Analysis
-
max time kernel
50s -
max time network
153s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
-
submitted
14-06-2024 00:51
General
-
Target
8f215662c9c337e16b1e831c7c9ce67af756cece227e9fd10076e776a4b1b603.apk
-
Size
2.6MB
-
MD5
14d3af84b8a68248f09332a3009358c9
-
SHA1
bc610d3b68ae6e908397831b66be444e2a2c6d98
-
SHA256
8f215662c9c337e16b1e831c7c9ce67af756cece227e9fd10076e776a4b1b603
-
SHA512
182ff6a4865fdc0d6fc35e3706f3c6c582679f645d5f5f25d63a19380ff848bae201a3b678611cec919ae3118a6c59dc896d5f840a464c23943a9041ec849093
-
SSDEEP
49152:2kEwptu1e+tbqxroC/LfmomMqgaI3tyIv3g8RzfriXnr:2l/1ekqxroauoHqgawsIPzfriXr
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.perl.gqm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.perl.gqm/app_outdex/libdexprotector.5135.soFilesize
370KB
MD58aba148186257a51ed99d39762886ea4
SHA18d355231499bca8b0bb9f791ff68a18d084b4943
SHA25613c5c92b9be3a499a0d67577c8c2de0b42d2bbfc89fb62425d8c84ce25012c2a
SHA5123424fa627db7b06db8453f5fa7a7fc96639e8258ca3ebd8610c74252e9d6d2841604183a7b2e5498fe59e00f1ddb34f3d7066fc6f20640b5416b6b90b802a9cc
-
/data/user/0/com.perl.gqm/[email protected]Filesize
300B
MD57c80da100acf95df2c9629e515898a6b
SHA128c7d9a00126bc12a0760f9cc6270abea6866d73
SHA256ed26ed598d0393b52cb68fd71e26f7eb5fba998f72c1c30eae4622bb0752692f
SHA512b2eb8340ae3dd3ddbe2a5cf3de6b735a33bb15b51b728f01643fed02375c8962f37fcbd4827fd578cb73678847cc47c45290d763281be5caeded67fa8923c6a2