57a47b81fdd3f5f95c8fa7925eec1338440efd2e626e8f5b89d1f481cfb697ac

Analysis

max time kernel
133s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
06/07/2024, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5.apk
Size 574KB
Sample240706-dherhstepq
SHA256 d75f907f12aa1c8b3b48c58ae65a23d9c7f7de2e06badb122c625d2916a3a0b5
MD5 82267a649aa0a1dbaea09a422f292fdf
SHA1 f24dd169c52754e21d261e173327313ad66518ca
SHA512 0ec7a1a74d98274c984506119fb3c8faefb6c530995f3b667b0658b30dda9ced5b9200a3b2df9addffdefe1605e6ea58042389af99b2f30def7c5417b96bf93a
SSDEEP 12288:aNSDw+uaAoPekatn0k661r5lMZRgJtxgKH3obMITiyLU4:XDu+ex0k661tlYctxJgg4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence stealth trojan

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.cover.the.dumb.roll:Metrica
/system/bin/su	com.cover.the.dumb.roll:Metrica
/system/app/Superuser.apk	com.cover.the.dumb.roll:Metrica

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4490	com.cover.the.dumb.roll

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cover.the.dumb.roll

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cover.the.dumb.roll

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.cover.the.dumb.roll:Metrica

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cover.the.dumb.roll:Metrica

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cover.the.dumb.roll

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cover.the.dumb.roll

com.cover.the.dumb.roll
1⤵
- Removes its main activity from the application launcher
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4490

com.cover.the.dumb.roll:Metrica
1⤵
- Checks if the Android device is rooted.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4536

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

Path /data/user/0/com.cover.the.dumb.roll/files/m
Size 12KB
SHA256 0fac060c79c9ca0c543e4d3df83a6d63d3c370c3e0b23999fcbd8ceeca84b874
MD5 9476f7d41c26698b51378569eb9a23f7
SHA1 b28175e06aff5939ab7416cf4ef067fdb1bdb25f
SHA512 50cef934fa6b134aa5b8d3edf57ff806a465c3dd38952c65b7c1f76b61f45c8b5c3e2ebdced5279922450554b659dcba698d12f059ea59f9914ca7d2470c6704
SSDEEP 24:7+twqLY0MKyOmctlDWwwTRD5xs5cQlNGS1:7MwqTDP6PRtxOcZS1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /data/user/0/com.cover.the.dumb.roll/files/m
Size 12KB
SHA256 8ebefd3163142c039247d31456b8472d0fc06c11c07e4a10b3cbc04cbc3aace4
MD5 3783bb4c5c1b53615cca5ddb556d5846
SHA1 3e7b0ad4815e3919d6ff54548fae10b4ed3b0703
SHA512 a03bca32b42a88b6e8561df159c4ae155b0959989670bd59d4f13a114f32bcb6027a8769f529764d8b3ed55f331cf97fda3fbe59664bcfa17315ecbb1fc6631f
SSDEEP 48:7Mpc/opnt5YedYrnCXPTjJbqqzDP6PRtxOcZS1:7caKddGUjJbqUDP6PRbY1
MD5 SHA1 SHA512 SSDEEP

Submit Download

credentials.dat

Path /data/user/0/com.cover.the.dumb.roll/no_backup/credentials.dat
Size 226B
SHA256 fa350ed52bdad7ff686b6feb652a6a2cd691dea970fbba45f98f6c2c0fef0e3a
MD5 97a7d5a9311a1e25179833f792345f37
SHA1 80d6e5aeaa1610241a5293efe1d2825114cd8832
SHA512 e6e3ad8e1c27d391194e2b8ec686cec3d865da4911e0f9aa6ea62896f6376ee71fb363b15ce3caf6c90193af8d841d4257e5f034c265d8152735b848cd8f6365
MD5 SHA1 SHA512

Submit Download

db_metrica_com.cover.the.dumb.roll

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll
Size 36KB
SHA256 7ebf6713f2e2a8fe65801ebebab99db6de08502a66a625732c4ac90c400ab9b5
MD5 ddc3e051e7ecfacff39a30c4b51672bb
SHA1 16c57b3edee1789565cfbd6f1536200658c8d725
SHA512 4b7918c4cfb12e3664e214a8067426bf298c33656db0954e0d215e4171b59c746cbdbfb306a50e734851ba7eaced8b5e0f2b34af0c8078323b68bcb09ac8cb21
SSDEEP 96:tE8LtFNekFcbSincTncNnInCLVChCNC+pqGowRpqGoMpqGoUyscrXWJab4N:DrNekFcbEGnInMsabk2kMk3aJaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 20KB
SHA256 08ae9aedf7f276d68e7464f87ee47a3cf4d9ac976ef92926c40bbb8a01b2ea8e
MD5 1b29459316bc535c3e933ceef445a369
SHA1 d266fb9c73f7eb569e32cbd73b726c65c092fafc
SHA512 c37067b1cdc6b575a0ee078340255de6d043649399e4bdf6b93f6297b7276a62d2027c16537938a6a74c5f59cfed1e78d8dd3f270b6b44034a3f58e41439278f
SSDEEP 24:TLqfcQlNGSP/mJYgyKarMpwLnwEcBIbpQbsi2mp+GgncGkFEMnYWncCu:T2fcZSP/M8KObLcaqF+GgncG6ncD
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 20KB
SHA256 344980dce5cced048b8001dc8fed992dfe87e2bf0055ff54f2c78642c4b1dc9e
MD5 5b0b7ddc53333dfd2d5def95b2729653
SHA1 8e73a2a28849088d584c368a32c726a6031b40bd
SHA512 74874158df65cf93e5587c1f968d22ed2a14b601c7aea345aa986f070b694d748f18dcfcb83cc650ba74d2987a8ce0999e8d3e0a26963e5e86a4cbbdbbcb7c4d
SSDEEP 48:T2zfcZSP/2qZWsS0LKObLc9qF+GgncGEncD:iz0YPeyWNEKcpincGEncD
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 8KB
SHA256 e4605279cbfa594f9d7cb517e94983b541d7abb38eac3248060c95f4b088c291
MD5 0b0f90348cdacdb0579a41fb443cf684
SHA1 efc7610056f761c3acf3c039a516f19025dc18b6
SHA512 1528d899eadb828bc5b6da47f9ecdd122bb5ecc336dd4512339cf5f169ffad53e3243460a90664b12e6f4c45b2e93e631b8778086588a8e5c262e78bc35c214a
SSDEEP 6:7+/l9CBGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKpa/U:7+tc0qLJdeWRmBEyPbDU
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 d90c968404cda879d312041c3ba4b6241422cbccf993b9d769a8a6835cb29017
MD5 ab712e9ec7eedad6e17af269f27acc45
SHA1 499a220a543c2e5802cdcafedffeb464618dad36
SHA512 1b190641236df17f384533a57c7c1a10532baec7444586f58b38913df92b91ca1f73bd2ab9d2948672cd962cc9023a5d58b3dec0c097b144db4619e9daa5cca8
SSDEEP 24:7+toWEL4nqL6pOmVwvWcuR5OIwHATDFWDx+kXeseA+hp2RkaoWjg9vVGSy:7MOcqhE8WctFMkXe9kftchQSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 83649d0df76bc148287ecfb45c9d092d7d2a40dfa39d01393c471493576e076e
MD5 8b0dd50c4d3e390b35cca52388b0b2c9
SHA1 592e815d1dd3727b996b9b8dd05f7d052ef797b0
SHA512 d2313756e6c82d98faa472fa87e443ef27eda677ee579c639aa5fa85379e53aee1cc827b9586fd9260b5730a98ab50097afab874455fa4cef7fb91758a1d3f12
SSDEEP 48:7MU92fbBVizBnqxE8WctFMkXe9kftchQS8:7Z9GbBQNn+E8LtFNekFcb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll-journal

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll-journal
Size 12KB
SHA256 044a544dcfe577d4496e21e820b47660a532d319f5ef30fe0e193273d264b72a
MD5 ce53276bfecdfe62018a1cbff34c012f
SHA1 4ab740a5af2d2e1aeb7aa689bd1569efa260fe52
SHA512 e6946c8fc3e7e1e128760a9154654542ed708ef6b6a0204abe3ec0d17a3f19fa43727941e736554866b977c2f2796fa5d3d78a1ebceeb84efba0d09e1ebb6e7b
SSDEEP 48:7M7LVjiB2vujawLOtIOu5HW4cJV8pi4LIDtuzg9J/thmnj6UrDKtxKVbjqhE8Wc6:7WqcSIWoabjOE8LtFNekFcb7
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180

Path /data/user/0/com.cover.the.dumb.roll/no_backup/db_metrica_com.cover.the.dumb.roll_20799a27-fa80-4b36-b2db-0f8141f24180
Size 36KB
SHA256 153c531d7faabccbef62421c5344b72b89be9276de386fea99f3e1364cf0f207
MD5 210893cdc782878f64df1c7cecce59e3
SHA1 d86482020101a2abad481181b925b080a7b2c1c4
SHA512 3a9c141bafe39fb724f615820e06aa5db3eb1442db4ee26645fe6c59c8121158224cf50fe9ae2bd1fd6d5fd0f13e690f7ad745aa24938425c44255cc741726d1
SSDEEP 48:ThE8WctFMkXe9kftchQST/3psrWyUp0VHSqzqr8WjE7ocjiESPa2iIgp1z5pU82I:9E8LtFNekFcbL3aCympqGoxToqsbn+
MD5 SHA1 SHA512 SSDEEP

Submit Download