Analysis

  • max time kernel
    133s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    05-07-2024 19:39

General

  • Target

    d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5.apk

  • Size

    574KB

  • MD5

    82267a649aa0a1dbaea09a422f292fdf

  • SHA1

    f24dd169c52754e21d261e173327313ad66518ca

  • SHA256

    d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5

  • SHA512

    0ec7a1a74d98274c984506119fb3c8faefb6c530995f3b667b0658b30dda9ced5b9200a3b2df9addffdefe1605e6ea58042389af99b2f30def7c5417b96bf93a

  • SSDEEP

    12288:aNSDw+uaAoPekatn0k661r5lMZRgJtxgKH3obMITiyLU4:XDu+ex0k661tlYctxJgg4

Malware Config

Signatures

Processes

  • com.cover.the.dumb.roll
    1⤵
    • Removes its main activity from the application launcher
    • Obtains sensitive information copied to the device clipboard
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4970
  • com.cover.the.dumb.roll:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5009

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cover.the.dumb.roll/files/m

    Filesize

    12KB

    MD5

    5ec22ed4accdcf6733f9f1b1c15b554a

    SHA1

    e1963d6602c7572345cfc0c6228007664a07ff24

    SHA256

    39b6595378fef8f78fe049b9d0653c687a6aa20668ffca6940275eb60785aae4

    SHA512

    52e6b71a6ee7264bf536bc1fb8c75904f228c18bc633b82ac17f1de2f73691dc6bedcfac724be653c962c3d969f2626435cc5e2d3416ca268398f285afb30fb0

  • /data/data/com.cover.the.dumb.roll/files/m

    Filesize

    12KB

    MD5

    eeafb5a5ea9f96c8dbfa3def21db8a5a

    SHA1

    664e31c09b0710c8d9a21c4d786fa3eec807043a

    SHA256

    120700f6bf6f70615787a90c0c50be353eed856120022ce9b592a670f0de735b

    SHA512

    f9420bf17a299fde813b06feebb5e521e88d736f3ddbdef96c13c120fa3d86154891f4545e26fde804404f150e7b61d5124b413b7193af63cb161ee7f8e8c27d

  • /data/data/com.cover.the.dumb.roll/no_backup/credentials.dat

    Filesize

    226B

    MD5

    f23dbf1922594711bdf205f7fd38944c

    SHA1

    3aee42a1a3f343866fa3703594017e1a2bc19b2c

    SHA256

    b5da7346095edff5163806803b9e47a509a39abd7f73e47fbdd4360fd17806fa

    SHA512

    3a498bf61493b776e641a038239cfc411f65682997c48aaa2efa790ee8cd37bc725bca3fdf71cdecf06fbaf89a44ce46484e5b166ff2ed68ae7e4bbfe207850a

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll

    Filesize

    36KB

    MD5

    35d8c8b99431c074ebcb1f0c65dd36a5

    SHA1

    d287a5e58c2a7899f9efb3efc346bf719c4decad

    SHA256

    2d5984b0b75978f7dfe533159c36cad9ea46d545969f8cee909071d0d3de79e7

    SHA512

    c10c955fdaa041698b3d9e182433c5d556e6312c0e7848fb4ea7547d960fba95e4318450f79246ebee5c47d54b81cf509eeb9f05f612d50d858d684119312a35

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal

    Filesize

    20KB

    MD5

    74b99e9c3b5289fe9c7613c3dba3b570

    SHA1

    d3488ff947f5561125d14e0cf3739a86715c2a3f

    SHA256

    d3e93047b08ac3aa14f609bcc8b0923c0401966c97ef3a84201dcb211dde57c7

    SHA512

    679b8bb22e3adac6ea92d138c49a61c5d0e49fe958024c2907fd8a214301b8e5975e93f71833eab24718c1f2fd3b6cb8a73a709155944c27af8753c1f9b49cc5

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal

    Filesize

    8KB

    MD5

    193bd897eba4269ddba146cce8d068e5

    SHA1

    fbc2da50a48372359809ce8c3fec2172030884aa

    SHA256

    925ad6a287e5ad0fa077b4cafe5d248d276263f89f11ae12aa33f263910a1c0b

    SHA512

    5c2714f8439bfb4e7941c23cad8cc62fee538485a05aa2171c39fd1f8081b2556cade17e1386c1c4d17f914eab0d18f15a9b2c098d35ba653c1d605d48efe404

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal

    Filesize

    8KB

    MD5

    de6db0dceca77e25cbb3aaf43344fac3

    SHA1

    2a010b2359ab0637447f51b40b6994fc743e7385

    SHA256

    29087927851355aecd8670c0748fa0eb18e0d3af853ae4415f37d684606872c8

    SHA512

    61c2fa78df0639769a7c4929c5e044fa0604f211c1d32e5698f07d504ffdd81657cbe9038a1f9b5589237f69134da7219f94159f924df5c51b251bc29cf6dac2

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal

    Filesize

    12KB

    MD5

    f969d751abb5f4341a63bcdd20c7fba8

    SHA1

    570b0ea62def689e579fa8b3645660a120e9518e

    SHA256

    ca1cd79901491ee170299094956c3361992b63a02c36854edb8247b301ea4380

    SHA512

    83d3bc2c64ba73011330afa61c4699958895ed7ee3e03e9f73f6c9aaaa9ccf2ab10e4f823b0ce2e7006e9ef76f535fc401eb65ca92d8887ae38e1c4a78995022

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal

    Filesize

    12KB

    MD5

    6f1395aa0e98402e2a28d3b12c77f72a

    SHA1

    3b7b276b18dbd41bbd9391b2b6b53a7bd8af2eea

    SHA256

    95ae04dfbce81aaff1f712421574975e97fc9376f3d9792a6ca3807aead0fd12

    SHA512

    4cd54e49cdae3a634eda362de852877c89f07154b66738cc552189ca66d158d2b54467a6e5246c7dd880407a3058a763dfd48ddf74000da5b9fb7e73a5ece5f9

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal

    Filesize

    12KB

    MD5

    d8238597f1b8a3f8855ef738ab2f242d

    SHA1

    f71d635c37a4497e2d2ba5c5d08ec831ab0d7908

    SHA256

    cdb123c0add00e4dafbf1efad482b3b8be524844707772c52e5c0d65d6208631

    SHA512

    0531482db0b9f9564e18afe8c100e6b96ca733cdb067f14568145ba19febe52100dd766445090b253e00fb4c49330ecfc9ebcfdb294ea73b7b678f230d929943

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180

    Filesize

    36KB

    MD5

    cacce775688211d197220a164b09b085

    SHA1

    59bc9eba2b4130e0e07890b44920e7f75be55ff5

    SHA256

    206ff4bf782908b04860aca525bd58aa50c8c74ebac9904efbb5619a01f30950

    SHA512

    072de07a959e6d7de60203fdf77b5628f247d17fb76c5061183d749a275f37b7e4a53cf2807ddd8878445597c697ddf1fc5b8271503ea808dfd657186d31f543

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    512B

    MD5

    9edd8bd526bf5f9bfd70919e7e07a332

    SHA1

    a6adb22e40c019c0a261781426f1b1c1b8212598

    SHA256

    cf05b76df7473cc254fe97f6207eeca24c0f0e7b3181a6057129bdeb3e6fe594

    SHA512

    fb4cdda429eb0f5b7b67bb9d2f30955caf03eb096aecc01feb8cae794afa1328291e73789d917a4a50d605d6cf1aa75ba0852306d357e442788ccb8013de795d

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    8KB

    MD5

    61ed2fe6b0394f53182d3fa0e2139710

    SHA1

    a595ce7eca8d428be2f47c323347b5c1c8579446

    SHA256

    980d2b5e6769e5e1631a6f9490afeb2758d556ee7754d8ae5cda32ab6d58f7f7

    SHA512

    43b16ad845a46cce2b2f88dcdd9407a1dc5af09b202a08cf218963057d25d92f8bc1e5ea438fdf5cb161fb013a365bbe83ada4699b8e9f5c8d473d5a13722459

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    8KB

    MD5

    8b36ab0ce4f8e6b029872762656c273f

    SHA1

    487ecafd428323fbcecfd0bf4444f4a6e4797cdc

    SHA256

    13526987854b6294817be391dc38a42945c76cbda1d4e6d2b1f96d1f4be0745f

    SHA512

    c33fe7bcf8faf455f89ca2c42ed74c47b3b90090da33749b96ba0b541875a6bfabeba1fcef0c712eab37d0fe2d2c0723f7f2623beed2d1725c07c1805629d2ca

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    fc13d94f53bf767eddc04f0e8e7f19a9

    SHA1

    9af5e7d36c1733b6ed3d3bf298774613e6320534

    SHA256

    33b46a251e3cc914c1f89d53473f69a646fd32153ae8a996f1381b9b8fed1bc6

    SHA512

    35a1197d54486653ba26c2a7e43059f282277024c72d9e2795a755b603188a29edf81c3e1eba96fc0e7215e72e8ca20d02d914c099f0ed55984d7c313cc7e73a

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    2bf0f10d6ef6f018eabcf93369311d7a

    SHA1

    36937fd84412d7ac912e3a3c6ba709973c979441

    SHA256

    b061762c589622a0b8a132f0aaca9a2c87b0d476ef92a37bd024604fa37ba4b2

    SHA512

    410f7b27563c435d37ec1e90d75d82095a2fbeeebe073762f0750e63c1e39111db855ddb4f07d051db365489f1a1f49248cf44f459422cd63367cbee02499da3

  • /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    de9556da95839274a17738cad67f869f

    SHA1

    5f4671ba30bad4e225eec7af32691f7322fdf944

    SHA256

    eff1bf168ef499859b059e8983aff6eb8bd95921291fcf388e3bfbd9d3ecd042

    SHA512

    e0f33ab35509850bbe55998dbaadcc80dadcb79dc2cfecd7814dfee96eb34e47c72c2a647780d6b2b1164ceb50a44e45571c6685cd7ec7c863f7ee9243b88c89

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    a0a548793a510f9caed081689f935eeb

    SHA1

    2d1aad0213b2b86bfe52dd2485741fb00eb02f3a

    SHA256

    4564ec31a51694e8349f462d5ada137b3f37b7c42515a7fe34ea8ef33b5063c5

    SHA512

    624204c5e505d3f2822a9761109babe81079ce8552551f23b7315baa171ef7881e5b5c4eab607a53b9bf080be6cb3100ff8cedf4cc86fa6218cd18301fcdc367

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    b9d6903d92aea3914bff87ec736df79f

    SHA1

    cdc4509888f10757c49ace558203d9faa7e084d9

    SHA256

    d94b6b2fe5a39d5dc5044f9b1d17786f586b918d9dcec6020d08124056e52aaf

    SHA512

    3bad4b61b16a0310e14b49be3860b4f7713444fb0f231a935ea551d3d4622af9d6699a8681d7631c3858012dc49a5a037c8722e23c074a94bcdd94d1cd59f4d0

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    831b010d3c8015f14db1be20d29d374c

    SHA1

    1fbcfd38ffbea7dfe80a3604d5772bbe41935dfc

    SHA256

    f381f3b96bf6eca3f964d5eeb7ec25788d500d83be80b35a491e52c9414b67d9

    SHA512

    45c86aea0d88b03ce19bea31db6af4ce2641fb96188d0b337bea1cbe9b09341bf03151822cc7352042cc97dddd1dd62fc8a3ff5afae9b2f544c5999b0197ca1e

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    35f788b3b23386c45e547f133caab746

    SHA1

    3c04610f102d37666b48b024398bcd222e72d9b3

    SHA256

    e577affd5794e534c66d9723fc1e5499fbafb269ab38ff063921a3b85c2442ec

    SHA512

    142d1a07c17a066a6345b26f2d81a67034b9250cd6b2db4ccf82d0d9bd8d54c8009560ce786e5da1126c347ba854449651cb56c04606ebd01c45e493e116f51f

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    b5fbe3c6404bbd7103240514ea8e64ca

    SHA1

    476f3adcf748c9302ec812b96561f38119eaf2a2

    SHA256

    1ec008e54100a4988995aee9a99804cf6d55eab5bebc98c2dd6a76506427e436

    SHA512

    d920932110099ff82b62408c913763e6d6f653f911d7410c07f1e240f443889452d54001ddddb6248a5b512aead95cec425483cbd8013d1b4f9c5b64467d70ee

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    bfa01ee5e5c77a470e6d30a224f97769

    SHA1

    56a831a0bbd1c01453fb60626b591429930c90a3

    SHA256

    83b35330c221d814d06bef91c2674f51f92c9c857585f93435e49056774946a4

    SHA512

    f9ff11a849e450e820b45d0fafa1c01dde644bd08499950438c94fdc0b19c2b84cc47205d41bfde4ffd71c5db2d96865d8ac6790133ea01ed28b8bde7ca9c21c

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    3da570e482f9a0c5481c9fd9225e5968

    SHA1

    54e0340ccc5d56a410de2cb18c78ed68c744e63e

    SHA256

    faa2e451be02f540e9536be712ed0cb5650ccb26f3cba25e7df1e25a814ad0e3

    SHA512

    a39ce062b0cf68cfbf187a7ce76d9a5dfa4bcaa86a497a631f9065a1dcdbb82d7205153b3b7db6f3d88bf12958ed6f5a9b2f056ae74c461b919367195e1595a7

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    5b7741f4da8bcef98751e785ceeefd59

    SHA1

    392329fd5bfc73f2b2f7a39c2fe4c3af00bd6bdc

    SHA256

    2ee5b93952d95a16e1a776ffa668975df502efb4146e655677409108a520947d

    SHA512

    bfcd3011f73d8a28fde3507af217d30bf51750fddc8ec7f5cfac6d6a1ffd634402c7a2b73e8235189ca754a03c571a2d464e7d3da58e7633ddf90e286d416ae9

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db-journal

    Filesize

    44KB

    MD5

    7574fe232cf50b14cb4dd5abaff27ab5

    SHA1

    6155ac70c50fcdba6a36a295015934833a981048

    SHA256

    f9f75c26f70f227a3b6a5389067a363056688a6b60bbb91f8cf71a6bcc444e64

    SHA512

    8f8f999e3bba281c7a519ee34324b01a6a034d03fd17ed938858a4f7fc5ee83409689e18deb2ba2c517d2a94dddff7a8a77025be32037c69f8b07744c11fae07

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db-journal

    Filesize

    8KB

    MD5

    1764b07dbe66a579d6018d851423b8cf

    SHA1

    add2b9f794c886d08eac715a676090e481c685c7

    SHA256

    d0ad7c7b5b06e1f630c37af996250aaef59b1b3a2c1b87e3bda272688c9df957

    SHA512

    86043e7bb41f0b4c9816b52975870ac88215ada674b8555f0dab581d511dede3da21c20697ff824bb197389f36f3ce3765cc4c32645b641b0676d98b1251c0b3

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db-journal

    Filesize

    20KB

    MD5

    5dccd7264d5e6d6093f3282333c7d13c

    SHA1

    99003ed66d690c1ba41a993c28241d49f14c0314

    SHA256

    9f2c5ecd1842822c471595bd9620f105d821adbd4aa16ccc1090263b751904de

    SHA512

    a67b95b1e04cfdc419e92dbb038fb803dce0b3b4ba7c62ce7a2082d1f84df7aab32d144b0b0ced8a76834913795179ff5117511f77eb68dd9e4a63e90b61ac66

  • /data/data/com.cover.the.dumb.roll/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    36047f7efd8bdefe5274f4810072a6e6

    SHA1

    0801a98ba89bc621e2ea48bd203fae94383f5c57

    SHA256

    be5161af74db04830d2a7ec725d7e1a325d1121cc5e22a31631107303996c58f

    SHA512

    bab061acd253d45871d7ccb63af707141677685b3e7c0644cb1e556d756a22d455262b01d6bb551f64c553f7630a3ae28873020879ac7c995c6197b1f5949bbb