Analysis
-
max time kernel
24s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
14-06-2024 00:51
General
-
Target
8f215662c9c337e16b1e831c7c9ce67af756cece227e9fd10076e776a4b1b603.apk
-
Size
2.6MB
-
MD5
14d3af84b8a68248f09332a3009358c9
-
SHA1
bc610d3b68ae6e908397831b66be444e2a2c6d98
-
SHA256
8f215662c9c337e16b1e831c7c9ce67af756cece227e9fd10076e776a4b1b603
-
SHA512
182ff6a4865fdc0d6fc35e3706f3c6c582679f645d5f5f25d63a19380ff848bae201a3b678611cec919ae3118a6c59dc896d5f840a464c23943a9041ec849093
-
SSDEEP
49152:2kEwptu1e+tbqxroC/LfmomMqgaI3tyIv3g8RzfriXnr:2l/1ekqxroauoHqgawsIPzfriXr
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.perl.gqm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.perl.gqm/app_outdex/libdexprotector.4259.soFilesize
369KB
MD5f23f0980c22b7eb88d9bb6a9056b3cbc
SHA15e8afd5aebfbc0345bc9c1751a4771431377430e
SHA256f73b58f3545d8f94e8d9436f3747c657f9c0522c9e85ad831dac2b54acfa4ab8
SHA512438a639030dd09ceb3d1c42e5e6a2ab8cc192d1366ef1474b3344e11206d3215b2b0e3888527697da3eb53e5667a7f8aaa98bf881fa20e9613db0785fc4dbca0
-
Anonymous-DexFile@0xf36fe000-0xf36fe12cFilesize
300B
MD57c80da100acf95df2c9629e515898a6b
SHA128c7d9a00126bc12a0760f9cc6270abea6866d73
SHA256ed26ed598d0393b52cb68fd71e26f7eb5fba998f72c1c30eae4622bb0752692f
SHA512b2eb8340ae3dd3ddbe2a5cf3de6b735a33bb15b51b728f01643fed02375c8962f37fcbd4827fd578cb73678847cc47c45290d763281be5caeded67fa8923c6a2