5812872a1cfa2c88dd7477881ee7e4015b237f35ad7cb9b3d930d291d560e6a1

Analysis

max time kernel
47s
max time network
154s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
06/07/2024, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5812872a1cfa2c88dd7477881ee7e4015b237f35ad7cb9b3d930d291d560e6a1.apk
Size 9.2MB
Sample240706-1myfrawdrg
SHA256 5812872a1cfa2c88dd7477881ee7e4015b237f35ad7cb9b3d930d291d560e6a1
MD5 cb15257128695991a490b70a32e2e9f0
SHA1 d5bd6500ae07fe8651956da78bdae50bcb1ac4bf
SHA512 405edd8363992e9c918a57fedf497172c64579fbab0894d8ce221a6208d5936f758188c31ac822fb34d598e7b03af69927d7a3c07123c6205f94f6da1e058981
SSDEEP 196608:mO4rYye2J4LHATYmx3ynDstkgGdrjjVUntcOEZdZ7OEf6SZ:m1YyT4LgjCDgUrjZyi
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/product/framework/com.google.android.maps.jar	4997	freerobux.appkh
/product/framework/com.google.android.maps.jar	4997	freerobux.appkh
/data/user/0/freerobux.appkh/files/audience_network.dex	4997	freerobux.appkh
/data/user/0/freerobux.appkh/files/audience_network.dex	4997	freerobux.appkh

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	freerobux.appkh

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	freerobux.appkh

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	freerobux.appkh

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	freerobux.appkh

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	freerobux.appkh

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	freerobux.appkh

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	freerobux.appkh

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	freerobux.appkh

freerobux.appkh
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4997

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

appnext_dbs472

Path /data/data/freerobux.appkh/databases/appnext_dbs472
Size 36KB
SHA256 e304777904a7f741aeb9d939ebfecd5c183a96e37bf08fa174d3aadbc28fb3d8
MD5 fc572bd518dea6509a2388e84be3f916
SHA1 22543d22fabdf0181217105501be6e9ba3c25364
SHA512 43e02e4f5b96d45e084a58cd8504ecdfdccc7494f1dfc8a094d8bfe2e824e15219a945cbc753f58a59d72ae374839ee9bb5b2e0d92805a024b29d3bbe07668e2
SSDEEP 24:TLIVDWeYY2ZAR4d7Chjy7qRgOZ5qRrRqGSgGQe:TqMZA24V9RgOZQRrR1S
MD5 SHA1 SHA512 SSDEEP

Submit Download

appnext_dbs472

Path /data/data/freerobux.appkh/databases/appnext_dbs472
Size 20KB
SHA256 d3482ca581a0ecceb257f31386538d8d711d1fddbdcd8da21f52f7ba220b8ef5
MD5 52af5f512aac726c329dc4b04bf2b39b
SHA1 4216628e68c9281d20003d7f3d0e82e7ef61943e
SHA512 e1b2d6f27f54243417a3753c0e84ced47312c96cfc8d8e887dd86009c3ab2e1aa88d65968b21e88b277dc7ada996914b90747b5012eee2b4ed7014e74f9451c8
SSDEEP 24:TLd0zDWeYY2ZAR4d7Chjy7qRgOZ5qRrRqGSP/dp6VZ:TKzMZA24V9RgOZQRrR1SP/A
MD5 SHA1 SHA512 SSDEEP

Submit Download

appnext_dbs472

Path /data/data/freerobux.appkh/databases/appnext_dbs472
Size 20KB
SHA256 e7478e06b8ac0917d6e1f5fd51b5d2c47171784430a0c8c125820cd10a0dc136
MD5 3f7a0906de7390dc4845e7d69d3b7844
SHA1 bc60037e8654c1d6c48de2d1cda36106fc4102c6
SHA512 9e74c773184462f777bbc011d0c4757068563136ef09659412735b4fc8593dd47154a539ba1eb727aed81142463485e684ac949495a17363c6ab428c44ee964e
SSDEEP 24:TLaeiDWeYY2ZAR4d7Chjy7qRgOZ5qRrRqGSP/7lnQMGp6VZ:TKMZA24V9RgOZQRrR1SP/RQA
MD5 SHA1 SHA512 SSDEEP

Submit Download

appnext_dbs472

Path /data/data/freerobux.appkh/databases/appnext_dbs472
Size 36KB
SHA256 0cbb3d6a0d3cab2ea2893b78e1715061ca80260833548c991139291467f849f8
MD5 d9c296541761f4b8c014c411d24333c9
SHA1 df03316e9d0c5ef0f5b66e694708823d54e65291
SHA512 fb9e8b07fd19514ff0ca9f700ed16975abf7691da2376b39fdede291441dd379f48aaee80c39f927ba08962c72b5cb3fc56c85db54acfe1b3a375ec58f33d4f5
SSDEEP 24:TLX2DWeYY2ZAR4d7Chjy7qRgOZ5qRrRqGSP/rL:TaMZA24V9RgOZQRrR1SP/rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

appnext_dbs472

Path /data/data/freerobux.appkh/databases/appnext_dbs472
Size 36KB
SHA256 664e8f7cc8873af6384d1ef66dff3dfb6b30368775d8a6571140ab763bae45b0
MD5 bbe974b08a30d11ea70227996843bc0a
SHA1 dbcb39716b19f484234c135aa28c177a681b7fde
SHA512 37cce13a0ae7b3b9762e179a6ce72e47b3acdbbcbba2b34ce90244c7037d27c55b9edc390ea79b2deb422edc34fcd6651b05100fd11be71486d3e5638199142c
SSDEEP 24:TLUJDWeYY2ZAR4d7Chjy7qRgOZ5qRrRqGSP/W:TqMZA24V9RgOZQRrR1SP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

appnext_dbs472

Path /data/data/freerobux.appkh/databases/appnext_dbs472
Size 36KB
SHA256 635aa7c4c254fdf1dbbe8187dbc1134cf10f6844a84f978b8df9aeb5cee14a78
MD5 ab4069d68da56f36c76569c2281f0636
SHA1 11c3e43dddce5a9f4c4333b4839d4e527fe17201
SHA512 54fad5c41bafd275b7d7b88ce32b8e11c06559b46ab6bcbc8d600db0074b49b7c51a768be7bd6562d304e9df5eb05bd8454da4cd13160678822cc99f729f6386
SSDEEP 24:TL5gDWeYY2ZAR4d7Chjy7qRgOZ5qRrRqGSP/b:T6MZA24V9RgOZQRrR1SP/b
MD5 SHA1 SHA512 SSDEEP

Submit Download

appnext_dbs472-journal

Path /data/data/freerobux.appkh/databases/appnext_dbs472-journal
Size 512B
SHA256 76048708ba1bcfbc323b8f38cb5bae32434189b3cdc47a27dad944ae5802d8ba
MD5 753dd56970e2952f988165847e00b3e2
SHA1 b187bae64574c8d79726cb529dd4a6646e67e1aa
SHA512 339705f55e657d6e0de04f9cf776aa18e7464acc46366ddbc56140c256b51302721c45d6747f3a7ecdd2a4dc6bcdec0656aea4cc09ac631dba0fb51533871335
MD5 SHA1 SHA512

Submit Download

appnext_dbs472-journal

Path /data/data/freerobux.appkh/databases/appnext_dbs472-journal
Size 8KB
SHA256 977e432fc38ecae6c330221e356f7850e0c833776d3d51e2fbb464a867f0059f
MD5 dcf39e732674dc86f5754c088eb3736e
SHA1 06735a13bc6415345fabc3ddf69ee1d624a94c5b
SHA512 f4b7a1df10340deb690fcdf90a7991d65a10d6afc1de71fc9eeb141e95db97f7e0af4124c1919e654017d9ee9156fe0048c4df43bf3695c17fc3d5452b42aa04
SSDEEP 6:7+/l9c//gn1qng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKDn:7+tE//nqLiuWdwRmBEyPbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

appnext_dbs472-journal

Path /data/data/freerobux.appkh/databases/appnext_dbs472-journal
Size 8KB
SHA256 2ebee1ef058222d3fd356c111066adc5b3f84026081f9d465d6aa19bc4ae99df
MD5 b9401c165eb674f2ea3ccd8a6552dd39
SHA1 b59a7faec1dba3914301fa336e2f2c50341e5ed3
SHA512 10c3bf9acba6c3c870f65b3c6a008340049e6c9c4a9b03ef22474070bcf141d3af86ee5671714abb8c437d161cf90ad9b8fff3600b027f2db504a60391c25f37
SSDEEP 6:7+/l9rOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKOvs//T:7+tEqLJdTRmBEyPbDvsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

appnext_dbs472-journal

Path /data/data/freerobux.appkh/databases/appnext_dbs472-journal
Size 8KB
SHA256 f0c0ad1e45a9857431285240f8f28f6f4d0d7ff55a5146c33fd5a177b9e6a286
MD5 fbd86ab5716abfb4fad8ff17332ffeab
SHA1 0d6272945fe8f5f49db4dafdcb0f0f473fb1b130
SHA512 77ba0678a36907fb93d69aa7e27a3f05defb3f96e0c609c8c32feaecdd7e3fd3786a7b7d9ea632674374949cac4c69877cd9fe4871e481846ada716443ec4529
SSDEEP 24:7+tFQNqLIVDWeYY2ZAR4d7Chjy7qRgOZ5qRrRqGST:7McqqMZA24V9RgOZQRrR1ST
MD5 SHA1 SHA512 SSDEEP

Submit Download

appnext_dbs472-journal

Path /data/data/freerobux.appkh/databases/appnext_dbs472-journal
Size 8KB
SHA256 30c1b9190a7bf2dced88fbdb2f8af60e055685036242eb79759a963f4c3144b3
MD5 381861ce6d91bdba1ecce5acb263f1d5
SHA1 533fe8d7e456522fba86c51af59c44897ba3054b
SHA512 a7e170d55b922a8f831dd0bec2b7317a7cac272b8d60f2c558859b361f0ef53cae671fc6f2714d56acfb860842bfb65df4599136ed3ff6c5dadd362b9bdcec33
SSDEEP 24:7+t7cp6V6fqLd0zDWeYY2ZAR4d7Chjy7qRgOZ5qRrRqGSk:7MqfqKzMZA24V9RgOZQRrR1Sk
MD5 SHA1 SHA512 SSDEEP

Submit Download

appnext_dbs472-journal

Path /data/data/freerobux.appkh/databases/appnext_dbs472-journal
Size 12KB
SHA256 a9c700921b40dd06f087639768a03ab281ed11e41886e20441c510241e53a4af
MD5 13d63385627e5f5bcd9ab8861b891b7f
SHA1 0d867034d5525a92dbc57101d3a4d3b35b148062
SHA512 8ac6123a63092136e4f85cc4e822cd27dd113e1d4fe11c3c3ebaf293cfa77eebeca2af717fd59d8cea87950cd9613d3cde638bebcc62cdc29a62b31447b8118e
SSDEEP 24:7+tj3qLUJDWeYY2ZAR4d7Chjy7qRgOZ5qRrRqGSh:7MLqqMZA24V9RgOZQRrR1Sh
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/freerobux.appkh/databases/google_app_measurement_local.db
Size 16KB
SHA256 aa5fa19d2e9629323c9ecddf657b93f2a3015e19c7f8f2f2a3e41546e8e8e74d
MD5 3b426844711115a89d562c02265be054
SHA1 c509a433cd79ef6618963d753ba7beda60e051c4
SHA512 ea777e6fee97d0713df7fa61bcb30de03e6e9c224bc4b3550a51e015bdcde30913de884a54fa70f7d9fea91dcf5166451175c298bb6cd5bba4b06fdecacb397f
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WZc:TLiEy9zmzrfRmBEyPbP/WO
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/freerobux.appkh/databases/google_app_measurement_local.db
Size 16KB
SHA256 bf918808f596818267bb69939aa965f7f2136b7678396bab23784865971e3a23
MD5 ecca961f90e80ddb216f4abd09fc6fa7
SHA1 caba2df6f30b57750f403b837f29eb22352ed061
SHA512 ef0dab7264569062936a0335146774c6af3490cffcefe13f0555aa9fa0cc30f892c99f6577c2b00f6db3aa8198551462f3fbba0365242a3b474ccf4fd5bb9f9b
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/ML2J+/0Fl6BihB:TLQpmzr0GSP/ML0lFr
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/freerobux.appkh/databases/google_app_measurement_local.db
Size 16KB
SHA256 43f7e8679704f968f9c4f1ace266fc7acf39a34d9212cedcf43a2009d6b19348
MD5 7dbad48a3a74fc74a8138453b7b15a01
SHA1 b747183c35671446b25081d6361e17f89d0c36d3
SHA512 a62ac9f33b03ef4b41ffab1218354ba6b41e2470c8e3f2b0524bffb3452e9b13baf93c2063acc8761741577ad2284587ff70c38aedeab9e959d907812baa1cde
SSDEEP 6:l9bNFlils1QvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wx:TLIEQv9zmzrfRmBEyPbP/Wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/freerobux.appkh/databases/google_app_measurement_local.db
Size 16KB
SHA256 76c4285983ae36988472a8900ff8e3a1fd0f44acc8acae56aa0406afaddb3e38
MD5 60a59b220fbe0a394cbcddd1dfc519e4
SHA1 67e98e05f586edecb94f13c7a7213bac5545f30a
SHA512 018610e464a529ec9b08b666a3c311c008f50d89d4c6d6ac7a535b9dafcc5869a8de4a86efa1a91ad095c70a0dbbf0b8b6cf242fee501190c298792a8911fe7d
SSDEEP 6:l9bNFlsals1dvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/jqLL2m4+/lu1:TL6uEp9zmzrfRmBEyPbP/ML2J+/0gihB
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/freerobux.appkh/databases/google_app_measurement_local.db
Size 16KB
SHA256 258a9df82b3c58cc0839d823cb12c95ba52d87565c3a72668c6a6fa0f5562f37
MD5 d8355540a6c39ce10d301708484ceed1
SHA1 ac940fce8e175c4aa91e2856821ce4a0c7ff0b78
SHA512 068160ee1d36e574a40dd02357bbb13a2469207ee8b8ba7f45c0c5d16b325682fccdea91d0b6f299835b780dbfb1577294c34a3eb9911394c6b42c9a22ad113a
SSDEEP 6:l9bNFlmls1QlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WZc:TLUEQ9zmzrfRmBEyPbP/WO
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/freerobux.appkh/databases/google_app_measurement_local.db
Size 16KB
SHA256 feb3890de0b319bb614088e942065fdc8c9e9bb1ac7670559189d1ba42bb62fb
MD5 13d4a98e5d9b78fbcfffe6a4e5674e9e
SHA1 ac4aaba1027e013c62b1d83e5691e37d5b45257b
SHA512 1562b764ca51fd4afa4d227ba016bc61cd0e5c71e9d1499b3340788d369a737a42aec082c9ebc698a8c7d9ca45eda9cfd07167f9752f8a94f77122d3cf15957e
SSDEEP 12:TLWuEOe9zmzrfRmBEyPbBvOwO+OLaJBzOAUv+WlNRgw:TL5epmzr0GSNO+KajzO5dD
MD5 SHA1 SHA512 SSDEEP

Submit Download