1e6cccce8a46aff2c607ee4092f5d2c778e3b0b6d7ae0ed7ac673e5702d0ddec

Analysis

max time kernel
4s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
28-06-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e6cccce8a46aff2c607ee4092f5d2c778e3b0b6d7ae0ed7ac673e5702d0ddec.apk
Size

3.5MB
MD5

39f9c0603e5a3422f5c41071680ebd81
SHA1

2ccdea0c77d2c3447f0d89cd43379f64eadb934f
SHA256

1e6cccce8a46aff2c607ee4092f5d2c778e3b0b6d7ae0ed7ac673e5702d0ddec
SHA512

2a0a1591103e2a911edc3c4a32627838da6437f07c17b4378c229a11f54251fac597e928542fe233c1b6e26f04f55f2651a3c94ddcd75808dc1bb9edf3078dc7
SSDEEP

98304:t/uLod7dpDnoagxlToTwr5LCzdOGAXk0Ji0KV:E69XY/9XkOM

Score

6^/10

discovery impact persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

Processes:

com.drnull.v5

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.drnull.v5

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

com.drnull.v5

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.drnull.v5

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

com.drnull.v5

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.drnull.v5

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.drnull.v5

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.drnull.v5

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

Processes:

com.drnull.v5

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.drnull.v5

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.drnull.v5

description	ioc	Process
File opened for read	/proc/meminfo	com.drnull.v5

com.drnull.v5
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4257

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.drnull.v5/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
a14e61b424b618e0ce518842fe3ca063

SHA1
a586a3054570dc8c2c4479021616a918740250cf

SHA256
689fe75d48f97a631fb7f4a6180c69fa73e5fcbef3480f131e9f38cb1000e409

SHA512
d29a8c809cbacf462f9306bc233247e26412ea7b14616eff6b6375a8d02eff4d369cfbfc6a2755bf68986c4da0ed495ea82c8d686a59f2a374c216c1d2c97903

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.drnull.v5/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
013805fcbbcaf3ffd536f473dcdc43d0

SHA1
1f012f18c496adaacac34025860a66a3d364cd86

SHA256
7aaa54ef821abdd8e0bb35ac96e45920c800a31ae59430ebd6ac4578b460c3dd

SHA512
2fda0a887ddc1f40b8b126283839d5c97a269b8c4e38e6f56c23ed4e613e244a7e1763e63416d278ec315206a71a2ecc35c6a4bddac36b7a66d2443948993ada

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation274192167816487542tmp

Filesize
90B

MD5
9750123e9c296b09d5a8650d65dc3925

SHA1
1cceb308e01c1e631d67b909c607f613aa8bd4e2

SHA256
5f94b8d94f3aa361de5577f96f49b8a5399fb1c3c413af7da3e3f1eaeb5eee03

SHA512
c42a81af2f7ae5d424921fd4f7e08465d6bd0cfc385ec37851b09ef94a677473a32635e0090f83d8b0d1fcdebe14fb8d456cd1aae4baa1f352ba854c7090a987

Download Submit
/data/data/com.drnull.v5/files/PersistedInstallation9045562974478837566tmp

Filesize
568B

MD5
9001c307718516e8c73a59924ca93c08

SHA1
813f8df4b32b141c213744954c31dc16a496537f

SHA256
8e4bf644d9e3302f9257ad0cf1e320d11d5d9e2d84e788b200818a13e51703c1

SHA512
d7266358aef56a9e38e19d6e7e550a0fc2a9aa29606a43011f6f294d758efc113097896db8e1520cc74ed7301174988cc8d4e1246e9fe6af8d9dd6fc8771f3fc

Download Submit
/data/data/com.drnull.v5/files/database.db

Filesize
102B

MD5
1794e2ed4d5fced9d0ab7b976a02b9d3

SHA1
017ac8570cf473e4c0dc723f470d010cc3579cbe

SHA256
6e55f4a5d30a56fabfdb1b75e93a68e3dbf8424342c086a4092d74fb0ec86d48

SHA512
b5ae11f69c86fb76b0f14efb85dd9905bd0423161979062e245a55cd1488d66c34bb9a2658a54073b4e54f485b14f1859163df5f032e1514dcb552a0875a5114

Download Submit