c816d7513cb36becac080698ee3937bccfc5f8f3b2b0a436c8b46f7f0635197b

Analysis

max time kernel
173s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
09/06/2024, 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c816d7513cb36becac080698ee3937bccfc5f8f3b2b0a436c8b46f7f0635197b.apk
Size

3.7MB
MD5

af60591348229c9ac3400cf47db0d146
SHA1

8a0233bf2c6272b085daade9c6fa6f3a32708467
SHA256

c816d7513cb36becac080698ee3937bccfc5f8f3b2b0a436c8b46f7f0635197b
SHA512

4c9e01cc6568d7d31d8ca7c28d7d8e5726b649c1caf323175cb33a9e2e703ea166fd030a19e230df1b8a3e22db375c7c49fa40d6bd1c9f90168ecd8b23c18b03
SSDEEP

98304:N9m7hsS4M8HR2/LXL+Jhwcxgv/q7xyvwNI8MG/koZOU1iEOVdJ5l7kfBNjF:O7iS4rHR2/LXyJhwrvKCiI8MGsoMy

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	Aktualizacja.apps

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	Aktualizacja.apps

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	Aktualizacja.apps

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	Aktualizacja.apps

Aktualizacja.apps
1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4267

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact