d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5

Analysis

max time kernel
133s
max time network
177s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
05/07/2024, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5.apk
Size 574KB
Sample240705-caxrpasbmf
SHA256 d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5
MD5 82267a649aa0a1dbaea09a422f292fdf
SHA1 f24dd169c52754e21d261e173327313ad66518ca
SHA512 0ec7a1a74d98274c984506119fb3c8faefb6c530995f3b667b0658b30dda9ced5b9200a3b2df9addffdefe1605e6ea58042389af99b2f30def7c5417b96bf93a
SSDEEP 12288:aNSDw+uaAoPekatn0k661r5lMZRgJtxgKH3obMITiyLU4:XDu+ex0k661tlYctxJgg4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence stealth trojan

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.cover.the.dumb.roll:Metrica
/system/app/Superuser.apk	com.cover.the.dumb.roll:Metrica

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5059	com.cover.the.dumb.roll

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cover.the.dumb.roll

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cover.the.dumb.roll

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.cover.the.dumb.roll

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cover.the.dumb.roll
Framework service call	android.app.IActivityManager.registerReceiver	com.cover.the.dumb.roll:Metrica

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.cover.the.dumb.roll:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cover.the.dumb.roll:Metrica

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cover.the.dumb.roll

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cover.the.dumb.roll

com.cover.the.dumb.roll
1⤵
- Removes its main activity from the application launcher
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5059

com.cover.the.dumb.roll:Metrica
1⤵
- Checks if the Android device is rooted.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5100

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

Path /data/data/com.cover.the.dumb.roll/files/m
Size 12KB
SHA256 d2ac0e3c663dc0bfee815e9f7ffc0dbb63db2e8caacdf53f0102a0d6d02ee753
MD5 5dfe389461dfde8646b3a610515a4d71
SHA1 deac69958bbb97a048096cefe89b17f5770712a0
SHA512 88dc0c722d9b900174b4d233cd1c6a1e144bff5b871228e4d3b703a5f1c52173d623eef68aace2e804822bee2fec95f4444cddcc76a73f2c7af58148a4b599d0
SSDEEP 48:7MsC/epPa5redRFOJXpTjJbVqvzDP6PRtxOcZS6:7NsBqdRMnjJbVkzDP6PRbY6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/data/com.cover.the.dumb.roll/files/m
Size 12KB
SHA256 fa1c05bcdb89d53880c23e73b4e72dfbd9128d17dba0cb7ee42a78be0ee9a81e
MD5 9f80af715526a1f38713041d465116cf
SHA1 75aad5ffcb2db62a08e46e7e91d2653cf9c9c7e0
SHA512 87a9105016c058eab8dd13240ba8e1d3a5e29d4533ee87d67fe5016e13573fbb443062ae459ed8a50ae796dd6019bb1bf5711f73f78cc892eb3cfab62a3aed85
SSDEEP 24:7+t+5RqLV0dKyOmctlDWwwTRD5xs5cQlNGSR:7M+5RqbDP6PRtxOcZSR
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/data/com.cover.the.dumb.roll/no_backup/credentials.dat
Size 226B
SHA256 5d0ba9f86079fc4f39e902e4db2d8e8c1f85c6cfb2e09dc23646de074faf928e
MD5 ed12dedc93d21e7bd1d28227d7f1b097
SHA1 405f415ff42bff5165cefafcd565cdd751254307
SHA512 b569795a388c5ca78e61626409ff59f5c5d27f0d6bcea93d35f5ae0c16f37326f43f02a66add759e4023204c6b9c5f5b28b4b4a5433211454a9fa23a1841692d
MD5 SHA1 SHA512

Submit Download

db_metrica_com.cover.the.dumb.roll

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll
Size 36KB
SHA256 a6b97f842fb441403c6f24955cd5a266a68bc10eff2db4ea4d8a226a0b5fafe2
MD5 6396afc07d2ad1c1212f749673524403
SHA1 74169aa821ba03d2edc01b5dfbfb10ebfd63fe2c
SHA512 584892406f25307a339a0aef7159c75a86670afc97b52f9eb21ad7330f315db1d50781abffde27ccb040d8ad47753d30254f19e8d8427bb60cc0ea8f9a691458
SSDEEP 96:VE8LtFNekFcbSjnc1ncLvQCLVChChCr2HoL2HoV2HoUUo80b4N:brNekFcqmMvQMsOYFbyK
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 20KB
SHA256 6b8c685177acc2a7e8b6ad5ce501fd4bf703817d8f8f28db1dd0a0d45f16301d
MD5 193f5f607db44880d8ab20dcd416bb01
SHA1 a6be073120b40e787cc4bb942d66f6b697ad766d
SHA512 d8aa6f27aa0fa0d52a50c40bf17f1a057d38781bb50b33ed56ad05d6dc22449b5039c45c0db567bd8d9fb34144d323ab5bd328e55f63b707b2e20e5696b87a93
SSDEEP 24:TLCfcQlNGSP/mvt2oTPMq/iuETBzbpQbsi2mpRGgncvkbEMmFnhncCu:TOfcZSP/pmFa1TVqFRGgncvnrncD
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 20KB
SHA256 66ae42b7b657bc2bb48955c9bd1a05c9e58bf30da98502b2fdf5e0f97ac21e59
MD5 d3d099d116f484591b39adc2c9ea7df5
SHA1 236dba104ca7f9877fc6d40dee192d1966c78753
SHA512 1f7e95726781d0eed226480958eee0aafbe7fa1343e33519edfc247512528c41aaadf063e1fb8de60696effd3e6cb5b605eba16b5fa1b49597e0959f42316e9c
SSDEEP 48:T27fcZSP/kWqZWESNX1a1T7qFBGgncvEbncD:i70YP/yWFNlaozncvSncD
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 8KB
SHA256 a4b522e2a3aa4293c849e20eb34dbece45d87503eb24231c5666376bc9409675
MD5 366e569053cb044fa389c92383b8341b
SHA1 21d7467985ce8eac005a1d485c7660b4c6db2dc1
SHA512 f828dbc1eff978e296d75d2425630059fddd1a6e2629ed484e49c382066a134eb72450f54a1e318e33d5781c7b9a3005630704e42a38b3ec6351eea46215150b
SSDEEP 6:7+/l9KFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKuYt/V:7+tmqLJdTRmBEyPbNY1V
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 738a43753d601bef7a604c2fbf001ec371e066c1eff1235ac690ae8d82d6eec1
MD5 fd4044e274f694e464ed13b04a25794b
SHA1 1ba285de9ab9d8d967033ee93de67fb28949acc6
SHA512 69bbef42a0dc57a48e8154450f9bc3b0b8072cdbfd989915d437bfb8b33c2ff78ca04c97ce0f719a35cd9d7ec6153ac14a5581446340be752c87e48f7290db34
SSDEEP 24:7+tmED0lk0lfqLipOmVwvWcuR5OIwHATDFWDx+kXeseA+hp2RkaoWjg9vVGSI:7MtDvUqpE8WctFMkXe9kftchQSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 d1153d2cf34904750ef7758457d9de0081f65c3a5f49155ed57b05b9041bfc3a
MD5 6f0af01d30f842264484d35eccc80137
SHA1 0554fed1301f55e8bbe3804dd50f9903ce905f8a
SHA512 aabf3216991a516e21b8612ce8abebcbd1130b34a0b5f57e8a015fcd3439e7e066a7dadd42d20c283747cefd19d955fe1deecb67c0a83b5a56516ff011827c87
SSDEEP 48:7M62fbfizVfqnZE8WctFMkXe9kftchQSC:73GbqN6ZE8LtFNekFcbC
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 176f34dc9490ff18a2221fe4ab2e30ac122594c369d9ef922ae9418e6ffddb9c
MD5 82585dccb0c6fb72b46467a8a481679c
SHA1 16dc8c08279dc9580e7a4049d8f10a6e1c7e33c9
SHA512 2c3aa26a07d59d95eb69767a65c8cffc2118c97eed8d6b2644fcd274ef2c1e536032d6763c0f55c54f919962851d38a7b6176c7f2c7d8d149d8feaf80d50b2b8
SSDEEP 48:7MlXjinpujNh45ju3w6C3qP1ZIiINmuuzB5GnWYsSJ49YlQFh2byqpE8WctFMkXf:7yuUlQyqbyWE8LtFNekFcb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 bb4ef68b79c50133a232ab05f48b5e788b2eca2b0764b1d2286f1888dfafe2a0
MD5 d80d53444fdc8a7593c7e10de3ef2842
SHA1 632d7b12b82d0fbf9c13e9e128ffd5f325e9a2a4
SHA512 edecad5c3be22320c6c909ce62f1a55ae77d37873fa539c961e2148ad834cff64c557d5b58dced4ff8fd87f66e3a520977d5e432e3e7471f232ae8703382b0cf
SSDEEP 48:TZE8WctFMkXe9kftchQSM/upsrWRUe7HD2Hr8qojE91cjWHAa2+Iqp1z5kF2K9w8:1E8LtFNekFcbCuaCR32HoeKsbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download