939ce5a794baa391aabd143ded6fcc5125eeb11bb0b973b5e361becde742014b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

kapp-google-kwgt-prod-release.apk
Size

32.7MB
Sample

240612-va6cyasbkb
MD5

32a556c25e2ab2e0f9538370c6ffc4e2
SHA1

0d74a569d25b36a6ba0e81f35d1a0ff629b22ecd
SHA256

939ce5a794baa391aabd143ded6fcc5125eeb11bb0b973b5e361becde742014b
SHA512

9ccb1bc66d65260c77c150cdc049796f37f1ac873a2811b6417f76748ab47d7b0909795995ba2c246e5d61ff9e8dd1639162931461de1a8765c10297299f1ec9
SSDEEP

786432:T1xW+HemuD5jA1Lh9KR5spsZtboKBWme4ldeFRV4I:T1xz+muDpA1LhcfCyWmroF9

Score

8^/10

android collection credential_access discovery evasion execution impact persistence

Malware Config

Targets

- Target
  
  kapp-google-kwgt-prod-release.apk
- Size
  
  32.7MB
- MD5
  
  32a556c25e2ab2e0f9538370c6ffc4e2
- SHA1
  
  0d74a569d25b36a6ba0e81f35d1a0ff629b22ecd
- SHA256
  
  939ce5a794baa391aabd143ded6fcc5125eeb11bb0b973b5e361becde742014b
- SHA512
  
  9ccb1bc66d65260c77c150cdc049796f37f1ac873a2811b6417f76748ab47d7b0909795995ba2c246e5d61ff9e8dd1639162931461de1a8765c10297299f1ec9
- SSDEEP
  
  786432:T1xW+HemuD5jA1Lh9KR5spsZtboKBWme4ldeFRV4I:T1xz+muDpA1LhcfCyWmroF9
Score

8^/10

collection credential_access discovery evasion execution impact persistence
- Checks if the Android device is rooted.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Checks the presence of a debugger
  evasion
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Event Triggered Execution

Broadcast Receivers

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Discovery

Process Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Clipboard Data

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Data Manipulation

Transmitted Data Manipulation

Tasks

static1

behavioral1

collectioncredential_accessdiscoveryevasionexecutionimpactpersistence

behavioral2

discoveryevasionexecutionpersistence