Analysis
- max time kernel
148s - max time network
165s - platform
android_x64 - resource
android-x64-20240624-en - resource tags
- submitted
27/06/2024, 08:39
General
- Target F0E35528571D2F96B674752960C49500738D6886B8358050CC5B12F1B726BBA4.apk
- Size 14.4MB
- Sample240627-kkmy8ssdkd
- SHA256 f0e35528571d2f96b674752960c49500738d6886b8358050cc5b12f1b726bba4
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 1 IoCs
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.year2020.dailyarieshoroscope1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
db469
db469
db469
db469
db469
db469-journal
db469-journal
db469-journal
db469-journal
db469-journal
db469-journal
chcp.json
chcp.manifest
nativeapiprovider.js
promptbasednativeapi.js
exec.js
platform.js
app.js
cordova.js
cordova_plugins.js
app.bundle-min.css
app.bundle.min.css
app.libs.min.js
app.min.js
directives.bundle.min.js
features.bundle.min.js
angular-carousel.min.js
baguetteBox.min.css
baguetteBox.min.js
moment.min.js
picker.js
picker.min.css
picker.min.js
progressbar.min.js
libraries.bundle.min.js
onloadchunks.bundle.min.js
application.bundle.min.js
booking.bundle.min.js
catalog.bundle.min.js
cms.bundle.min.js
codescan.bundle.min.js
contact.bundle.min.js
discount.bundle.min.js
event.bundle.min.js
facebook.bundle.min.js
folder.bundle.min.js
form.bundle.min.js
homepage.bundle.min.js
image.bundle.min.js
links.bundle.min.js
loyalty_card.bundle.min.js
m_commerce.bundle.min.js
maps.bundle.min.js
media.bundle.min.js
newswall.bundle.min.js
padlock.bundle.min.js
privacy_policy.bundle.min.js
push.bundle.min.js
radio.bundle.min.js
rss.bundle.min.js
social_gaming.bundle.min.js
source_code.bundle.min.js
tip.bundle.min.js
topic.bundle.min.js
twitter.bundle.min.js
video.bundle.min.js
weather.bundle.min.js
wordpress.bundle.min.js
youtube.bundle.min.js
providers.bundle.min.js
services.bundle.min.js
templates.js
utils.bundle.min.js
error.js
customer-placeholder.png
pin1.svg
pin2.svg
pin3.svg
pin4.svg
pin5.svg
home.html
comment.html
edit.html
history-item.html
history.html
actions-popover.html
comment-form.html
comment-item.html
comment-list.html
new.html
post.html
history.html
blocked-user-item.html
blocked.html
gallery.html
post-item.html
post-list.html
gallery.html
map.html
nearby.html
post.html
profile.html
fanwall2.bundle.min.js
fanwall2.js
cover.html
list.html
list.html
list.html
list.html
list.html
list.html
search.html
folder_v2.bundle.min.js
folder_v2.js
admin-modal.html
contact.html
create-place.html
blank-700-440.png
job-header.png
no-category.png
no-place.png
search.svg
list.html
manage-company.html
manage-place.html
more.html
view-company.html
view.html
job.bundle.min.js
job.js
011-cc-visa.svg
012-cc-mastercard.svg
013-cc-amex.png
014-cc.svg
cart.html
list.html
product.html
confirmation.html
customer.html
delivery.html
error.html
history.html
history_details.html
payment.html
store.html
stripe.html
success.html
m_commerce.bundle.min.js
m_commerce.js
010-money.svg
payment-cash.html
payment_cash.bundle.min.js
payment_cash.js
payment-modal.html
payment_method.bundle.min.js
payment_method.js
001-blank.png
002-credit-card.svg
005-cc-amex.svg
cards.png
payment-stripe-cards.html
payment-stripe-form.html
payment-stripe.html
payment_stripe.bundle.min.js
payment_stripe.js
categories.html
filter.html
maps.html
places.html
view.html
places.bundle.min.js
places.js
list.html
view.html
wordpress_v2.bundle.min.js
wordpress_v2.js
app_icon.png
m1.png
m2.png
m3.png
m4.png
m5.png
drop-alpha.png
drop-color.png
drop-shine.png
drop-shine2.png
ionic.png
point-validated.png
point.png
sprite-play.png
530.272.png
blank-512.png
white-1.png
texture-bg.png
texture-fg.png
texture-drizzle-bg.png
texture-drizzle-fg.png
texture-fallout-bg.png
texture-fallout-fg.png
texture-rain-bg.png
texture-rain-fg.png
texture-storm-lightning-bg.png
texture-storm-lightning-fg.png
texture-sun-bg.png
texture-sun-fg.png
index-prod.html
index.html
languages.js
url.js
ionicons.eot
ionicons.svg
ionicons.ttf
ionicons.woff
ng-cordova.js
polyfills.js
utils.js
games.js
styles.css
games.js
view.html
hooks.js
r9-menu.js
style.css
view.html
hooks.js
style.css
view.html
hooks.js
style.css
view.html
hooks.js
style.css
view.html
hooks.js
style.css
swiper.min.css
swiper.min.js
view.html
hooks.js
modal.html
style.css
view.html
AdMob.js
AppVersionPlugin.js
badge.js
barcodescanner.js
browsertab.js
Camera.js
CameraConstants.js
CameraPopoverHandle.js
CameraPopoverOptions.js
chcp.js
clipboard.js
device.js
DirectoryEntry.js
DirectoryReader.js
Entry.js
File.js
FileEntry.js
FileError.js
FileReader.js
FileSystem.js
FileUploadOptions.js
FileUploadResult.js
FileWriter.js
Flags.js
LocalFileSystem.js
Metadata.js
ProgressEvent.js
FileSystem.js
isChrome.js
fileSystemPaths.js
fileSystems-roots.js
fileSystems.js
requestFileSystem.js
resolveLocalFileSystemURI.js
TransitionType.js
geofence.js
PositionError.js
geolocation.js
inappbrowser.js
Insomnia.js
util.js
keyboard.js
local-notification.js
MusicControls.js
navigator.js
OfflineMode.js
permissions.js
promise.js
push.js
SocialSharing.js
splashscreen.js
statusbar.js
webViewPlugin.js
whitelist.js
com.google.InstanceId.properties