8f215662c9c337e16b1e831c7c9ce67af756cece227e9fd10076e776a4b1b603

Analysis

max time kernel
25s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
14-06-2024 00:51

Target

8f215662c9c337e16b1e831c7c9ce67af756cece227e9fd10076e776a4b1b603.apk
Size

2.6MB
MD5

14d3af84b8a68248f09332a3009358c9
SHA1

bc610d3b68ae6e908397831b66be444e2a2c6d98
SHA256

8f215662c9c337e16b1e831c7c9ce67af756cece227e9fd10076e776a4b1b603
SHA512

182ff6a4865fdc0d6fc35e3706f3c6c582679f645d5f5f25d63a19380ff848bae201a3b678611cec919ae3118a6c59dc896d5f840a464c23943a9041ec849093
SSDEEP

49152:2kEwptu1e+tbqxroC/LfmomMqgaI3tyIv3g8RzfriXnr:2l/1ekqxroauoHqgawsIPzfriXr

Score

7^/10

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.perl.gqm

ioc	pid	process
/system_ext/framework/androidx.window.sidecar.jar	4440	com.perl.gqm
/system_ext/framework/androidx.window.sidecar.jar	4440	com.perl.gqm
/data/user/0/com.perl.gqm/[email protected]	4440	com.perl.gqm

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

T1414

T1641.001

Processes:

com.perl.gqm

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.perl.gqm
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.perl.gqm

description ioc process

File opened for read /proc/cpuinfo com.perl.gqm
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.perl.gqm

description ioc process

File opened for read /proc/meminfo com.perl.gqm

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.perl.gqm

description	ioc	process
File opened for read	/proc/cpuinfo	com.perl.gqm

description	ioc	process
File opened for read	/proc/meminfo	com.perl.gqm

/data/user/0/com.perl.gqm/[email protected]
Filesize
300B

MD5
7c80da100acf95df2c9629e515898a6b

SHA1
28c7d9a00126bc12a0760f9cc6270abea6866d73

SHA256
ed26ed598d0393b52cb68fd71e26f7eb5fba998f72c1c30eae4622bb0752692f

SHA512
b2eb8340ae3dd3ddbe2a5cf3de6b735a33bb15b51b728f01643fed02375c8962f37fcbd4827fd578cb73678847cc47c45290d763281be5caeded67fa8923c6a2

Download Submit
/data/user/0/com.perl.gqm/app_outdex/libdexprotector.4440.so
Filesize
370KB

MD5
8aba148186257a51ed99d39762886ea4

SHA1
8d355231499bca8b0bb9f791ff68a18d084b4943

SHA256
13c5c92b9be3a499a0d67577c8c2de0b42d2bbfc89fb62425d8c84ce25012c2a

SHA512
3424fa627db7b06db8453f5fa7a7fc96639e8258ca3ebd8610c74252e9d6d2841604183a7b2e5498fe59e00f1ddb34f3d7066fc6f20640b5416b6b90b802a9cc

Download Submit
/system_ext/framework/androidx.window.sidecar.jar
Filesize
12KB

MD5
bdf3529e80318eb14e53a5bf3720c10d

SHA1
25c9ace4b1af6e80ebb2572345972c56505969ba

SHA256
bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

SHA512
48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

Download Submit