f3abc39f34f77db6ee8b89352354b08a67c9fbb4f6da8a3974c9a3bee681366f

Analysis

max time kernel
134s
max time network
178s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
21/06/2024, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DonCP.apk
Size 28.5MB
Sample240621-bak78ayanq
SHA256 f3abc39f34f77db6ee8b89352354b08a67c9fbb4f6da8a3974c9a3bee681366f
MD5 f43de22b95409b38bbd453c9b5b5faeb
SHA1 523e66110bd7fc0e6b4080e9db1d36553278abe8
SHA512 fae7a457e4b2cc8e686d08b6ec082282b8545cd9d462344e84df1ab492035c3872b137119860a5dc87ca6dc583c252cf837ddeaaa445ba6b455ab39afe8b701f
SSDEEP 393216:p2OychkbRrvfJehigbytVUNLe/tu99lkNRPwMdB74mWDNGYW9hOimPM23a//aqg:UncYZfJeMVUhe/ATkbPb4nQHhaLang
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/don.cp/[email protected]	4670	don.cp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	don.cp

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	don.cp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	don.cp

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	don.cp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	don.cp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	don.cp

don.cp
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4670

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 2a81fbefc6e6f010c7dc8ace64bb883364340eadaa86f37aa0ea17ccc27afba9
MD5 796a258bf36185585349e0f8f41b2a23
SHA1 7c9c9f0f7276fab99a824aeddf68eea40fbf1054
SHA512 f7d30355eca07e4562933b1ef4a0789d83b4a7df4e77f8f0ed8fddbbf9e6a1ee84e622fe18a93ae29cc88b8d4eb2fea0513ebcaa19fc5e5368d7e0c3597a45a2
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6h:TLiEq9zmzrfRmBEyPbP/P+/0Fl6nh7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 9940c7d8741b6127dcd73a47cb3278f69f932ace3416e86b789b13dc67e279ff
MD5 405d6f3efe1c40e80e9530d69389a46f
SHA1 489b2efc685cec3cace1ee8ab229045e646124e5
SHA512 1d79156311a86fc38c301f8b313971f29523b1a3177983fa3ec9d698b7106b70e478ccff8b73e68e443bdea7b095e3f03ffd8ca2ee7fa9583c2fc75bc90d585f
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlc8V+/0Fl6nh7:TLopmzr0GSP/h1499F5lFI
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 34ecda915d4912213c59bb42dc2bbde3f9def0f62325780723a940ba4a39135b
MD5 eda158689fde82b9e46f32fc93b80ea7
SHA1 51e3bfe5f348395967437047a87f8a4f17136a17
SHA512 b154ffbee1a2c3c9b3bf516ea2d680e08252fec2c625550f18d5c97be7701bf624b7f0bb225ac3d912bae073d530ad1d338276561672cfe04806d0eb74fec38b
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/6cOLaJBzOAUv+WlcEga49blqYFlc8V+/0Fl6nh7:TLYpmzr0GSP/6cKajzO5F499F5lFI
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 4169d2536e8807f737bbdb10d4dc1831a03f6ca4f3acc7f90f0ffd83e88fc450
MD5 c9af444ab0a07d3ee962be6bf18aaa06
SHA1 9d6456f2bf2d47448b567bd1c1f59715ec4da5c8
SHA512 36bed7e60e03798769b83ed5bc26baa36c5696eeb440b5616cacac0feb603f72db2efba1d5584f3842f67f5a398ef15d918fab65d13f79db43cea01dd1214977
SSDEEP 12:TL6uER9zmzrfRmBEyPbP/wYcOLaJBzOAUv+WlcEga49blqYFlc8V+/0Fl6nhv:TL6vpmzr0GSP/wYcKajzO5F499F5lF4
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 d5c585122af69f9b2fb00997f0230663cced3f1dce963e77a2fc004277897186
MD5 c313b41d320cabbc0da65e2650b6f34e
SHA1 3c7f321f099e29c4b43f3aee9b8dc3ab8931a405
SHA512 a5bc4dfbf3ad1100736ba6beccd69cb464f01041d8662cc4275d6fc50806bc25d15cbd65f4e7ef1c0444c0897c764e197e3d4af017b08b928b7e923f9b0bcfcd
SSDEEP 6:l9bNFlkals1FnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WHPrP2a:TLCuEJ9zmzrfRmBEyPbP/WHD
MD5 SHA1 SHA512 SSDEEP

Submit Download