Resubmissions

09-06-2024 15:45

240609-s7g1hacg63 7

09-06-2024 15:29

240609-sxcysscf37 7

Analysis

  • max time kernel
    127s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    09-06-2024 15:29

General

  • Target

    Hamster Cоmbot Bывод.apk

  • Size

    7.4MB

  • MD5

    43cd0d0837b2cf2371e93e4340614562

  • SHA1

    db8cd87819a91f311f22a78e1e4099486768099d

  • SHA256

    608bccf44f236542d708efc9e8d81372bb1a941969f267b315772acd370d2b06

  • SHA512

    7e5356ef27b70b99a872b3c5cf8e21358971c0c85c34c7fbab6a8a20a70a5859a34dc8c651e274fd3a13bcb3af6f7adfc2269b108f11bbb25eb4257ac5f9a0f9

  • SSDEEP

    196608:xwzajoJT+62TZF8SoGwsX7LwwYwwxfn8/XezdJsy7BwHxz5:4aKfsf1oRjzqXeJSyK

Malware Config

Signatures

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests changing the default SMS application. 2 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.example.application
    1⤵
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests changing the default SMS application.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4286

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.example.application/files/profileInstalled
    Filesize

    24B

    MD5

    362dcf0f59700f2733c3e0e86962635c

    SHA1

    45e2282d6ea3c0ce1bc5477789eeb3eb6b9289f5

    SHA256

    7d6c86df2b207638c7b5c039e7fc22d64f6c42e14373fbf55c08feed0f22441b

    SHA512

    b2910804df27056e743b95239b562ef9f824dd78b251901ae65fb1fb7bb9e31a0c6bdff51461b83f0263896105d69583d9183ce311520547b1d42c4852ab5528

  • /data/data/com.example.application/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
    Filesize

    8B

    MD5

    02c01db493487e375d9657165bc37d81

    SHA1

    533b7b4b473818fb5d423bbf31fbd30ac7e150fa

    SHA256

    0809620a849f4263edf23d5c5a07cd9e42818299fe83a10f4516fab276f2946d

    SHA512

    e0af9de68e776ac88d0cad5ba300aef99c73a09c5c372f171e3b4b33acc0260696b6157fd2276d87019664021ed0415dcf95c489576053c13222c0172ff9ef1a

  • /data/misc/profiles/cur/0/com.example.application/primary.prof
    Filesize

    5KB

    MD5

    b6d3ca5f8b1bea3f243673abdcbc25f4

    SHA1

    917a67c3b5fd9814adc01e81c59ed08c70db70ac

    SHA256

    1eadd2d3de1286832ab2ff6ee7eaba4fc116b53981008593219e9afe543cc9df

    SHA512

    03bbd5bff2f967445e1f62da8570063f2aae822c3f0bfc67a42d7d0afc893ba5394e3d5d525dcd7c4569fe0f0e9a904b0fe5044c138a2427c46879bd7ae6a4e7

  • /data/misc/profiles/cur/0/com.example.application/primary.prof
    Filesize

    2KB

    MD5

    3e0984b273aec90badb3c1aa340c8042

    SHA1

    213e1dad39b1fd1ecffd7143d6bf46e57dedf161

    SHA256

    caa13bfd9af21fa115e1c65ca8b174029b09ef603b8cc8f921375d27948cf43c

    SHA512

    df9570e6b240533b92ad1d0e9f231a35b8f83bd9ebeb14296ca12e35afaa03bef424adc6955b161a696fb6ee1d55a03828a2f0a77cbc93bdd44c4d792308f826

  • /data/misc/profiles/cur/0/com.example.application/primary.prof
    Filesize

    2KB

    MD5

    4820e5c745058b00f4ca5df9c5e2ed37

    SHA1

    6f0bc59bc87bcb51a1d86e30a79d2f9ccc94bc61

    SHA256

    380b7d08a5fe685631a8991308a90816a6580c0b9e01f831c69ff43ec212d6e5

    SHA512

    5a9bb2fc880158a35412037b9d986468bfe8bc05e9a96643fb2e9244431c48c577ce4706955ebaa94340969d21bb4d47736d1318984c6e526ea27f0c3cc1afcc