57a47b81fdd3f5f95c8fa7925eec1338440efd2e626e8f5b89d1f481cfb697ac

Analysis

max time kernel
132s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
06/07/2024, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5.apk
Size 574KB
Sample240706-dherhstepq
SHA256 d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5
MD5 82267a649aa0a1dbaea09a422f292fdf
SHA1 f24dd169c52754e21d261e173327313ad66518ca
SHA512 0ec7a1a74d98274c984506119fb3c8faefb6c530995f3b667b0658b30dda9ced5b9200a3b2df9addffdefe1605e6ea58042389af99b2f30def7c5417b96bf93a
SSDEEP 12288:aNSDw+uaAoPekatn0k661r5lMZRgJtxgKH3obMITiyLU4:XDu+ex0k661tlYctxJgg4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence stealth trojan

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.cover.the.dumb.roll:Metrica
/sbin/su	com.cover.the.dumb.roll:Metrica

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4959	com.cover.the.dumb.roll

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cover.the.dumb.roll

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cover.the.dumb.roll

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.cover.the.dumb.roll

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cover.the.dumb.roll:Metrica
Framework service call	android.app.IActivityManager.registerReceiver	com.cover.the.dumb.roll

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.cover.the.dumb.roll:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cover.the.dumb.roll:Metrica

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cover.the.dumb.roll

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cover.the.dumb.roll

com.cover.the.dumb.roll
1⤵
- Removes its main activity from the application launcher
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4959

com.cover.the.dumb.roll:Metrica
1⤵
- Checks if the Android device is rooted.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5000

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

Path /data/data/com.cover.the.dumb.roll/files/m
Size 8KB
SHA256 520c582261fe55006ded8404aec0acb52f7bd8d59eaff11eeb1e382c69090ff0
MD5 7aec84397cc7efaac9bdf58654b6d14a
SHA1 f7a1b184b47cc96bc0c1555a848adec9f27c9c19
SHA512 4ba78526636c71948fef9c062361bf8b34542fbc644f1ed9564d5a0abddb2a0668a11c82e3e818ca605eeccaedda4ac1080d0e4ab4c8f34d3c8cd1416a478950
SSDEEP 6:7+/l95lmHn1xlk2vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKQ:7+tFmk2vqLiuWdwRmBEyPbn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/data/com.cover.the.dumb.roll/files/m
Size 20KB
SHA256 cdb80951ec9142dc96018bbbb55cbd23ea49c750ae2a96ba2537f1d37812035e
MD5 e2da854cfbd2dd93f2cd8e9c985fccf3
SHA1 4ce21be3e10e06dd33ed9d44a6c0697b8200b79c
SHA512 4b1cc55209a272e9a217eb155b45fea9b897bf281d05930f1b92ec92f3436406566e0d9be6e6c1fe54d444b0516f1ff1d7855d0a7041c22e748b600bc7f92993
SSDEEP 12:TLwgwfcGtSBw8w2RmBEyPbP/uksXQBncQmYVaOtqBVq5PpJQBncQm2zZMn:TLyfcQlNGSP/ukGgncFOtqjq5Pp+ncCi
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/data/com.cover.the.dumb.roll/no_backup/credentials.dat
Size 226B
SHA256 6361305b2b0fdc65e8e26a4c0017863edb55261825d76006d812f9e0cfd493da
MD5 b9655a5944f17a5d96488e5a1ad40db9
SHA1 4353bbab6a7a29bdb722e076fc6ba8e67b02ebbc
SHA512 b02140ebe6bc0658ef4c4231e73f7ab2cfe3a3169a6b0bfbfd9b543dbe950bc3fd9d78b11def29701a239137054ddaf295e6509e69a03a773e40b2ebfba20c3e
MD5 SHA1 SHA512

Submit Download

db_metrica_com.cover.the.dumb.roll

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll
Size 36KB
SHA256 6fbfd08e376d1ec80ecbbd26282c78d75ef630acccc377055addb52dc1970f36
MD5 11c9500b14d3666af5b6efefb6c68e5f
SHA1 fbcbb2619a57b27122460a36d344bbb70072dd03
SHA512 23d93b53a62d0312b66f9847b615a1a80adb79a1dd1a8f562611fa72e296bc0bf287c8f409a638e7d0c24ad4dbeee0ffda5b1b7e82393426cf1044fbf7724e92
SSDEEP 96:VE8LtFNekFcbqCLVChCNCnHoIHoFHo28c/KNL7b4N:brNekFc2MsaJT+k/4PK
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 512B
SHA256 3a3c2c128bdf9bdfd5ff1a18ff918d5af7fa9cf090851adc5f59009202148818
MD5 0668927c104d60e3c1dde507d69d8374
SHA1 51827eceb2ae557da9ebd0c0c65be2cf63312816
SHA512 1e2389205759fbccaeed3051a45720c302ca5d3c69513895395b52e06d7a2005c6dbc2502f31f5c0f38f4742097b53c8c9d878f339cd04d83b442feba266083c
MD5 SHA1 SHA512

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 8KB
SHA256 0451c01f935e6f387cebb076f0e9ea5650cb9cf3de27847b1a0c0b40e8dc7666
MD5 d89c19b9d86d2dadc32a0125c0600f04
SHA1 83c6e7035c2b475bc0a43e27fbb02613c60443c9
SHA512 c98c8cf061045b61470051a3e9fa5852413d65e06d7b00aca790e75ded86c0d94aa8e17603cb46b54446e895327200c5251f2ba5e6ccaeae323e2fefc3012abb
SSDEEP 6:7+/l9OHn1EWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK4x:7+tZWqLiuWdwRmBEyPbf
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 8KB
SHA256 fbef47aff0b5572d011fca374401b31c60b1464574cd37f206e0ac8d8b742156
MD5 72f3ca3adc742b39886d225f1c63ad3c
SHA1 a954b3d279923f5b76848ac874979834b86d6d9a
SHA512 e89318a7a661f0aa12c859c06324a3e63debe338633600f40e1aa2337ec5103d53ba75cbf26c2be3824a1e6b638a161b77cede9d76b8bdf75360c336cf193fbe
SSDEEP 6:7+/l9EPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKQq5/p:7+tGqLJdTRmBEyPb+p
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 ef3063f6ef5ce7e30d073501006f0a7e5aa9389d39d05221cde80e4b0c977c71
MD5 2c14388687d421516db858dc4d28fc4f
SHA1 f99d4fcab54c5c3edfe8d13c41c734426a1d814c
SHA512 22a2352df87ecd70f5383a01fa9b711963e06aa365e65e85a3e330eeb2cf97f565ad9e1cab153e9b9cdb8f3fffe1a7b76394ab5cfc26dbebdfc0da36d4a3f20b
SSDEEP 24:7+tZEUqLipOmVwvWcuR5OIwHATDFWDx+kXeseA+hp2RkaoWjg9vVGSy:7MWUqpE8WctFMkXe9kftchQSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 ff1e2130f9052649fe562b026f73288917b3918f8741d2a4b21f2e213eddf2f3
MD5 b87e2cf81d6f6528507a8fb18b09bdfa
SHA1 f459f6e22d5a00e3a31f7697245eab5e9e4e35ac
SHA512 e9f0424b47e8f11c6851fb812cd12062f20600ae79c1722841d7862f29a2e38dda8105f75c5cddfbd129d1262f298cd66aa192bc2e598c25592abe26b5d28a30
SSDEEP 48:7Mm2fbd9izpqnZE8WctFMkXe9kftchQS/:7vGbS16ZE8LtFNekFcb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 3783b760b25d40998103a7087f66aec04fcb0746c623fc9382fe6a6ecb4c3585
MD5 bdf4a4e60954bf853dfcf14267b78fff
SHA1 e1e8418e533b3186e4890ba9d928e34a49d56874
SHA512 0761c1206cd4fae55cf4099051df63565b1848a66971dac282e1714aa2573ec2d21266a78576682023c89420568f16661a0ba50d8be21e74a72a32c8ff95a077
SSDEEP 48:7MMUjiWbIfjQbuqpIyf4cDbJD8ai4LIDtuzkjlMmmz8PU6Uy4vf8Hb3qJE8WctFD:7dTcf6P2Ob32E8LtFNekFcba
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/data/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 2f0300217e6694132f9509fbebc6ea8a6d31b05a224945e6216f4585bc35c912
MD5 587959b119cb109b86a61979d81da4de
SHA1 8c9f5aeb99779b167335dc2f6f7d43fdd0a2e434
SHA512 2a66c8b0febc3fc99af8d63e034f8324148adf96245a3a22485794418e33de633fc6019e5cd03124824d3b0e7b1ecdd9861cfaad90782cf779d25ae60de2a51d
SSDEEP 48:TJE8WctFMkXe9kftchQSI/5psrWLHgkHr8bwajE9ycjNZHbn2JIgp1z5KP2b0Swy:lE8LtFNekFcbO5aClHobnRTsbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download