c8037e71f38e39b55c81d71b62aca6b330e2b763e54eb3c0b50dd90b71257b0a

Analysis

max time kernel
178s
max time network
182s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
14-06-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a28c89841d88c0a759ac1b022af073e8.apk
Size

1.3MB
MD5

a28c89841d88c0a759ac1b022af073e8
SHA1

45e60a8e3c957089574e9696f7298727be3c05ea
SHA256

c8037e71f38e39b55c81d71b62aca6b330e2b763e54eb3c0b50dd90b71257b0a
SHA512

d39e88852fb01018fd330a0b51581cb0c3de88e2aaf4688ba776df2403f36342e56d09cd02b509e7e826bc56f5efdbc599881ba023a414456157ef0c221efa69
SSDEEP

24576:xDmoL0otaYtXMjGcdJZXs+bS8oaPnDAUCxFMUjTo+1EjlMbq/13tdHbZKm51Ob8q:l1Q7YtkdJZJboaPDAUcFHj/ajlMbq/1u

Score

8^/10

banker collection discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.hyrc.gauv.erlb

pid process

5013 com.hyrc.gauv.erlb

pid	process
5013	com.hyrc.gauv.erlb

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.hyrc.gauv.erlbcom.hyrc.gauv.erlb:daemon

ioc	pid	process
/data/user/0/com.hyrc.gauv.erlb/app_mjf/dz.jar	5013	com.hyrc.gauv.erlb
/data/user/0/com.hyrc.gauv.erlb/app_mjf/dz.jar	5095	com.hyrc.gauv.erlb:daemon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

T1409

Processes:

com.hyrc.gauv.erlb

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser com.hyrc.gauv.erlb
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.hyrc.gauv.erlb

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.hyrc.gauv.erlb
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

Processes:

flow ioc

31 alog.umeng.com
46 alog.umeng.com
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.hyrc.gauv.erlb

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.hyrc.gauv.erlb
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.hyrc.gauv.erlb

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.hyrc.gauv.erlb
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.hyrc.gauv.erlb

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.hyrc.gauv.erlb
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.hyrc.gauv.erlb

description ioc process

File opened for read /proc/cpuinfo com.hyrc.gauv.erlb

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.hyrc.gauv.erlb

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.hyrc.gauv.erlb

flow	ioc
31	alog.umeng.com
46	alog.umeng.com

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hyrc.gauv.erlb

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hyrc.gauv.erlb

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.hyrc.gauv.erlb

description	ioc	process
File opened for read	/proc/cpuinfo	com.hyrc.gauv.erlb

com.hyrc.gauv.erlb
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:5013

com.hyrc.gauv.erlb:daemon
1⤵
- Loads dropped Dex/Jar
PID:5095

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hyrc.gauv.erlb/app_mjf/ddz.jar
Filesize
105KB

MD5
23ba0b249042b7ba33e92c0199b0ea4a

SHA1
99b13ee9f7307316c2337953fceed87e9942b794

SHA256
1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

SHA512
0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

Download Submit
/data/data/com.hyrc.gauv.erlb/app_mjf/oat/dz.jar.cur.prof
Filesize
507B

MD5
6c59525ad1e58d45715a576c7399424d

SHA1
8a4df4c33c4cc5712243529f7447019fe73ed503

SHA256
1b4ef94717ee431f294225e9b909a3e07a692e8109743561d65e1e11ac431d9f

SHA512
b1cc76365d55a2f178402fe9f3f3cd689b9916c292d3696621aa48f350aa7b2b07420e735fa49aea7537774ddb7a9a6e48ce4f09540d04f81a6c5d99d634c347

Download Submit
/data/data/com.hyrc.gauv.erlb/app_mjf/tdz.jar
Filesize
105KB

MD5
293ea5f01e27975bed5179ba79d80eac

SHA1
c5b0806a537fd1cb753e11f1a9684933317716b8

SHA256
8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

SHA512
c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

Download Submit
/data/data/com.hyrc.gauv.erlb/databases/lezzd
Filesize
28KB

MD5
dae68dcffc3d522a79f98ebbc3b6d457

SHA1
6df5dce9a50f12044a2d20b8d1742ae47b82ee03

SHA256
56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

SHA512
23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

Download Submit
/data/data/com.hyrc.gauv.erlb/databases/lezzd-journal
Filesize
8KB

MD5
3854eccbe5dbedb1ac88d5b4d864e79c

SHA1
01991d2bc82d7dd2f8256c3688f0173587e7b6a2

SHA256
58ae28a7fb62cd689557a49c43d18bfbdbc6914855b2cbb110222c0566cbe72d

SHA512
1d1d3e05a460b3479f953d27fc95a8e9475997b19447668c451cfaaf8971b1d3629100081c96c4de8fd2aa08bf06de1f53125f8ad5b4cba2f6afba78ad59d3af

Download Submit
/data/data/com.hyrc.gauv.erlb/databases/lezzd-journal
Filesize
512B

MD5
c58331a735266fadc6b4ac7f6a04f4db

SHA1
5c268ae6b15f3397806a4e14f15c776c19de025d

SHA256
fb6f5ef0e392a21d7cbfedc819eab8dba30d6a7c881146a5f3a05775a4bbb6e6

SHA512
dfe13260782fd7e0e7e87f7a7033d9fa43d11e0a2d277f5ac3fa14e8a58dd6a8a70e9417518ade2c28776eab01e6042d3170c9541e18768da71707c74c054f7e

Download Submit
/data/data/com.hyrc.gauv.erlb/databases/lezzd-journal
Filesize
8KB

MD5
22aed5392768267e8d2a10dabafe2092

SHA1
0fb220aa4792d4811af87a5c8e26b21bbd679ac5

SHA256
95c7a6fcab69b116092852adf5e5b9a82597eee0f8efdf95ebac46130766676c

SHA512
b21a7cae24ad86104480a54a670ebda8b243a2a0767a9015c578682145e390806d5a665782093e9bfda4ab6e3fbac4c61a1d06d35f4c5f4aa984d05836292597

Download Submit
/data/data/com.hyrc.gauv.erlb/databases/lezzd-journal
Filesize
4KB

MD5
912042f34400a32475208b954ac87bd1

SHA1
e8a81b84a270c801d25c54d802e12b02e219b55e

SHA256
2dea1f1eb3c24cbf7d072f754f98f17551b94ddcdf0db418bc5324eaab16da22

SHA512
3031e1dae24acd6fdb4f1b13b4ae676c906d708f0ad79a8968c7297721537c64ab6673b7b0f6161bd5f26ebb2dae05fbb73d257ef4f0eb8cb6232362a8ab9796

Download Submit
/data/data/com.hyrc.gauv.erlb/databases/lezzd-journal
Filesize
8KB

MD5
5b8519bff03ea0726fdf2cc16f8fb294

SHA1
0703a572c980f66703e6cbb29ada929b75a28495

SHA256
0704b30d8bb8f595d22afe3d6338e3f2f6f2bc3b60f990de75ff80696c7b67e9

SHA512
33540fed37f9a212851d4ae65ff4de2d68371affd0248eed6698b7e3ecf189d833cf6197c14892f9aaa97e4016d7312fb420d2a789ece17a5454ceac4e968427

Download Submit
/data/data/com.hyrc.gauv.erlb/databases/lezzd-journal
Filesize
8KB

MD5
a1966dd9525b802c3682bb282f8f3c01

SHA1
3cf1c61a16c60001c120a0f9b75af3e6250ae13e

SHA256
ed2c4fbf2dffe45089da065694dbb4f4ffb55e41b89f01598872b239f877b35b

SHA512
51947932fae59a123da334c5d40aeaa571eb8b899ecbe8c3b283425c3fca8ad951d2cbabd338fb91749ce660bf788d698af3595aa0edde327e4a8ba2b8548acb

Download Submit
/data/data/com.hyrc.gauv.erlb/files/.imprint
Filesize
944B

MD5
d1c9cc968b51db99f2de0b52e556c85c

SHA1
50339aa80a2050fb01c30bce10c3514db8c7d1fc

SHA256
8a3ece7f7369d5a0fd709748c55f5b38a4b5b245a863a772e2425652e1f804a5

SHA512
49d906623e3119456563c8a9bc2435daf78accacc09db1a4b694d10647d5bb1c4992eeb2aefe6d32524b2aa05210e78e1829b6a21a77b6ca50741f25122516b4

Download Submit
/data/data/com.hyrc.gauv.erlb/files/.um/um_cache_1718332449828.env
Filesize
1KB

MD5
0868e88403a5cf1ac1aae6c0419dc8c6

SHA1
b3017a38e6299ad15c77ee7215e743bc104129b8

SHA256
5f38ad3d7a38233bdb64a218d8e5630a408ea2e89552ef4ace184e8c1c22c5b6

SHA512
af68789e9972461b165b1e10409be9719271aea94e178e36385e530bd8471fa38b70856ddde9ec2376ebdd0e8d68655e3b27c5ce3e9a57c051ad05c60a4de364

Download Submit
/data/data/com.hyrc.gauv.erlb/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
82f4d008705cdb6fb9a17c03635f727e

SHA1
005738962d7c4313526d966dadc53557bcc15578

SHA256
c6a06b386a7b901eebcf7f105bbb6b43222137604ba651237ff1c94791e7de9b

SHA512
7a7137a0c8b350b94364f6c001fec33661d577d9625e4d02e16b81252a103e75726a38f6b0ab12b6bf5a6dcff252ca38a80fe1304b33bd00c3078f26883d742c

Download Submit
/data/data/com.hyrc.gauv.erlb/files/.umeng/exchangeIdentity.json
Filesize
204B

MD5
8e624a2c9f96586e0f3f4ab5cd99ce57

SHA1
243c8a87adbd23f6d7537815c83751cf2fbd3851

SHA256
f0a6528c4e3881e67e8123eca0b65b21ee6a80377402bb7cd91ac06f2a7819b1

SHA512
d2ad21c45b02b1cfaaf206f0fc89f6a76d7a2ddb6b03e702e5eea8a972e52b1c7dcf3b742e54a731e436fe8557e8009fbff9fa01abff55e71b7c38c5bb7e5fcf

Download Submit
/data/data/com.hyrc.gauv.erlb/files/umeng_it.cache
Filesize
352B

MD5
ccbaa5d6726f91182fc7248ca6413d73

SHA1
045d0f00d4eb9ed2fdc7d3bde87b3a37626952a6

SHA256
99f942d4e35722414011d09ed71dd9208c5c3da538674c0db7be6ae60abed28b

SHA512
69b4c3295b78ece52c6b60422e1b81a7c1a9791f7f1984efbbe9aa8247958ce95f494883a1ffb38494e6ad552da86ae2172d537b16d62fc810aeed335683923b

Download Submit
/data/data/com.hyrc.gauv.erlb/files/umeng_it.cache
Filesize
179B

MD5
8116ea3ab4736acc082879771e275cba

SHA1
2c90a341934cd3e7f865f7c53847b9b02c652122

SHA256
2ebf5868baf84211ce4df34bf54e59f424e02bad069be8d5b8de79f2e8fba248

SHA512
ac2089b86cad7c519622be8245e59f3db1d43537b04a6d33414f52396eeb9cc5519d4a659e1943278e212786c733e4c84c8e7acc329c84a0c574475bc0055b7f

Download Submit
/data/user/0/com.hyrc.gauv.erlb/app_mjf/dz.jar
Filesize
248KB

MD5
a54a18b58c6720991c021f433dfb2a46

SHA1
d2ffa07919f92b6e04914e39843f08fdb2a75b68

SHA256
3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

SHA512
e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc

Download Submit