Analysis Overview

score

7^/10

SHA256

60f7d7b285fbcd1200cc706fe8c5f60096b499bfdb704693a94cf35941944f2b

Threat Level: Shows suspicious behavior

The file 60f7d7b285fbcd1200cc706fe8c5f60096b499bfdb704693a94cf35941944f2b.bin was found to be: Shows suspicious behavior.

Malicious Activity Summary

banker discovery impact persistence privilege_escalation

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries the phone number (MSISDN for GSM devices)

Requests dangerous framework permissions

Queries information about active data network

Tries to add a device administrator.

Declares broadcast receivers with permission to handle system events

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 00:19

Signatures

Declares broadcast receivers with permission to handle system events

Description	Indicator	Process	Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN	N/A	N/A

Requests dangerous framework permissions

Description	Indicator	Process	Target
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE	N/A	N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE	N/A	N/A
Allows an application to send SMS messages.	android.permission.SEND_SMS	N/A	N/A
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS	N/A	N/A
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS	N/A	N/A
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS	N/A	N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE	N/A	N/A
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS	N/A	N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 00:19

Reported

2024-06-13 00:22

Platform

android-x86-arm-20240611.1-en

Max time kernel

179s

Max time network

184s

Command Line

com.hgqf9gqr.p2nlwxwh

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Queries information about active data network

discovery

Description	Indicator	Process	Target
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	N/A	N/A

Tries to add a device administrator.

privilege_escalation impact

Description	Indicator	Process	Target
Intent action	android.app.action.ADD_DEVICE_ADMIN	N/A	N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.registerReceiver	N/A	N/A

Processes

com.hgqf9gqr.p2nlwxwh

Network

Country	Destination	Domain	Proto
N/A	224.0.0.251:5353		udp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
GB	142.250.187.206:443		tcp
US	1.1.1.1:53	android.apis.google.com	udp
GB	142.250.178.14:443	android.apis.google.com	tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
GB	216.58.212.202:443		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp

Files

/data/data/com.hgqf9gqr.p2nlwxwh/app_config/config

MD5	64e4d48b3247c1591efad50533a74ea5
SHA1	5a4d3a39e29ea8a80103b7cbffb5c7675e832e6c
SHA256	b6d260982a6a631036c2c5d633b3be83ac5a9d498b395994bd1c9bbcdb6ac3b6
SHA512	0f32149bef5bade131b8e898dd2f2e176eb268cfd9fef6d6637bc834991be10938ae41a11e3686bc72dbf3ff4fe9eb6a82e50f7bd92ef9cd79383329f2ffe8fe

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 00:19

Reported

2024-06-13 00:22

Platform

android-x64-20240611.1-en

Max time kernel

178s

Max time network

186s

Command Line

com.hgqf9gqr.p2nlwxwh

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Queries information about active data network

discovery

Description	Indicator	Process	Target
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	N/A	N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence

Description	Indicator	Process	Target
Framework service call	android.app.IActivityManager.registerReceiver	N/A	N/A

Processes

com.hgqf9gqr.p2nlwxwh

Network

Country	Destination	Domain	Proto
N/A	224.0.0.251:5353		udp
GB	172.217.169.42:443		tcp
US	1.1.1.1:53	ssl.google-analytics.com	udp
GB	216.58.204.72:443	ssl.google-analytics.com	tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	1.1.1.1:53	android.apis.google.com	udp
GB	216.58.201.110:443	android.apis.google.com	tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
GB	172.217.169.42:443		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
GB	142.250.187.206:443		tcp
GB	142.250.187.194:443		tcp
GB	172.217.169.42:443		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
GB	172.217.16.228:443		tcp
GB	172.217.16.228:443		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
GB	142.250.179.238:443		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp

Files

/data/data/com.hgqf9gqr.p2nlwxwh/app_config/config

MD5	45d12a2638e9cd03356c71e5ef99f168
SHA1	f2c80eba08041b01f905cb80687afbb37879f245
SHA256	522b3f5defdde92f4cf6cfeb8e9ee5069cddb04505e6ce40d68191751da66467
SHA512	ef6a967267d01da68293850276c1946b9871307dd6d48564562306368d22c88bb0e7a0020e6b9781f67cad88de5cf5f057cea43689ff1a714cf1ce9dd4c79b0a

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-13 00:19

Reported

2024-06-13 00:22

Platform

android-x64-arm64-20240611.1-en

Max time kernel

178s

Max time network

187s

Command Line

com.hgqf9gqr.p2nlwxwh

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the phone number (MSISDN for GSM devices)

discovery

Queries information about active data network

discovery

Description	Indicator	Process	Target
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	N/A	N/A

Tries to add a device administrator.

privilege_escalation impact

Description	Indicator	Process	Target
Intent action	android.app.action.ADD_DEVICE_ADMIN	N/A	N/A

Processes

com.hgqf9gqr.p2nlwxwh

Network

Country	Destination	Domain	Proto
GB	142.250.187.206:443		tcp
GB	142.250.187.206:443		tcp
N/A	224.0.0.251:5353		udp
US	134.73.138.56:80		tcp
US	1.1.1.1:53	ssl.google-analytics.com	udp
GB	216.58.204.72:443	ssl.google-analytics.com	tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
GB	142.250.179.228:443		tcp
GB	142.250.179.228:443		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	1.1.1.1:53	www.google.com	udp
GB	142.250.187.196:443	www.google.com	tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
GB	142.250.187.196:443	www.google.com	tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp
US	134.73.138.56:80		tcp

Files

/data/user/0/com.hgqf9gqr.p2nlwxwh/app_config/config

MD5	a87a819c91a2e45ba399ed8dbf85f74f
SHA1	07b324c498cd337ecb336ac5d3bec5ea315fb898
SHA256	8b5448618a94922ad49b5526962bda38f88dd5a9ff1546d1a41c04697c9c9f70
SHA512	1898a3a4774602e777bfe8ca0ad679171ace218b005dfbc1a8d78e3810fea16e729ba512fd6bb6bbf67fd01111ab599d696d20263d663fb6f7f010a61f50cd58

Sample ID	240613-amk8bazhln
Target	60f7d7b285fbcd1200cc706fe8c5f60096b499bfdb704693a94cf35941944f2b.bin
SHA256	60f7d7b285fbcd1200cc706fe8c5f60096b499bfdb704693a94cf35941944f2b
Tags	banker discovery impact persistence privilege_escalation

Malware Analysis Report

2024-07-28 14:44

Table of Contents

Analysis Overview

Threat Level: Shows suspicious behavior

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files