Analysis
-
max time kernel
27s -
max time network
148s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
-
submitted
14-06-2024 00:30
General
-
Target
8d07e9af2b8fc4704b7bc78b1edbfce404f2f82a705daf61c0db4776d49dd82a.apk
-
Size
2.7MB
-
MD5
60b6a142a82773575f5649ae05c84b81
-
SHA1
42e322480bad36d9b72266b991d57b030a6cf025
-
SHA256
8d07e9af2b8fc4704b7bc78b1edbfce404f2f82a705daf61c0db4776d49dd82a
-
SHA512
852a296e86c0bc5fd9ae482d61c83b4a4a0bdc522c2fdec3ff09ad7c14ec99d6eebcaedecd8adf4544da674a7c4371cd2030b72b0c231ec8c0098f03839eb06d
-
SSDEEP
49152:q0uQ4bML5/mZ1IDwlY4pKggLDHUTwtR7g8lzfr+EYV:qjA4PIElxwgOH1txzfr+Eg
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.perl.gqm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.perl.gqm/app_outdex/libdexprotector.5012.soFilesize
370KB
MD5ba508d854161f2c118dd4cbda78f0d3d
SHA195bb103c31bb296f00e523c704bd73861cb92b75
SHA256a313c530165a8a7db870433a8e70b29d6d5feed71900fd65191b36c99d9ad057
SHA5123b878d4c5db8dbc91ceb41ece44923716e8ef0bd8e7044f3168749c760d2596663ad08a0d40dd870f6d407169141f8ef665c0261f80eddc2de81627377500f46
-
/data/user/0/com.perl.gqm/[email protected]Filesize
300B
MD57c80da100acf95df2c9629e515898a6b
SHA128c7d9a00126bc12a0760f9cc6270abea6866d73
SHA256ed26ed598d0393b52cb68fd71e26f7eb5fba998f72c1c30eae4622bb0752692f
SHA512b2eb8340ae3dd3ddbe2a5cf3de6b735a33bb15b51b728f01643fed02375c8962f37fcbd4827fd578cb73678847cc47c45290d763281be5caeded67fa8923c6a2