19e20c9809cc61b1d4231cb0c3156b1a12b7ec14f9825e9fa2f8fd1eac359c08

Analysis

max time kernel
178s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
16-06-2024 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flash-Browser.apk
Size

1.0MB
MD5

fa890c9400cfc5c3d96ecbbb46474daa
SHA1

cf0ce6fa8d5d239a3ed75ed30b7b4b21143837dc
SHA256

103a5aab1fe5ea809ad10bf9a2bcfc1bcc2542ad4cbbe894e67b536a8700f134
SHA512

50d542c1594821d01ad8ce6cde37789d34ac677c61de59ba44b9f98b46b9068ed1a1a1d36d4e6872532527af47289667f7650be6b3b4d3a7420ad3dcbabc3d91
SSDEEP

24576:H3Goet2CUaliwt73v8GLRJINNrkhocABhJLkHOOqNjc:H3GSCUq7pRJANwwnpm

Score

7^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tech.browser/app_ttmp/t.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.tech.browser/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&com.tech.browser

ioc	pid	process
/data/user/0/com.tech.browser/app_ttmp/t.jar	4297	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tech.browser/app_ttmp/t.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.tech.browser/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tech.browser/app_ttmp/t.jar	4267	com.tech.browser

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.tech.browser

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.tech.browser
Reads the content of the browser bookmarks. 1 TTPs 1 IoCs
collection

T1533

Processes:

com.tech.browser

description ioc process

URI accessed for read content://browser/bookmarks com.tech.browser
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.tech.browser

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.tech.browser
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.tech.browser

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.tech.browser
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.tech.browser

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.tech.browser
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.tech.browser

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tech.browser
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.tech.browser

description ioc process

File opened for read /proc/cpuinfo com.tech.browser
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.tech.browser

description ioc process

File opened for read /proc/meminfo com.tech.browser

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tech.browser

description	ioc	process
URI accessed for read	content://browser/bookmarks	com.tech.browser

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tech.browser

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tech.browser

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.tech.browser

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tech.browser

description	ioc	process
File opened for read	/proc/cpuinfo	com.tech.browser

description	ioc	process
File opened for read	/proc/meminfo	com.tech.browser

com.tech.browser
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Reads the content of the browser bookmarks.
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4267

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tech.browser/app_ttmp/t.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.tech.browser/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4297

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tech.browser/app_ttmp/oat/t.jar.cur.prof
Filesize
361B

MD5
1f00ac868da3c6c402c1e2f7a5f28d33

SHA1
4986fdaf39b009ef69a4239f6d08de48c8f7997c

SHA256
4ace29158538e419cd1361ae3bf70be8d6117c18f2a26be92f00fbc4335bb052

SHA512
2e08991127f4c85080c1f7efb877bc6d615344f70d4310698febe7db7902dceee4067be12ec64c125a21a1c9d77ee1298cedaae310678501848013edd6a02de5

Download Submit
/data/data/com.tech.browser/app_ttmp/t.jar
Filesize
172KB

MD5
39f7c5d4a7962708aa7d98bf2fadfc27

SHA1
cb348f750596b2e54705eb7d20b9fb2cc9d8807f

SHA256
e303dc3a3e31e4d525840e20486b6a99821e330b75c11e61c0f78d56f5dd9558

SHA512
55267b2721b056f9dab24c9f29df40db648cc3bd2eef0f4464da5545e6540f3f18cd8cdd9b7e7c77fe7a4fe37a08eb1bde482edbdd7eb364dd840f7f83740caa

Download Submit
/data/data/com.tech.browser/app_ttmp/t.jar
Filesize
172KB

MD5
cf9c7fb39d30b43019bfac428a3269ab

SHA1
912d7b2f83d9d0eae24d5b4cf1a5033cd2b8a283

SHA256
9031644073855d5bc7ad4ac8f211b472c7b52b8a5b743e85b40d1864f95a09af

SHA512
2450ac53f0f2ecec5d32ce0fb90ce4ed051d25319965d6758d90e0ede8cc813d445911e7511f140510d3ed19390a1effb9c1758861a95cecde8760abe127590f

Download Submit
/data/data/com.tech.browser/databases/com.tech.browserb-journal
Filesize
512B

MD5
7a6d1a54fa1b88c2be76eb61f5ef1ce0

SHA1
a55cc606dd2a8f842c1da7207828dc3a590552d8

SHA256
4ba8b0ed090ef8c17ce727b37150e7eff122b8ccc3f5d7899bcb2278a7611043

SHA512
b018647001f7831aaa21a3d83d8e4083cde38342c31f7693df3f1c7e2a7c4be59def5c8a0211259e75006be335983e936a0ace7af1b80721786c4725aab9eaa3

Download Submit
/data/data/com.tech.browser/databases/com.tech.browserb-wal
Filesize
84KB

MD5
fcbf6a6a4538f6dada5f7aebd29f29ce

SHA1
ad7b08bc634a2269ecf49ca76ce08715319d00b7

SHA256
b595a21e27f6f1377e8389a45ae4d57d4602b63977385730fd3a765ca5f34bf9

SHA512
70ca1b13caae833c81f77d9f28bdf21944120901ef10626bff26875567583dd8a6b8910aaf4831d71ff7ddd964a320bb769666be8ccf52456b1ff38bda699338

Download Submit
/data/data/com.tech.browser/databases/historyManager
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tech.browser/databases/historyManager-journal
Filesize
512B

MD5
4629cb59fde2158df4ca711207aec810

SHA1
505cc43fdb664744cfb2814c034a543a2c886260

SHA256
40575dc5e72e41a15a9ae1e2344e615a22377ea6e68f58f78847f56fb77e8258

SHA512
536de2e368668bae5cb3eef10f1b785c10c8335ec6517afc9f2b0cb88e0bab17872f0fe0934193378608bcbf5e4297d1742f293d80c20d987c28b5b26aa0faed

Download Submit
/data/data/com.tech.browser/databases/historyManager-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tech.browser/databases/historyManager-wal
Filesize
32KB

MD5
e8c45449961c676c072251264455bf32

SHA1
ad549133ddfa5201c655b8428216140f09e4c64d

SHA256
9e43593cef2cc824d53a7e473a8f333e5671e6ef5631314add486ecbf294681b

SHA512
d50a86cde9bd053405dfb8b78b36d6a2f5a4664a833ff3ddface6c1a5f1a4482ffe4e661b1b508e5266aac63ad8180fe72022bbb751cbff2c75d5eee8c060286

Download Submit
/data/user/0/com.tech.browser/app_ttmp/t.jar
Filesize
363KB

MD5
4d50d49666dd4a7aab4ba4c4152abbd4

SHA1
b0ed22f4b8b27c2c20bf081eaf7f95a9dfd9cdfa

SHA256
67ee73418973fbe2d071df13f4e340c8951157a1594914b987605df034063963

SHA512
7979989b4a22c23d175052478c75c9884f51f85fde38dc440c42a76202e81bf51622fa9fd44a58748c0b562111cb54fd8e4fc0aac702b506a58ced2db2e680ff

Download Submit
/data/user/0/com.tech.browser/app_ttmp/t.jar
Filesize
363KB

MD5
71f79ba9526f0b6a04ff423212d75238

SHA1
ff505b3673f566a812ae925acc84157a1b6f34d7

SHA256
ab9672e93263e2459e8381f5216b8d8ce928c7bff5fd74cca8ae6f32977e557f

SHA512
b8df08dabb951a4881c0bb7cba6b80b76eeef9776fff51730daa8672f0afb6fa514b9c8bb8981b93db698698a83b77391e16aa612b55cf1150d6c18881aa2253

Download Submit