f3abc39f34f77db6ee8b89352354b08a67c9fbb4f6da8a3974c9a3bee681366f

Analysis

max time kernel
171s
max time network
162s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
23/06/2024, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f43de22b95409b38bbd453c9b5b5faeb.apk
Size 28.5MB
Sample240623-eev5rssfpp
SHA256 f3abc39f34f77db6ee8b89352354b08a67c9fbb4f6da8a3974c9a3bee681366f
MD5 f43de22b95409b38bbd453c9b5b5faeb
SHA1 523e66110bd7fc0e6b4080e9db1d36553278abe8
SHA512 fae7a457e4b2cc8e686d08b6ec082282b8545cd9d462344e84df1ab492035c3872b137119860a5dc87ca6dc583c252cf837ddeaaa445ba6b455ab39afe8b701f
SSDEEP 393216:p2OychkbRrvfJehigbytVUNLe/tu99lkNRPwMdB74mWDNGYW9hOimPM23a//aqg:UncYZfJeMVUhe/ATkbPb4nQHhaLang
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/product/framework/com.google.android.maps.jar	5140	don.cp
/product/framework/com.google.android.maps.jar	5140	don.cp
/data/user/0/don.cp/files/audience_network.dex	5140	don.cp
/data/user/0/don.cp/files/audience_network.dex	5140	don.cp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	don.cp

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	don.cp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	don.cp

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	don.cp

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	don.cp

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	don.cp

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	don.cp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	don.cp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	don.cp

don.cp
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5140

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 44102e4e5c5fe45adc2c15cb37a0bd9ef797f18a4a23f8cb32ca306e21323804
MD5 0ee91aa4f6879ce2bdeb880aff69540f
SHA1 b59dd5c74269e0e57f5ee908ea2087d6119ea597
SHA512 b099b0716a5cb9c9cac4198711e6f82c3b942a5b3b8037860194e06325e558c23cc03ca90b4df2bd41e22d64874af5597d08c1bedb8748185935fc458f458c1e
SSDEEP 12:TLiEy9zmzrfRmBEyPbP/P+/0Fl62/pXX7:TLApmzr0GSP/PlFbp7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 d30fde254549d01f7047989b4121c84b8d93eb20c83487fca3398994a4d231b4
MD5 fe184eaca6aba88ca0d31759bc7b60f2
SHA1 40d1bb27d78372521bc63fc887bc2e0c22b34296
SHA512 d1a18ad6a9abc0765b59fc183a1f4d654a1b3f61cdf09950a3d456c71c3b6de45022badb90c2e8e8a392307095ff775e96002a8da9fe9cec9366124a646b0004
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlAQtWg+/N+/0Fl62/pXX7:TLQpmzr0GSP/h1499FCfNlFbp7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 1220753117754a1c96893ef5537db74a7bad17c3c6d9bbda1ee8517b7cc8d039
MD5 69eaea3c59e2a4c82f680b7bb2c4b468
SHA1 85dfec8dbbcba36191969d09b3d7fedb568a29e9
SHA512 50de6209221719a8a5623a1aece98ea36f1a4fe41d55052fd1d832e9aae4f8ee5521ac047ad74f33ab77608670130f828543b40ceb69667526493a2e81366634
SSDEEP 24:TLEvpmzr0GSP/6cKajzO5N499FCfNlFbp7:T4vArSP/6Za3O5q5CfRbp7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 5a1940306cc21528bc7d5905a5e78fa15ba3c0e71514543d9cc90b19e1413cc4
MD5 d5372433c9c4fb7f19dc8a104b7bd7fd
SHA1 8e0794a9f62c42d8e6483e59131e2dbf798de3bf
SHA512 bbc05d97a16fbbe133da259905d28f8d2477a8b4d3bc1c8349445b1372d61d0a8e2a26961ee2ac8cf08243c21ef4cf91cd6b800815df6fbd880776b3ca9a4cbe
SSDEEP 24:TL6Xpmzr0GSP/wYcKajzO5N499FCfNlFbpv:T2XArSP/wYZa3O5q5CfRbpv
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/don.cp/databases/google_app_measurement_local.db
Size 16KB
SHA256 0aff5457949386394329e2858fca0157ecd8fafab2cfc429f839124e9c84e02b
MD5 baa9968525aec519ea41d97dd0f35693
SHA1 0f71fc02fbe8ac12f47c5f2dac44f7c42fc583e0
SHA512 589b88fe6bf774011782fc8b9580795cd4e467cb59eb05636a6a18b234e48974d5bf872d861e024adf38d149f0256d602223e3be754354afe7355158cc33231d
SSDEEP 6:l9bNFlkls1KlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wkm7l:TL6EK9zmzrfRmBEyPbP/Wkil
MD5 SHA1 SHA512 SSDEEP

Submit Download