d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5

Analysis

max time kernel
175s
max time network
141s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
05/07/2024, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5.apk
Size 574KB
Sample240705-caxrpasbmf
SHA256 d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5
MD5 82267a649aa0a1dbaea09a422f292fdf
SHA1 f24dd169c52754e21d261e173327313ad66518ca
SHA512 0ec7a1a74d98274c984506119fb3c8faefb6c530995f3b667b0658b30dda9ced5b9200a3b2df9addffdefe1605e6ea58042389af99b2f30def7c5417b96bf93a
SSDEEP 12288:aNSDw+uaAoPekatn0k661r5lMZRgJtxgKH3obMITiyLU4:XDu+ex0k661tlYctxJgg4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence stealth trojan

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.cover.the.dumb.roll:Metrica
/sbin/su	com.cover.the.dumb.roll:Metrica
/system/bin/su	com.cover.the.dumb.roll:Metrica

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4475	com.cover.the.dumb.roll

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cover.the.dumb.roll

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cover.the.dumb.roll

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.cover.the.dumb.roll:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cover.the.dumb.roll:Metrica

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cover.the.dumb.roll

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cover.the.dumb.roll

com.cover.the.dumb.roll
1⤵
- Removes its main activity from the application launcher
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4475

com.cover.the.dumb.roll:Metrica
1⤵
- Checks if the Android device is rooted.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4520

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

Path /data/user/0/com.cover.the.dumb.roll/files/m
Size 12KB
SHA256 e82b60117239f6310dd9898fecfcdd9ba21b9a87334394b62e20e0b1ec7349fb
MD5 53c1fb5808b4241eebc5b77f7020241e
SHA1 bf61bf71f040c7ab7d28a8477b2b90bde1474f49
SHA512 3e88a8a008412e379487ce04eb1d590d9246aa7c24617350611ec86139ff49fc64169ebdc0f5acfcf7a27474dbbbb82c6600ed8c21791a8de87e5c02ce9a20cc
SSDEEP 24:7+tqqLY0MKyOmctlDWwwTRD5xs5cQlNGSD:7MqqTDP6PRtxOcZSD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/user/0/com.cover.the.dumb.roll/files/m
Size 12KB
SHA256 3babc583ca4dd395e4ef76ae8a427fa9cf9ade5bb8b8457c3e37ca92ad621971
MD5 e0023e28402d8a9a9e023e18377fe550
SHA1 27b727e97191156413deaa0afba5aaa793fde135
SHA512 602ac60b1d1dc7baf9b2b284f0d422eed2e2d791faa327fe1af0f5a58a9a38f6ec999fe2652daea2311a2d2ec209cadf3b522f9906cd2b5e05350f9f4521a3f4
SSDEEP 48:7MI/opit5s1ed1rnCXPTjJbLRqTDP6PRtxOcZS7:7F9XdhUjJbtUDP6PRbY7
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/user/0/com.cover.the.dumb.roll/no_backup/credentials.dat
Size 226B
SHA256 b513776adcdd5e81135aa931932744b2d61841010e51d9271d389b681545fbda
MD5 d40f882769ba82fed72f28e745a1df0b
SHA1 99e33ecff4e34774e8cc662707451117a98d8d65
SHA512 a386eede661e9b4ab34835e2220c131477c66cff2b3c3de265c744bcdace84fceed28a571e1f4cc05c868774029d5f291c357d75420f4669fac33abb4c01f950
MD5 SHA1 SHA512

Submit Download

db_metrica_com.cover.the.dumb.roll

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll
Size 36KB
SHA256 82741fcbdc09c44a3231290427406898b27f52fa719a48c3f9c50fe53600a6c2
MD5 360dadfbff406efcbed833f8faf4cdc8
SHA1 7d8d60eb35775c85c9091c8413dba2df86b1516e
SHA512 bed33666dbeb41acdcaf16d1b5e48a71aa74d124d78746f6580706ae15322ecb3398c7562f84f9f1fa302f089f8460c4ece7ec79b2d4121e1185f0b3920d4869
SSDEEP 96:GeE8LtFNekFcbSincPncLnWCQUClCbCokGofkGoUkGoE34DmAkm5cb4N:zrNekFcbcsnWcWuZ0f0U0E3Un5cK
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 20KB
SHA256 a8284d4c58ab2951192a5655b9649a6719cfbaa6d4875e6209e6c7a76680581c
MD5 dd3439f8f72a5a99a34ff9b034620f71
SHA1 88e7c5ade0868b0d8e1fb76fb81072fa39d5cc00
SHA512 291a51c65baa3a13ba55ca69ad7cb04f3fa01ae136f98b4a8f62954215bacc93a472372136dcf2fb2ed58032598e05c5d3dcc3d56eb5db8fb69900fd98e96b3a
SSDEEP 24:TLqfcQlNGSP/mJYgyKarMpwBE99EcBKbpQbsi2mp+GgncckFEMnYWncCu:T2fcZSP/M8KOW9+cMqF+Ggncc6ncD
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 20KB
SHA256 87bf902d378150413534bf7dd67b986d704bd9551cc3afcd3ab4b04b4783b004
MD5 6a08a328e866e8c983302ea033ca1da1
SHA1 986dc8b3e4d9977c91c94861a10a834b8dc35640
SHA512 497d710e8e620c3a0f120604bab6c5e5bfecc5c470ceaad8ee90363b6e068af4a7a4d7836c4d2fb70fa7a0d786f70a05f8a12f42453b5df8f39ec0f1aaa43d5e
SSDEEP 48:T2zfcZSP//qZWsS/LKOW9+cMqF+GgnccEncD:iz0YP3yWNDKp3inccEncD
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 8KB
SHA256 14edeeb8c8361ffd645ebcc20ba6b4e1f5de7b55053d2b3cfd21eecd73e8de67
MD5 1bb568bab892b779e19f4c5c21b9182a
SHA1 7b5c177fe13fad48eab7970bacb77140ba2afe52
SHA512 7440e58f1642a0d1b588359dbeacc2afdf573e6dd84fce2b3b1fd303e19a2fc14556ed91920d28a140ea2e466d4a1259e693195970ce20488e7a99fef6fb696c
SSDEEP 6:7+/l9W0GPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKZeC/OU:7+tI06qLJdeWRmBEyPbuV
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 a99b9974e07fc5596ad515525e961884c6f34883d58dc15cabdf86176d168539
MD5 e397c8d451d1483d8712d870b2cef06e
SHA1 40a16156c34cbed512e9c2001ba01b8ed9454399
SHA512 9130a3b55ac15f487d330d3fae3cd6602caa7f3bd421eb5c66749d332e6a01a3f3664f3bef334ed8f5af0d0e128d9d178ecede49656e8cddab080db7791753ff
SSDEEP 24:7+t6EgqL6pOmVwvWcuR5OIwHATDFWDx+kXeseA+hp2RkaoWjg9vVGST:7MpgqhE8WctFMkXe9kftchQST
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 367c7ee4af5326eec18ce0e5e56ff934240b0a669d45687a7b2891b988d0c348
MD5 bdd74d068b6f078d6ebc77dfa920cf55
SHA1 7ddfa3f2f4dfd159140be8cea8db2e949bc5d6f4
SHA512 a802b2584bdea964b2efea0787e0eb431a809e535bf2a32290140020586b9ecab0132241d1287c697779c137d2d0592a53256052ff43e30721f61e5ffab92c20
SSDEEP 24:7+te3E2fbivizqqLqpOmVwvWcuR5OIwHATDFWDx+kXeseA+hp2RkaoWjg9vVGSHT:7Me02fbQizqqxE8WctFMkXe9kftchQSz
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 3347dd98c186d778f7a1e0b71035ef2f9af7b3567ac0f9dda94127174df9cba1
MD5 8248063609b564136cd912eb54e885b3
SHA1 c09a46f95536daa5992baa2a9f7d021445e28585
SHA512 819c2e425799d3585d8d41d6e5f8d248129405e284b7c7647ec9ba540f98b9b872a1c715778c488c324249259c76a8fa837631d185aec27139df89e751b38e61
SSDEEP 48:7M4lWji2BDujUO3SQvXu5mItG3bglIE+tuzcmRy6xssizRdJx8ItxqbpqRE8WctB:7NUyDmNS9cbp+E8LtFNekFcb6
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 c3ff91f0c2c7fafb3516d425df0dae0ba4397a46a8a1d8e185fc33b41f213235
MD5 ca275fa0527e94b1d61c4b418ce0c346
SHA1 649c16efc8d1622eafc366da08e9efe8160c0c21
SHA512 8c5c9c79efb3922806afd302e95de50c222050bc81beee020364598d4dbaad699a8376634471f814e5e2313f7ed775be9124d2241b25eb8ba8485870379778a1
SSDEEP 48:TRE8WctFMkXe9kftchQSD/JsrWyU/0VHdjzqr8Q9ajE7TcjNZHbL2+Igp1z5kU8v:tE8LtFNekFcb76CySkGoQyJOsbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download