Overview

overview

8

Static

static

6

kwgt-kusto...13.apk

android-9-x86

8

kwgt-kusto...13.apk

android-10-x64

8

Analysis

  • max time kernel
    18s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    12/06/2024, 16:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kwgt-kustom-widget-maker-3-75b410013.apk
  • Size 32.7MB
  • Sample240612-tk35ws1cra
  • SHA256 84d69ef348382106682c88f6ba8a9bbf8db0e6fc40472af435d777cb2a6967d0
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryevasionexecutionpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Checks the presence of a debugger
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • org.kustom.widget:editor
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:5216

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events
        • Path /data/data/org.kustom.widget/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 4a12163dc7ed70f2ba2d2df2604f74700c61dc224ec8b002e487ab14fd544489
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/org.kustom.widget/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 352268c2bc8c07b33aa5d4f81111966886666ac2980c6d716f637add73bb13c4
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/org.kustom.widget/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 561f1947d49455e14036dca704e08c282860155fdb73a895968b9d53159d1dd9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/org.kustom.widget/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 8a5f46a415d20511092675d9ce252ae2103e2ed4df9a6236e28ef402e35c848b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 dac179f7170e7760b8b6cafbd24989ceb51b82e1cdce10db321de03bece00674
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 587e29387ae03ac4a6edf2567856e97f758dabeff59fc65e7865e265636d9110
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 a2f934c4c24fbd9f9d4e86d048197eafa757398a5c0734ff5d40683488dda6fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 7fd60efe44bf4f72c818bcbcd083c999a9076046a5614da6c6a60122c407e0c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 6b47ebcc6e3d93a7411f73a0e03b4d0dc13b5d7908f33ebc7f43ab296ff265e1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 d76f16ff5330a8a1c9fe6d621e5cc349fc0ee4a095acfa1bb4110b6ea365bff8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 c5d96d966bf6a5e1fcc3fd7f18ee8a08330c19fec8ef64b7d078c6abcbf58f93
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 73034c23c47445a06d95d1f592a365c5012b6e553525068738dbbc19de1ca737
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 b80c35be471dbf1986becd4b11e5a41b0e45e80e529d77c2be447fcbe7705c46
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 cdea9189f44de081f8df970a05a573e3cfdacf1c88f2be61412e0d86648d6403
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 300d2dffc2583b7757b949cf19637a0a40765262192000a90e80d43d1794fa97
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/org.kustom.widget/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 9d3c00c610e32e3a2df135338ee2b7c0616c872617458b41bd1447e7cd98902d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        com.crashlytics.settings.json
        • Path /data/data/org.kustom.widget/files/.com.google.firebase.crashlytics.files.v2:org.kustom.widget_editor/com.crashlytics.settings.json
        • Size 713B
        • SHA256 58e2fc34993b932032a30ff580a73d3bedafcb479f873ff24bb5cb4823901faa
        • MD5 SHA1 SHA512
        Submit Download

        internal-keys
        • Path /data/data/org.kustom.widget/files/.com.google.firebase.crashlytics.files.v2:org.kustom.widget_editor/open-sessions/6669C80B038000011460386B25CFC4AB/internal-keys
        • Size 207B
        • SHA256 ed9f58705e9237903f59cf7c792c438a1be19373793e3dd26cf43bbdbc511c40
        • MD5 SHA1 SHA512
        Submit Download

        report
        • Path /data/data/org.kustom.widget/files/.com.google.firebase.crashlytics.files.v2:org.kustom.widget_editor/open-sessions/6669C80B038000011460386B25CFC4AB/report
        • Size 761B
        • SHA256 042583ebcd31a46b4051a61eb1d992b44c6a809bce6cafe038815c70f3fad7f4
        • MD5 SHA1 SHA512
        Submit Download

        userlog
        • Path /data/data/org.kustom.widget/files/.com.google.firebase.crashlytics.files.v2:org.kustom.widget_editor/open-sessions/6669C80B038000011460386B25CFC4AB/userlog
        • Size 1KB
        • SHA256 1252c232ee1e50b077b77f5aba0d052408bd2aa1fdea2ff89c51adc37b85a21b
        • MD5 SHA1 SHA512
        Submit Download

        userlog.tmp
        • Path /data/data/org.kustom.widget/files/.com.google.firebase.crashlytics.files.v2:org.kustom.widget_editor/open-sessions/6669C80B038000011460386B25CFC4AB/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512
        Submit Download

        PersistedInstallation385921618709356189tmp
        • Path /data/data/org.kustom.widget/files/PersistedInstallation385921618709356189tmp
        • Size 90B
        • SHA256 9cf590354496d96a16ba92f19664da8286c67bb1da0c8a5b2fef6ea678befa91
        • MD5 SHA1 SHA512
        Submit Download

        PersistedInstallation6572822419093649396tmp
        • Path /data/data/org.kustom.widget/files/PersistedInstallation6572822419093649396tmp
        • Size 559B
        • SHA256 155b3909c7193f13f45f3278a822b691bbc962971e96f91a2912f639f4617e26
        • MD5 SHA1 SHA512
        Submit Download

        frc_1:415510900161:android:b9af1b0edbcc3626_firebase_defaults.json
        • Path /data/data/org.kustom.widget/files/frc_1:415510900161:android:b9af1b0edbcc3626_firebase_defaults.json
        • Size 66KB
        • SHA256 31ae0f91be81a0bf0ef22409a22f8ad317da72dd3257338caabc2f9b7e83b0b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        frc_1:415510900161:android:b9af1b0edbcc3626_firebase_fetch.json
        • Path /data/data/org.kustom.widget/files/frc_1:415510900161:android:b9af1b0edbcc3626_firebase_fetch.json
        • Size 59KB
        • SHA256 1f089de2206f764743d0f7e8a3e38d92bc41907f1316ccf54892b5b41d9311d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        profileInstalled
        • Path /data/data/org.kustom.widget/files/profileInstalled
        • Size 24B
        • SHA256 00e1ece789e1c92206fc25bd762cf3684dd91bae7fc09ab0954d621ba2975a30
        • MD5 SHA1 SHA512
        Submit Download

        profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Path /data/data/org.kustom.widget/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 d67c3567afdb39f899e698b2c21d3662cdc08ea06cb15de2333f8e9815fe5f84
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/org.kustom.widget/no_backup/androidx.work.workdb-wal
        • Size 305KB
        • SHA256 1b1a392818d87e02be616c54d7ce3561d422da4ba62bebb6ae1c608ca7c4c310
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        primary.prof
        • Path /data/misc/profiles/cur/0/org.kustom.widget/primary.prof
        • Size 10KB
        • SHA256 af587cf905ceea5630e2adf0e44190dc34e9a6b5813b61e5d92f544251df2c13
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download