f3abc39f34f77db6ee8b89352354b08a67c9fbb4f6da8a3974c9a3bee681366f

Resubmissions

13/08/2025, 18:10

250813-wr2xhsfj417

01/07/2024, 13:58

240701-q9152syflr

21/06/2024, 00:30

240621-atq25stcpg7

Analysis

max time kernel
155s
max time network
152s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
21/06/2024, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DonCP.apk
Size 28.5MB
Sample240621-atq25stcpg
SHA256 f3abc39f34f77db6ee8b89352354b08a67c9fbb4f6da8a3974c9a3bee681366f
MD5 f43de22b95409b38bbd453c9b5b5faeb
SHA1 523e66110bd7fc0e6b4080e9db1d36553278abe8
SHA512 fae7a457e4b2cc8e686d08b6ec082282b8545cd9d462344e84df1ab492035c3872b137119860a5dc87ca6dc583c252cf837ddeaaa445ba6b455ab39afe8b701f
SSDEEP 393216:p2OychkbRrvfJehigbytVUNLe/tu99lkNRPwMdB74mWDNGYW9hOimPM23a//aqg:UncYZfJeMVUhe/ATkbPb4nQHhaLang
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/don.cp/[email protected]	4443	don.cp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	don.cp

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	don.cp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	don.cp

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	don.cp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	don.cp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	don.cp

don.cp
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4443

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 6a8e56c9fc62da66b7c247245446679f5b13ce68b3399889755d6acdfcd09e3d
MD5 5c9709ac9039eff4ef239cae84f263fc
SHA1 45388ace423ed47c7b5bb49d4d6de7ba2458ae4a
SHA512 4996641cc3476284a9be207f5d7ea38fbe81a4706e0d1cf08299a9651cdab528e2625bdcb41c4c444cc233fb6ff308b062feab49d229c6f810a19fd665d22b81
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6p:TLiEq9zmzrfRmBEyPbP/P+/0Fl6oEh57
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 b4c2164a59ab94859fa7defce713dc2f225f5cc634a17b1abea574fa51fd6ca3
MD5 4fa3bb7cda72bf2c1f7656a3f1d27f38
SHA1 ddc490fd3078b9c72848faf8bf2ad94204067bcb
SHA512 2ddef29c16f2f924d6ccba45153a8a5aec2077d9a4b009687c3c0771f20e4c2d775e88c687d5de2677753db0fd228ac3878fafa03a0675a4f81b54d8743acc47
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlUgIE5/+/0Fl6oEh57:TLopmzr0GSP/h1499FvNlF0n
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 c9c951f305281b1b3249e00ca8301e3596926d59a43117f90aa78850774fc0ff
MD5 64443afbed65e1f08ffb4b45f62a343b
SHA1 16b855cb48982de5208b996139df23060642bef7
SHA512 18cb5a40cd0c6de55352ef68a1ba98eb4b72ff62587836dd5ab80adba746e73612c30eeb104e256290a3771556cfce2ab5b674463e3ad3697b33315d85190502
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/6cOLaJBzOAUv+Wl5HLpIGbf49blqYFlUgIE5/+/0Fl6p:TLYpmzr0GSP/6cKajzO573499FvNlF0n
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 5c6ab02e860f0e86b207c15ad68968edb7ce5d357633e67689a22393be2aeb35
MD5 9bc12adf21ebf60252a359bd3cb5aded
SHA1 184684e3c9aef321478e43dfdff3f9e9b9d4e4e6
SHA512 8b4e022aeaf98a792018d17f94667d630452f2c5d614fe2e93c319fd419ec67a0392d52f0349ebc5091ff6057013629b005b9016eb0bc6a128f29d295aac8d58
SSDEEP 24:TL6vpmzr0GSP/wYcKajzO573499FvNlF0T:T2vArSP/wYZa3O57o5vR0T
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 f00dd7ab3d95c4db3dfc7ba1955cc4fe3ff794dfdf1db9ca4a60e27eaf987d80
MD5 231231998750c26480534554ad0db473
SHA1 774656a2f7d203d86bb3058fab4659f925915bc0
SHA512 62f854afa1d5175139c10131071930b2ce6b90a3251070028128b47dc0d1d3f68164afa689239c301e5bf91b452cc8900ecb4dfd1d636a00287610c9880722f2
SSDEEP 6:l9bNFlkls16/nlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wkm7l:TL6E6v9zmzrfRmBEyPbP/Wkil
MD5 SHA1 SHA512 SSDEEP

Submit Download