290f23cb46ab59d4c2cee6e861da2e6717798b997a90d890bd7388103efe8ac9

Analysis

max time kernel
8s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
12/06/2024, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tachiyomij2k-v1.7.4.apk
Size 50.4MB
Sample240612-dd85kazapc
SHA256 290f23cb46ab59d4c2cee6e861da2e6717798b997a90d890bd7388103efe8ac9
MD5 a311ed36158cacd84bbdca4b8edc5c68
SHA1 626e47ca440b766fd1e140fa253819e5bbc32c8b
SHA512 f3d8d79b8e0660c6d8547fb5ba642e28fbd04a18f17ebfef49dbe9e6e58450f9ba8e58b7e3aba5da500b93e9e1e488c8fd504fbe36baa329808286bc37736cf8
SSDEEP 786432:DuIs2415qiWQ8H4LuzbA+JlrAE6jgdhVXVt1Qw9yiouCZqKnLlA4yDlBJjTKWT:3LWds4X+nZrfX9yPuCZrGlBJjTdT
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker discovery evasion

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	eu.kanade.tachiyomi.j2k
/system/xbin/su	eu.kanade.tachiyomi.j2k

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4456	eu.kanade.tachiyomi.j2k
/system_ext/framework/androidx.window.sidecar.jar	4456	eu.kanade.tachiyomi.j2k

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Checks the presence of a debugger
evasion

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	eu.kanade.tachiyomi.j2k

eu.kanade.tachiyomi.j2k
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Checks memory information
PID:4456

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/eu.kanade.tachiyomi.j2k/databases/com.google.android.datatransport.events
Size 56KB
SHA256 30f94ae945eec2f0395870fd928333e9a5fa924816b6b74ea673e4f87248f27b
MD5 a24d78c5ed4ca0bba5031db423d45f9b
SHA1 d003adff0db35a9e13ffd502942482ad88edf3b3
SHA512 50085e98e3f2a8a31b50364c9731427bf5a5e1bccd505cf2e43fd81785e6ca33a7d79359c43c85d4d343d9c5ebd19a74e6ebd6c7b34275c5ceb2da387e53ffe2
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSA:rAMEX0wIyNjaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/eu.kanade.tachiyomi.j2k/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 959437a4811df710db213a7fb26956e3f5df903b7105749761f513f9c5e144e2
MD5 8eb4f0019d70666c4cabc64aa7cf758b
SHA1 a61f2137937d754124f6bbe11c3d7fc4361e71e1
SHA512 9c80d4bb7e10a0a54e9e9885cd5da43f58d9524ec9ebef991da8d56903fbde79dd03287d3b49c273624fa05628782e97ea971034254074696c98cb391cc69180
SSDEEP 6:7+/l9zHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKg/4:7+t5qLJdeWRmBEyPbv4
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/eu.kanade.tachiyomi.j2k/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 f935b1a8050512e3d9c9853a9c0d8d866f963b33d2b15a32c7f9438aad8e8cc9
MD5 031b65f6651910f06c01ca344e085941
SHA1 e347646a43438993c94ca96520527d8c6e5a4046
SHA512 cf8b13319b76525230d5662b60452550253570b0cb549c573e613ecfcc9314d80bc78cf92dffad4cbb7e87c1b21c8337cda4ae5d35ac89f9b46d8a706140b4fc
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/eu.kanade.tachiyomi.j2k/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 2ae4791bc74711678242002545f447ef60b4434247fa0053ec0e874800c08326
MD5 f89f8b4de17f03716ddf52d1317db4f2
SHA1 791be5d49398a14a27d0e26a0fb16479e7435e68
SHA512 55ed3dc9124af90f60e16e228bdb702e46160ceaf4fc8e4d7aae922e62a16bc8edd132b7ba2c76008fc016f09589ac22d8adfb5c1fc883e35294ee236b057651
SSDEEP 6:7+/l9+n1Zg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKe:7+toqLiuWdYRmBEyPbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/eu.kanade.tachiyomi.j2k/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/eu.kanade.tachiyomi.j2k/databases/google_app_measurement_local.db
Size 16KB
SHA256 ee3f058a08b16eda015bbb401674a5b60525de5b6b1917ad78f9447dbc411ae1
MD5 ca6b88a0348a1a691be566f0a8610968
SHA1 f6f07ca223b627b9035280a7aa494b4a1fe8ffc0
SHA512 a05c8532e45752a565a3da99ccec2d1a9648e1f16bff4f1e9b8aec748bb314888d3566ccfa4f17d23130434ff3fa63c2f968eacf33b85f1620c24701ea2fe73b
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6G:TLiEq9zmzrfRmBEyPbP/P+/0Fl6Qqo7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/eu.kanade.tachiyomi.j2k/databases/google_app_measurement_local.db
Size 16KB
SHA256 c1b006e1ebead1cd71ff43c1dd26bdfa2b0b18e1791bbd8da584d3d560579954
MD5 dbed862ff5f00f55f1a7a93718e4924d
SHA1 ae5d7feeb21f8bd827c24b00c4074c26b66befda
SHA512 0f7e1b2657eadd59e18ccdfebbd34116044e617fef7674049e688d960162b346ab86a1b41b02d3a2e36c762c669340a1b9763e43f2c6a22e29fe635c5d58c7cd
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlWDmc+/0Fl6Qqo7:TLopmzr0GSP/h1499FirlFz
MD5 SHA1 SHA512 SSDEEP

Submit Download