Analysis
-
max time kernel
49s -
max time network
151s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
-
submitted
14-06-2024 00:22
General
-
Target
681746480927bb0ea963274be95e56ffc5f56aa447003394b40bd9f2f094599c.apk
-
Size
3.2MB
-
MD5
5980eb10e48de34b102deff85d574be0
-
SHA1
611f659aaf6cc2ae139ca857b8a80e4a118aa0cc
-
SHA256
681746480927bb0ea963274be95e56ffc5f56aa447003394b40bd9f2f094599c
-
SHA512
c1ae0a18f674fc2d3c802d3224ccfaaba65b40596107e4b1b098a47be99ba8ecb070ecf03d1202880a5d2eaf9b00b88836e2b33b6e5043b8257d7e1318c3a7c2
-
SSDEEP
98304:yWJECs296ETOp2VgUk3XH2ZQvUzfrivHlA:yW6Cs2IwUkkHH08W
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.perl.gqm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.perl.gqm/app_outdex/libdexprotector.5032.soFilesize
370KB
MD593716cc80bb61aeab2afbbdec51ccbb1
SHA1066efb5f0c4a68520561bdb5691a3e3fbe8e8e2d
SHA256422bb97f93c6e69c43d0e47267dafc0a043ab3ae7cfbfd1930b56f6fe4353861
SHA51254718505600be76cd334d93c221faa10ae1fc14a7acea5d8ee1e0c1b56e40ba642c01b977c7c9cbeb81b98818f040f60227dc22738841ea9df9dac922ff3198b
-
/data/user/0/com.perl.gqm/[email protected]Filesize
300B
MD57c80da100acf95df2c9629e515898a6b
SHA128c7d9a00126bc12a0760f9cc6270abea6866d73
SHA256ed26ed598d0393b52cb68fd71e26f7eb5fba998f72c1c30eae4622bb0752692f
SHA512b2eb8340ae3dd3ddbe2a5cf3de6b735a33bb15b51b728f01643fed02375c8962f37fcbd4827fd578cb73678847cc47c45290d763281be5caeded67fa8923c6a2