Resubmissions

26/06/2024, 23:09

240626-25grdsscjk10

26/06/2024, 22:32

240626-2fzkxaxgja10

Analysis

  • max time kernel
    116s
  • max time network
    1055s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    26/06/2024, 23:09

General

  • Target
    0e30948b3327a093bd7b35a10f65bc1f03a9b8d1d3e242dd6b5726e9136aaff0.apk
  • Size 16.0MB
  • Sample240626-25grdsscjk
  • SHA256 0e30948b3327a093bd7b35a10f65bc1f03a9b8d1d3e242dd6b5726e9136aaff0
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.apkpure.aegon
    1⤵
    • Checks if the Android device is rooted.
    • Checks Android system properties for emulator presence.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4272
  • com.apkpure.aegon:accessibility
    1⤵
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4506
  • com.apkpure.aegon:accessibility
    1⤵
      PID:5552

    Network

          MITRE ATT&CK Mobile v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          StartApp-d6864f2502af7851

          • Path /data/data/com.apkpure.aegon/databases/StartApp-d6864f2502af7851
          • Size 4KB
          • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
          • MD5 SHA1 SHA512

          StartApp-d6864f2502af7851-journal

          • Path /data/data/com.apkpure.aegon/databases/StartApp-d6864f2502af7851-journal
          • Size 512B
          • SHA256 17f39cc17b13809f20f157c47537f079634b951da964fa0bb3929a4e367a9117
          • MD5 SHA1 SHA512

          StartApp-d6864f2502af7851-wal

          • Path /data/data/com.apkpure.aegon/databases/StartApp-d6864f2502af7851-wal
          • Size 28KB
          • SHA256 fee848c6ab1ca234418897abd9e04c5a0d306bb3be43d34075eb143777aa586c
          • MD5 SHA1 SHA512 SSDEEP

          com.google.android.datatransport.events

          • Path /data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events
          • Size 4KB
          • SHA256 d4700de8c86dd43443edf7764854d3c7d94c2cb4f5fe484582389dbc9a711e68
          • MD5 SHA1 SHA512

          com.google.android.datatransport.events-journal

          • Path /data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events-journal
          • Size 512B
          • SHA256 bf005511349dc8d4c989abb9656f937ef44a30096c3a906eca29c1387701db8d
          • MD5 SHA1 SHA512

          com.google.android.datatransport.events-shm

          • Path /data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events-shm
          • Size 32KB
          • SHA256 320a16e2bf685cc7acf80df70fe4eac95ff41bbd77fadf994cb45091ceea565a
          • MD5 SHA1 SHA512 SSDEEP

          com.google.android.datatransport.events-wal

          • Path /data/data/com.apkpure.aegon/databases/com.google.android.datatransport.events-wal
          • Size 52KB
          • SHA256 01808ee59c3232666799d4ca69cc4feb717826cfad147c4f9a299ee8afd4c8ce
          • MD5 SHA1 SHA512 SSDEEP

          downloads.db

          • Path /data/data/com.apkpure.aegon/databases/downloads.db
          • Size 4KB
          • SHA256 9cbd755d9f2dd4b1b0362ba4eefbd66c31cf75459464deb1ac54c22636df8c33
          • MD5 SHA1 SHA512

          downloads.db-journal

          • Path /data/data/com.apkpure.aegon/databases/downloads.db-journal
          • Size 512B
          • SHA256 da376eb0537b62c21c991b776a0f83b4da8c6b1bb755b1702a56c8d9fd1c5d4d
          • MD5 SHA1 SHA512

          downloads.db-wal

          • Path /data/data/com.apkpure.aegon/databases/downloads.db-wal
          • Size 140KB
          • SHA256 d341fe27f5560656059a79b1443c516081f2206699490063a1be177fbfe8ae23
          • MD5 SHA1 SHA512 SSDEEP

          google_app_measurement_local.db

          • Path /data/data/com.apkpure.aegon/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 e094e920a98b6c3135c1c9d686834524a1d96286e32e10a1ee9805747eb483b9
          • MD5 SHA1 SHA512 SSDEEP

          google_app_measurement_local.db

          • Path /data/data/com.apkpure.aegon/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
          • MD5 SHA1 SHA512 SSDEEP

          google_app_measurement_local.db

          • Path /data/data/com.apkpure.aegon/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 60b3ab9158795da93f72e7722a71865ea796d7af8220a7590efffb21a1d3851d
          • MD5 SHA1 SHA512 SSDEEP

          google_app_measurement_local.db

          • Path /data/data/com.apkpure.aegon/databases/google_app_measurement_local.db
          • Size 16KB
          • SHA256 f451678afc3e456a0705cb86131181ff8f3d60777b41c480586c45f33385a6d8
          • MD5 SHA1 SHA512 SSDEEP

          google_app_measurement_local.db-journal

          • Path /data/data/com.apkpure.aegon/databases/google_app_measurement_local.db-journal
          • Size 512B
          • SHA256 ed83fce7cf44283920efff58a4f2a0af1fec11585f933cfec28426f1a56950a7
          • MD5 SHA1 SHA512

          google_app_measurement_local.db-shm

          • Path /data/data/com.apkpure.aegon/databases/google_app_measurement_local.db-shm
          • Size 32KB
          • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
          • MD5 SHA1 SHA512 SSDEEP

          google_app_measurement_local.db-shm

          • Path /data/data/com.apkpure.aegon/databases/google_app_measurement_local.db-shm
          • Size 28KB
          • SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
          • MD5 SHA1 SHA512 SSDEEP

          google_app_measurement_local.db-wal

          • Path /data/data/com.apkpure.aegon/databases/google_app_measurement_local.db-wal
          • Size 4KB
          • SHA256 46c174c3576bbbcbd093a70b72a0af120660ad17df7d9209a99ad8de81fe62ab
          • MD5 SHA1 SHA512 SSDEEP

          google_app_measurement_local.db-wal

          • Path /data/data/com.apkpure.aegon/databases/google_app_measurement_local.db-wal
          • Size 36KB
          • SHA256 46af83d2252be93275a6eeb2f3747990213f285758fd9af87c806beebc9b00e4
          • MD5 SHA1 SHA512 SSDEEP

          google_app_measurement_local.db-wal

          • Path /data/data/com.apkpure.aegon/databases/google_app_measurement_local.db-wal
          • Size 4KB
          • SHA256 64ec51ae4afe55e248b97a88f127a7b5158845c7da28990218aa82fa526e8716
          • MD5 SHA1 SHA512 SSDEEP

          667C9FD603A3-0001-10B0-8A4E45E35014BeginSession.cls_temp

          • Path /data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/667C9FD603A3-0001-10B0-8A4E45E35014BeginSession.cls_temp
          • Size 75B
          • SHA256 ce87c6dca0363f32ee5ea8da7c895d1903b96506b48ca347c6f6fa5b01aefd09
          • MD5 SHA1 SHA512

          667C9FD603A3-0001-10B0-8A4E45E35014SessionApp.cls_temp

          • Path /data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/667C9FD603A3-0001-10B0-8A4E45E35014SessionApp.cls_temp
          • Size 75B
          • SHA256 e9bdf9f3a003ee7eca8fafc70f7b9617418b1af89da57ad9b052efc29328e448
          • MD5 SHA1 SHA512

          667C9FD603A3-0001-10B0-8A4E45E35014SessionDevice.cls_temp

          • Path /data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/667C9FD603A3-0001-10B0-8A4E45E35014SessionDevice.cls_temp
          • Size 48B
          • SHA256 2861892e8f098662c173abcaf15b2480496b48dc1e96eb777cd6a3124dd63e17
          • MD5 SHA1 SHA512

          667C9FD603A3-0001-10B0-8A4E45E35014SessionOS.cls_temp

          • Path /data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/667C9FD603A3-0001-10B0-8A4E45E35014SessionOS.cls_temp
          • Size 14B
          • SHA256 d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9
          • MD5 SHA1 SHA512

          report

          • Path /data/data/com.apkpure.aegon/files/.com.google.firebase.crashlytics/report-persistence/sessions/667C9FD603A3000110B08A4E45E35014/report
          • Size 748B
          • SHA256 baa4a8f5ea6754a790d964ac411ca008f1dd291595077e3c1d72b345c7fe58dc
          • MD5 SHA1 SHA512

          PersistedInstallation1537420246860906946tmp

          • Path /data/data/com.apkpure.aegon/files/PersistedInstallation1537420246860906946tmp
          • Size 32KB
          • SHA256 722c04e7100feedf3390822d7ef98d803100fb2850442a3dab8613a3b2be91f5
          • MD5 SHA1 SHA512 SSDEEP

          PersistedInstallation2135830908870133076tmp

          • Path /data/data/com.apkpure.aegon/files/PersistedInstallation2135830908870133076tmp
          • Size 560B
          • SHA256 8e48c696b8f1cad969ea060d3abc8fa84e19727ee01d442d420e80b04c734575
          • MD5 SHA1 SHA512

          commainw2c6c7m5i6an9.

          • Path /data/data/com.apkpure.aegon/files/com.apkpure.aegon_c/commainw2c6c7m5i6an9.
          • Size 34KB
          • SHA256 f8afb8cf7fe2782739cb7dac6edf0a1f7923168ba2783ba9fb348f904f23b4cc
          • MD5 SHA1 SHA512 SSDEEP

          commainw2c6c7m5i6an9.

          • Path /data/user/0/com.apkpure.aegon/files/com.apkpure.aegon_c/commainw2c6c7m5i6an9.
          • Size 78KB
          • SHA256 ed2d91e9d6429ebf0371a98f2faecdc755b766faa4e70b6fd9746853c9b69234
          • MD5 SHA1 SHA512 SSDEEP