64b73201e87e106e06748e8bbb3842e832e22da9b8cc1d542ce423942d1097fa

Analysis

max time kernel
125s
max time network
131s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
10/06/2024, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_168803aafcf8333fb33d51a7b811ba59.apk
Size 173KB
Sample240610-mc4ccsgd34
SHA256 64b73201e87e106e06748e8bbb3842e832e22da9b8cc1d542ce423942d1097fa
MD5 168803aafcf8333fb33d51a7b811ba59
SHA1 0c86baef9c77de5620116e27cd17a0013b3023eb
SHA512 a9813b5a78fe256ee72ee1509522989a2278c0c7362671eff9bd673eb39175c9c2370907cb4da91886a3c54cd9ca9a29ac2b4997f2886ebe6673c68ae1ecfbc3
SSDEEP 3072:TpHdKFaN0oMwZoAHTShoSqhbp8rVYhO+Cc9YNN5EztO+iJ4rRXcX9SiXzKkEkM8N:Tp0FaRHTSWdNp8ri4cONN5mFLaciX4/O
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4995	gov.games.nigger

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	gov.games.nigger

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	gov.games.nigger:i

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	gov.games.nigger

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

gov.games.nigger
1⤵
- Removes its main activity from the application launcher
- Reads the contacts stored on the device.
- Queries information about active data network
PID:4995

gov.games.nigger:i
1⤵
- Makes use of the framework's foreground persistence service
PID:5043

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads