d28b953a3fe1
SHA512 b4a45e472958ec88398e7c12ce0e3e0c39dad59730b135f1f005b301252470dad481ebbecd123c62afa0b526f9eb2fa47aa83f9e628cc02e7de4be253aa22adc
SSDEEP 393216:YJG3Z68hFGSCfgvQ8G4uR7LOY/Dsl3klwT9tWL4B:/3Z68hu4vQt6QwTX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.reinsys.apps.conferencing.stanbic

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.reinsys.apps.conferencing.stanbic

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.reinsys.apps.conferencing.stanbic

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.reinsys.apps.conferencing.stanbic

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.reinsys.apps.conferencing.stanbic

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.reinsys.apps.conferencing.stanbic

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.reinsys.apps.conferencing.stanbic

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.reinsys.apps.conferencing.stanbic

Checks the presence of a debugger
evasion

com.reinsys.apps.conferencing.stanbic
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
PID:5125

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/data/com.reinsys.apps.conferencing.stanbic/databases/OneSignal.db
Size 52KB
SHA256 f8ebc23104952761ccaf8dcf7ea9e5341bb0f3da744550a518f8dbc8b3404904
MD5 5715efdd2d828d4d57c1376120ba2806
SHA1 06f279c976087695aaaf885df323d996a2560cc1
SHA512 dbc9dcea4f947dc61663054585dcc175b79ce7d69aaa8335754d1fe6d02881dadd75d3846190178e677e80efd63a1e364a31d51620d51e8e6254b8864651bb30
SSDEEP 24:TLLSrCrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+HR:T6CrQcrA0oJtqracrObMoOS
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneSignal.db-journal

Path /data/data/com.reinsys.apps.conferencing.stanbic/databases/OneSignal.db-journal
Size 512B
SHA256 04acf0fbdc8699bb8583f209e1e2b363156726a1c9360da9c37601614d7da572
MD5 994f73413e319799eb4c7e63d4bf929c
SHA1 efaa55c4c371cba9ce866072cbeae49fd2503180
SHA512 c043db5f99720b82feb464ac6704896c01b640006030d30c79f980fbad500b84e3e93967c04744f2a018cdcefd84e0ad624ee75e983bf13797fa6a1b74bf5a01
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.reinsys.apps.conferencing.stanbic/databases/OneSignal.db-journal
Size 8KB
SHA256 4dbf2bf14043c12db71150161135b49a47f12017fd14ebdaa49a737d89d34911
MD5 36399c89847a34704fe73ccf834d48fb
SHA1 22db653f5d8cf7449b52fbbe3bcba64a609c7ea4
SHA512 072d8b9fb7e3abe3f9fe018064a701be3d478d536175ff0f8db0661754297cf530cb50770a55042b2871cd7c981e24accd1145819b3be08f0e16b5b08f7de381
SSDEEP 6:7+/l9ki+n180g9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKG:7+tX0qLiuWdwRmBEyPbZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneSignal.db-journal

Path /data/data/com.reinsys.apps.conferencing.stanbic/databases/OneSignal.db-journal
Size 8KB
SHA256 20e67f94979ac1d9f4dc4fa8e24241753a9c648c3e42aa096c0e3c61117da06d
MD5 7347a04071a9517792bc4770082fae95
SHA1 b5b528001e0941ef0681aaf7f283b251dce4d24d
SHA512 b0bced2975393a6bae94e71b6fde7e1bf7991c2c0c361fab8e5187c11028b16c615d7bcceed84743386bdf9ff852cf73c769ea4400e835138f4618d76b060500
SSDEEP 6:7+/l98FmHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKrM/U:7+tRqLJdTRmBEyPbXU
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events

Path /data/data/com.reinsys.apps.conferencing.stanbic/databases/com.google.android.datatransport.events
Size 32KB
SHA256 a6417906596802ee2a80cd22ef848d832848a6f36f4e45d320e9b98633a5c456
MD5 ad7bbdcce258ba21d0a07659a3849e3f
SHA1 887e17f38cf736cc82125092f6cadd5753184286
SHA512 4519d5aec86a163c9c2c97d1cf9862cc9b421749c0d78c0f4ceee31c9fe07ac557e736d5b3f72942e2d5d44b578fc8a6789f2e7a3ec98ec2199fdc50dd3ac45d
SSDEEP 48:Tk859MEoBdUdndVd/7d5IvdldHlq8/JqFS:AEMEo0LIyNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.reinsys.apps.conferencing.stanbic/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 a86b047d2b72e8815a979ad67a817e458485aeb2b1eebe8f3ea4e3e09c917bfc
MD5 a4fef6cf8c22e9285fa1af5a77f4ba3d
SHA1 1f9e03ff83604f0b974596772feef41b6a46eeb4
SHA512 6e6a0e6b6763b835f12e3ad047059a79828786f45388ef1e57d35bec96ea3910b8c3747bab704648db3e62f9da92e24bfaa732291db70810a37f961a50287350
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.reinsys.apps.conferencing.stanbic/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 b904c22e67f42c2fa2385af30413fb64af5c88979f77e5b0c7f06eff7ac515f0
MD5 ba025424200979f3a4d8ec9928cbdde7
SHA1 d39a77b4626e9d66dea8d68e8c408ca5900b3285
SHA512 e98fff594053834a8b05a99f76f2f7d619f4f9589d8b26ebc8dda8f75a847535b408c61f54b109d691755c09687efeadd3fe0ec65daabbd46eafff42570f70e5
SSDEEP 6:7+/l9NB4n19Rg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKI:7+tJiqLiuWdwRmBEyPbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.reinsys.apps.conferencing.stanbic/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 067241ea8974800772af831c0622a8a6fd90fda285ff3034f52e64b9c64a4dab
MD5 d9e9a9c2fb2c848c2a3ab314c4147513
SHA1 faeadea14bc5bdc060403f3d4d966abcf056133d
SHA512 46bba30ada45ea2bf9db49a16022c3e638a3da6fd53657e89d80a94272d41547bbad45b2afde46d06d4b60c9ab39d43a019a12ee7b049c145148d7d6f27ae077
SSDEEP 6:7+/l9fr/0FPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKm/Gt/b:7+t9r/0BqLJdTRmBEyPb1qb
MD5 SHA1 SHA512 SSDEEP

Submit Download

PersistedInstallation5022371687918833613tmp

Path /data/data/com.reinsys.apps.conferencing.stanbic/files/PersistedInstallation5022371687918833613tmp
Size 90B
SHA256 36c99c91a3e6ef7f986376e82e3628b855b001a0dc838936180711e1b4ea627d
MD5 5f7cffcf422d6ad6258bc427b18936d8
SHA1 e521e952ba361ed784e4741ff56d7551a1d2138d
SHA512 cd6c23d0d3cc277b754469b755aeb2ca238018c359eb61ea85a9fb68988d5f30ae3f7239e6521ffca5535bdfd494b1a84899182f10490e91e6382c7739e0f63f
MD5 SHA1 SHA512

Submit Download

PersistedInstallation6067585517108997083tmp

Path /data/data/com.reinsys.apps.conferencing.stanbic/files/PersistedInstallation6067585517108997083tmp
Size 567B
SHA256 afa3cd816a9a21b3aa605cfe21e02c272316a1abdaf10fa4d97c92dc21787a46
MD5 6f21d5a0bf9f24d2023b01dae8afe82b
SHA1 eec6bb70f28026047acadd118559dbd9a845a7e2
SHA512 4536b934fb5b1bb58442f5641e142124aa4ba87fcf1951b4002ff834bc344bb8fc24adade513f596225696af9677fae99245a15d5b6878ab41e3ad347c5ea684
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.reinsys.apps.conferencing.stanbic/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.reinsys.apps.conferencing.stanbic/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 73065b9759bf1d890fecbed0705f58d1a480fcd3dcd2393587efd3cbda87e2de
MD5 ae4fb9b5d3017aab1bfbda0a0cc6d182
SHA1 8d164de3b6c3a79c3d63a17091685472457e6e99
SHA512 535aa193e517bf5e5f4629579278f158822a25c4e6a4f64a4951595a0e9ce2a95aa08562d20cba9e7e793d3586725959c7f2b2ebeacd66092a6d115cbed93a21
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.reinsys.apps.conferencing.stanbic/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.reinsys.apps.conferencing.stanbic/no_backup/androidx.work.workdb-wal
Size 189KB
SHA256 03df93a3b0e42f4c72f213dd405625c6b885119ca8d39b25c50a970b137d65c8
MD5 e1e355c393e9982dd493f4b39bd8169e
SHA1 6dfac8ae2111e89235146cfd645171fc7946d2b8
SHA512 eca8dc89ff97393d784530d3262c6f5e6178b922208e7a00193301e5bae1fdb79b4cbb86d6a4a1346160a506fee3397422ae71272cb0750298a6df2bd42f2738
SSDEEP 96:JE21DtYxaiE5jEFXuejuE5E21DtYX+hmE21DtYLHE21DtY:J1DtYxalsz/51DtYu01DtYLP1DtY
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.reinsys.apps.conferencing.stanbic/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 006305acd2ecdf9474ca3c1f02f0a840d33905529101d0ff6fe76918434c9b09
MD5 832d5456cc6db3bd870d5316dec0012e
SHA1 a48d704897a53e8af1bca2b2c0d7b899ab1ff578
SHA512 d108bacf5819493b8850bbab397c92e9f4d3c298db97f97dc3f7f4fd9b0c216cf1bea7f6171d1f8e2d13dec117ad48a804bca91aa2c8b8d869a904871f6f4218
SSDEEP 6:Kfgf1BZg069FZdrlOERX4PBX4ogLugMBX4suuK+/9gd/YQlFgQLl3gDPgtiOw2:K4UzdTRmBEyPbP/e/ZEgtiOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.reinsys.apps.conferencing.stanbic/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 572c4b8db75a66ff5f9a706b3b751a4ff56fbb96b48a8663d01c7748b1247f53
MD5 90348ee031a3e3211f2471652e879363
SHA1 7456b270997f55292d63759c8885fcd5c85d883f
SHA512 9e72e46be070cf673b2f9d93c8af9066cf6e13724cc7b5cd8be182d98c1a31f59458173a48161d39d98a03b771be608423a7872f2f17460a77e48f1359871472
SSDEEP 96:1Y6+hdjnHtDRMpf8UzS6+BD8q0ExPeJdGo1:18djnHt9Mpf8UzS6+BD8q0E5EGo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads