4c45b4fcce0670756a21382c2b0d03bcfe880a7d257192a59415df32c6b90b7c

Analysis

max time kernel
179s
max time network
185s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
06/06/2024, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WhatsHack.ver_.1.5.build_.8.apk
Size 2.0MB
Sample240606-chynysed8z
SHA256 4c45b4fcce0670756a21382c2b0d03bcfe880a7d257192a59415df32c6b90b7c
MD5 5b72cf7c480669ed473c2bf99631a00e
SHA1 4921502a0467946c038de18e17b5d53f9fd1bd7b
SHA512 6de7027f68ecac7ea5ea2201900a6851027b52fc6e54d0c6d610ade928c3c60114aadec77bfdb45e0025e965db197f00a4ab9051e2812f6fcf56f6be4142dde5
SSDEEP 49152:8pl3JenwQcX3/U9IWFceMUKq8NJK7Xrvde7Tzk:8rJeqc9OUKqCJKHFSk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.crocantimushroom.whatshack

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.crocantimushroom.whatshack

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.crocantimushroom.whatshack

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.crocantimushroom.whatshack

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.crocantimushroom.whatshack

com.crocantimushroom.whatshack
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5129

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

mixpanel

Path /data/data/com.crocantimushroom.whatshack/databases/mixpanel
Size 28KB
SHA256 a2392c518dcb8e1fcf487050bdf26b3011311dbd751bbb5aae25f980a75e4b92
MD5 caf8df69768c07f3f50f95dad4e9d0d5
SHA1 2106296a9e84fdca64fc029f843b16328ef8299f
SHA512 e902c31f14eb39421fa2f41d44c0a45a7733e5e81aaa720db0154f057f6c150c6d044c81b335fd6890e886a5bb29aa750d2d1448130bb63249952266696a4e78
SSDEEP 12:TLT189qWFNKQU99wzbhRJTSFbyjLH9wzbhRZfRmBEyPbGtOwGQ:TLT1WqWFU5+JNR+Z0GSiGQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mixpanel

Path /data/data/com.crocantimushroom.whatshack/databases/mixpanel
Size 28KB
SHA256 fa0997cf741f179197aa719a41aa2925bb789a4d74cf5d5d9560b4d43a570a39
MD5 107d4621f137f8d9942cf8c79cc4c86f
SHA1 3ba469c2d5987f7b1a3255d2f84745c393468e04
SHA512 d287e5e67334f6a912cf0c563c08dacf130a1bab62cf8496b03d3381f5e87b9a8f8ca235286b83f5c0e3158d9e447416837b9fc8679f4809a0586f42e52979cd
SSDEEP 12:TLc689qWFNKQU99wzbhRJTSFbyjLH9wzbhRZfRmBEyPbP/W4:TLc6WqWFU5+JNR+Z0GSP/W4
MD5 SHA1 SHA512 SSDEEP

Submit Download

mixpanel

Path /data/data/com.crocantimushroom.whatshack/databases/mixpanel
Size 28KB
SHA256 8b7e1d74140d37b8ad9a027bb1c130173837233fbf13fc5ff2f4c290f4ccc380
MD5 bb2cc27b0d3fa8cc148bb1162db1d428
SHA1 4e0b96c2e1b15f8f5fbd606049fb4847aaef29df
SHA512 7282c258f821aedb14c9c05a7eb28d15cf86b465e8aed91c36bd733cb4bfd8d2fd681b02b2930e37205d9be9b53c57e5c6d46fb07c8c8cd166576de510b3f808
SSDEEP 24:TLEP0DWqWFU5+JNR+Z0GSP/KEh6GJv/YhkoRtFG39t3:ToP0Db5gzuSP/5tvckJ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

mixpanel

Path /data/data/com.crocantimushroom.whatshack/databases/mixpanel
Size 28KB
SHA256 a3f2ccee215553a1b7c6cf2f5cfc2d5d90cd873d029f7806fc92202f27ffce6a
MD5 d38fbd4d47044345009b20ca2b0949d7
SHA1 a5a6f4060a368654f905d21a78c10d811b92d869
SHA512 7a10fd3c959cc9c2ffc1d586f7c085af6bf7613954cd06656ad0a72ca08ad8834f052aad20a582396a892b07843cea808c3a749fe2d481ef38d934e478cbad07
SSDEEP 24:TLleuWqWFU5+JNR+Z0GSP/dAJv/YhkoRtFG39uh6GJv/YhkoRtFG396Fh:TRfb5gzuSP/dwvckatvck2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

mixpanel-journal

Path /data/data/com.crocantimushroom.whatshack/databases/mixpanel-journal
Size 512B
SHA256 c1a0d404547d3ec71bf1b1bd88dc8efc891c791ef9241e4b2befc4f7b64e0500
MD5 6c03faee2020e74d47122630c290cdce
SHA1 bbcbd8cfc52b3b2e7107ed3a6cd60c2361651048
SHA512 11db773bc2146a4f1116707b1580088cb3cd91c87fe74561d3792251547580ad29bff2524370fea54269ac5c16329e10bd232c0bdb1e48652b95b4cf83ba3a29
MD5 SHA1 SHA512

Submit Download

mixpanel-journal

Path /data/data/com.crocantimushroom.whatshack/databases/mixpanel-journal
Size 8KB
SHA256 77c302c4bd7795f3d4983f7977a38cc2f5c1c00576c53fed76abefa462aea727
MD5 7a7edec148084190a0119b69eb81cdce
SHA1 63aa8f38dad61889c18374cb2df956ddf2df2c03
SHA512 5dbd15e67bcd5d7becb0e84989a10027124af57e10e682e2a46b334db5def2b45c38aaa0ebfe870c507956c1475ecc070f0b58902adbdc87d3583df45663a8b1
SSDEEP 6:7+/l9MqFn1sg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKN:7+tvAqLiuWdwRmBEyPbO
MD5 SHA1 SHA512 SSDEEP

Submit Download

mixpanel-journal

Path /data/data/com.crocantimushroom.whatshack/databases/mixpanel-journal
Size 8KB
SHA256 bbef842d34ceb6e4517983843bd057e5364fb69b060b8147c534b7ceb670e9c1
MD5 3e29c6be47c4701276a74339ff64b286
SHA1 2111de96b0b19773e744412abf85b146a0c01e8f
SHA512 fb345d364c0e6ad1e25593612f299db2f515a0d74f2914ac0a990bd0f01b95b12c0dfd2856ebccb2c90f5423ba11d40f83370112bac461b2b67038b9dd007864
SSDEEP 6:7+/l9FcPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK80/r:7+tkqLJdTRmBEyPb7Ur
MD5 SHA1 SHA512 SSDEEP

Submit Download

mixpanel-journal

Path /data/data/com.crocantimushroom.whatshack/databases/mixpanel-journal
Size 16KB
SHA256 8f9e4cbd4f4e41ddd9eccca43ef200d516fc3f5668bcc4db368790d40071f2c3
MD5 6236bd48acd51852fdb6b7fed2b84d1d
SHA1 3dd63ef918e9bcc7629768b552fa341bcec03231
SHA512 c85c662f627d2df2c6520d5479f5b6b503b36a1a6924a49a01e404fe45dcefb52f5b21e7d35b1446573f31bd1309846e4b9f1d80a6fb61b7013c9bbfbd84197c
SSDEEP 12:7+t7shqLT189qWFNKQU99wzbhRJTSFbyjLH9wzbhRZfRmBEyPba:7+tIhqLT1WqWFU5+JNR+Z0GSa
MD5 SHA1 SHA512 SSDEEP

Submit Download

mixpanel-journal

Path /data/data/com.crocantimushroom.whatshack/databases/mixpanel-journal
Size 16KB
SHA256 97d0445b44f0752ee5be1bbd8561b4c90d83fd0123e9b129c8037df03743afb4
MD5 da8706a487a7045a523fdb43fc22b9de
SHA1 1b97842173cd017cd995eb603b69fc864a035ca3
SHA512 57bc4b245d012e14c03d223e7ee55f68dd8f60951c6b21061786cf9fb0a0a056f27df86ce38c762ffbdc14e726cfc762b617d35501f111b5ed0cc61cd3b7422f
SSDEEP 24:7+tpevEh6GJv/YhkoRtFG39lGvqLEP0DWqWFU5+JNR+Z0GSHF4:7MpeMtvckZmqoP0Db5gzuSl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

mixpanel-journal

Path /data/data/com.crocantimushroom.whatshack/databases/mixpanel-journal
Size 12KB
SHA256 fb66bd9f806b295c8dfe6f801526cccb28565e19f291f13d007cddbc64cc35a1
MD5 8a516d8602ce973638cc328913f564a9
SHA1 fc1b6e4d8cf17e76a8bd2f5bf869f125af11283d
SHA512 04942e974c32f06d8e1b6f16294a267b86edd40cd89bfbb9a5420c738676860c78ab3d567ee47caceca2a0d7d68151a55e9e3941429c62ceef767fe06e4a64eb
SSDEEP 24:7+ttLunAJv/YhkoRtFG39uh6GJv/YhkoRtFG393qLleuWqWFU5+JNR+Z0GSy:7MtqnwvckatvckzqRfb5gzuSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads