Malware Analysis Report

2024-07-28 11:41

Sample ID 240629-13lrws1dlk
Target 4a6604ac4df2319fca1238caad6e6a735399f8b26ad03d1484b053fece2780c2.bin
SHA256 4a6604ac4df2319fca1238caad6e6a735399f8b26ad03d1484b053fece2780c2
Tags
ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4a6604ac4df2319fca1238caad6e6a735399f8b26ad03d1484b053fece2780c2

Threat Level: Known bad

The file 4a6604ac4df2319fca1238caad6e6a735399f8b26ad03d1484b053fece2780c2.bin was found to be: Known bad.

Malicious Activity Summary

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan

Hook

Ermac family

Ermac2 payload

Removes its main activity from the application launcher

Makes use of the framework's Accessibility service

Queries the phone number (MSISDN for GSM devices)

Queries information about running processes on the device

Obtains sensitive information copied to the device clipboard

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Acquires the wake lock

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Makes use of the framework's foreground persistence service

Queries the mobile country code (MCC)

Declares services with permission to bind to the system

Requests dangerous framework permissions

Declares broadcast receivers with permission to handle system events

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

Checks CPU information

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-29 22:10

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-29 22:10

Reported

2024-06-29 23:02

Platform

android-x86-arm-20240624-en

Max time kernel

179s

Max time network

185s

Command Line

com.wufeyusedisusi.racohuxu

Signatures

Hook

rat trojan infostealer hook

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.wufeyusedisusi.racohuxu

Network

Country Destination Domain Proto
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.238:443 android.apis.google.com tcp
GB 142.250.178.10:443 semanticlocation-pa.googleapis.com tcp

Files

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-journal

MD5 4f661b7295c358ae373ae58ffa0e7e36
SHA1 ec018bf04416a435a7593ff18386cf300a523636
SHA256 dbc47ab66e2514d730bda4725c55c26df9e6dbca8dd6b6b508d59e80cd8d7740
SHA512 2305336a493cd1cf83e9da4e1e0be50e4956bb1f9cb491e1a39aaac18b55c7117830f41cf568d362808b5e115049a3eefa5a9b5dfc51b23912df129652e8d1b6

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal

MD5 bda8261b893fe313fa466235c49a3e0f
SHA1 3cc9722282af758ecf53e8e324f120da2e2543e7
SHA256 97d8991b65cf162b553fe952cdaec999ee75f35b5ba6ec1dd9a6f90a09af1ad8
SHA512 a6929c63ad9c0e5a66d8cfcdceb6c65a45df221b70f107018d13278429457295a9634816f9edaf10ac9fa18ed6e45c361c737eadce1b50184533cf82bb710220

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal

MD5 daf7f52a05f101645c7db66c44cadc6b
SHA1 511cb5a7fd6258809aa01732523613cdf4508c9f
SHA256 907cd316cdb8fc9356549d38fb1112f3c9b55661a58929227ddce51690be1ef7
SHA512 e948ac6e056139419b934dee2d2aba92e1001a16450bc44a86c43395a27a953028f2f163b6ba9ee5ee8389781e226236e3d0bb42059b1b9d14443b3447587527

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal

MD5 0780d9b0094a41b254dc8c64f5b1ed0c
SHA1 87c791441d680270b9af820ce674239016be5412
SHA256 604dca52080730457b1bc48228656fd83fee0e2423d800c114eeabf2b7ae1263
SHA512 c64f8af95ac18bf3e8562c1bfe736e37138d91c8a45b55470dbd579934266f09b2e31345ee9422fbc215632356d5d689a81b03302b2f801cb761b448ba8239bc

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-29 22:10

Reported

2024-06-29 22:42

Platform

android-x64-20240624-en

Max time kernel

8s

Max time network

186s

Command Line

com.wufeyusedisusi.racohuxu

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.wufeyusedisusi.racohuxu

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.200:443 ssl.google-analytics.com tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
GB 142.250.200.34:443 tcp
GB 216.58.204.78:443 tcp
GB 216.58.212.227:443 tcp
GB 216.58.212.227:443 tcp
GB 216.58.212.227:443 tcp
BE 108.177.15.188:5228 tcp
US 216.239.34.223:443 tcp
GB 142.250.179.238:443 tcp
US 216.239.34.223:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.178.10:443 semanticlocation-pa.googleapis.com tcp
US 1.1.1.1:53 g.tenor.com udp
GB 172.217.169.10:443 g.tenor.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
US 1.1.1.1:53 mdh-pa.googleapis.com udp
GB 172.217.169.42:443 mdh-pa.googleapis.com tcp
US 1.1.1.1:53 safebrowsing.googleapis.com udp
US 1.1.1.1:53 www.youtube.com udp
GB 216.58.212.206:443 www.youtube.com udp
GB 216.58.212.206:443 www.youtube.com tcp
US 1.1.1.1:53 growth-pa.googleapis.com udp
US 1.1.1.1:53 lh3-dz.googleusercontent.com udp
GB 172.217.169.1:443 lh3-dz.googleusercontent.com tcp
US 1.1.1.1:53 accounts.google.com udp
US 1.1.1.1:53 accounts.google.com udp
BE 64.233.166.84:443 accounts.google.com tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
DE 89.116.27.45:3434 tcp
US 1.1.1.1:53 www.google.com udp
GB 172.217.169.36:443 www.google.com tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 142.250.187.202:443 semanticlocation-pa.googleapis.com tcp
US 1.1.1.1:53 i.ytimg.com udp
GB 216.58.201.118:443 i.ytimg.com udp
GB 216.58.201.118:443 i.ytimg.com tcp
US 1.1.1.1:53 www.google.com udp
GB 172.217.169.68:443 www.google.com tcp

Files

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-journal

MD5 80bf8a846a58f5a73e3bab2c0ecca2f9
SHA1 49ec73683381088b5b26dfc90a4baac0d747d80e
SHA256 25d0b2ba6b946ce1b38ee70f14423f331fd76ac8cec37caae040f4e65580e64d
SHA512 24c502f55e7a344d28e397c9f55044e679a7100b41984c986c9f7e1ac132cda744a4321196dff86721574701e50cbc28f9e34aa8d101be852582819b48f958ce

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal

MD5 98a03260f0abdb53c29b412a47af87fa
SHA1 0e899ec9aa2d04f008b9230bbb506f25627549f0
SHA256 f97eb661c55a6d99f7c7307fec574e9e724145abbabe6a67a005924f7d31932b
SHA512 df9620b750644d6a6d39b02f1520d73d9b065295016246088cc043772e5f14f1ec69f8ca5911b927c11cd470aa0821fc642cce623e8f9bc5801a7789101356fd

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal

MD5 b2342bc740361ed517a19cd7a9b37aa7
SHA1 ec60ec3fa3f2d3a714729136f6835ef840a38a26
SHA256 df415dc0d12c40c0631f7111a3c9312d5800396b23f14706d5201ca21a0ef415
SHA512 fd15590ed13075252d2360eeedc260c5c50c787d180814df2cd09a426698c65f5fd5c7d4704fcebf3af7f3e5ea010a467b7a11ba6c068f726b1913b26cc39493

/data/data/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal

MD5 307ac13315cc6e0c38a064922f27f62e
SHA1 cd1950ef638abbdcf0d094f49716f43fbd9d32ec
SHA256 0e5103eabd02d45e00589282a1175032bd1aab64bf03952892bd18f15d08cffe
SHA512 4bdf1b83e4bbf04f51c2c27f5c7ff2efd5f93e06ebe445a468e04e2961b8c1855308f0de817dab64a8bcd0a368238b9eaca65df1beca9cad2a3200d622cc7d17

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-29 22:10

Reported

2024-06-29 22:42

Platform

android-x64-arm64-20240624-en

Max time kernel

27s

Max time network

184s

Command Line

com.wufeyusedisusi.racohuxu

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.wufeyusedisusi.racohuxu

Network

Country Destination Domain Proto
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
N/A 224.0.0.251:5353 udp
GB 216.58.213.10:443 tcp
GB 216.58.213.10:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 null udp
GB 216.58.212.200:443 ssl.google-analytics.com tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp
DE 89.116.27.45:3434 89.116.27.45 tcp

Files

/data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-journal

MD5 7d9aa030182396b1623d030bbf1d03ee
SHA1 822d6af9bcaea691cf5935cfdad35ef5e54c4d88
SHA256 df6baaac6ad59ffb764abfff3a2bc59bd9109de3cd7f6f6f8a1e58c08efbdf18
SHA512 260892a1f65b03d4eedaad1bbf8df6aed221aac61da259ef6e4fcfa624ace54c7be6fc685db7523cfb7b21fad63fbd45c712c78e9dffaf6863a7a0bc9520cc7f

/data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal

MD5 fd3f3c47d5069c80b630f4c288265453
SHA1 4739b0796dca527d480bc1edb39d5de8ccad4acc
SHA256 97ef9af353d319a5c5b98be5cce567513a140461df1aa04b4def349501f0de3c
SHA512 18757a97a54b1912dfc21ba19e3439e57ba4b7d47fbe30b9f00fa53d18ecd144140544017e8dedf7bdcc302206624457e365d80f230fd53d1b2a168d92da3027

/data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal

MD5 afafe24d5ed500944d4d130a68851c4f
SHA1 c1e96f08cb5db6ebd4348b414307984d8fbad33f
SHA256 ff326aaa6ff5c6f4580760de70946d90c5be5d58b5faad0c9fc5d4829c2ab506
SHA512 11f591111d55dc55ff53b7632caed0096e5fcff83092fcbbde9dc9861bd81b21434c985d10621654060ca5f56490279818c85b078a7f5bdfe470785c5eccbbb7

/data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal

MD5 3cc35ee7e80e61c67dc057e544ca1304
SHA1 e104ba0096543b4f877a42cc577344224bf6b4c3
SHA256 e86716dfa9579a1a6d2ca13e5fa9dda14b70fded066ca6ff6986f2eb3e414115
SHA512 b91a64620c346f85491a148b1bcba6eb47ba01fa145795563b8e6e4d99c681ce3407128be8efbc89feb84db68617915bfa9abf085b4e48de594b637c7f7a7d72