3ce3c11a0013f24a1a828d2dba7c40b08d05f118de18b5a45863f64d10230393

Analysis

max time kernel
80s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
14-06-2024 00:33

Target

3ce3c11a0013f24a1a828d2dba7c40b08d05f118de18b5a45863f64d10230393.apk
Size

2.6MB
MD5

352f708f951160dff8c913cfd9a60f8d
SHA1

2664829957b96603a0763c37d411c38b708f640b
SHA256

3ce3c11a0013f24a1a828d2dba7c40b08d05f118de18b5a45863f64d10230393
SHA512

6792413f301f7bd3c4be9129de63da904578291f0c482ad5e680d71f3ce82481b9c65a5269d52d44c3a9c8c19e17015ec0fdd0cc02a14f7fa2e5afd16ee4657d
SSDEEP

49152:4GJjI0iNNpX8iI2Fv9KE4HeyL/lgn1DS643pkg8/Qzfr0hl8X:bIZZFvi+Qgn1DSHzfr0h6

Score

7^/10

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.perl.gqm

ioc	pid	process
/system_ext/framework/androidx.window.sidecar.jar	4429	com.perl.gqm
/system_ext/framework/androidx.window.sidecar.jar	4429	com.perl.gqm
/data/user/0/com.perl.gqm/[email protected]	4429	com.perl.gqm

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

T1414

T1641.001

Processes:

com.perl.gqm

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.perl.gqm
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.perl.gqm

description ioc process

File opened for read /proc/cpuinfo com.perl.gqm
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.perl.gqm

description ioc process

File opened for read /proc/meminfo com.perl.gqm

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.perl.gqm

description	ioc	process
File opened for read	/proc/cpuinfo	com.perl.gqm

description	ioc	process
File opened for read	/proc/meminfo	com.perl.gqm

/data/user/0/com.perl.gqm/[email protected]
Filesize
300B

MD5
7c80da100acf95df2c9629e515898a6b

SHA1
28c7d9a00126bc12a0760f9cc6270abea6866d73

SHA256
ed26ed598d0393b52cb68fd71e26f7eb5fba998f72c1c30eae4622bb0752692f

SHA512
b2eb8340ae3dd3ddbe2a5cf3de6b735a33bb15b51b728f01643fed02375c8962f37fcbd4827fd578cb73678847cc47c45290d763281be5caeded67fa8923c6a2

Download Submit
/data/user/0/com.perl.gqm/app_outdex/libdexprotector.4429.so
Filesize
370KB

MD5
812119459a3e2875e25e865b114a4ed4

SHA1
52d9e1aac06ae84dfc0602ed4a15ef44bac94f03

SHA256
90b1e73045d51b8c0618ce86d89ee9ba5bc474c0ee9ea81b5139f9ff78d7cf93

SHA512
2d3e4f42144718ab30e215e129b7b05697fb59a5ec07886bed40ac7aef8e0c409055ac2555efa875a024fd454448d29c11d4f34e39d1c195dc50d0aa70d5c965

Download Submit
/system_ext/framework/androidx.window.sidecar.jar
Filesize
12KB

MD5
bdf3529e80318eb14e53a5bf3720c10d

SHA1
25c9ace4b1af6e80ebb2572345972c56505969ba

SHA256
bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

SHA512
48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

Download Submit