bbeb16b180c9578abbc2b616ec24e9573124c3540d567c561d990c223dd363b9

Analysis

max time kernel
132s
max time network
147s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
25/07/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

legacy.apk
Size

43KB
MD5

e741a9bc460793b9afdadc963d6e8c1d
SHA1

ca71f5827faebeb1292774730db30d8e27d86875
SHA256

15039c74764f1d63d52f301708997f6f64dbab2a6c1a46ed4701ff550e69f040
SHA512

f615bf5dc06b26b1583a2b69ea849de4d9426256452eaf081ad7a4360721febd00722ced3d382a7539450f5ac37427407dab6263b0b3f9b89e00d1bc31f19d10
SSDEEP

768:aYWCc+52Zr6tRrMxu3LJjTb/ZxMYf6n71XNUbw41ExOHNgj7:vWfsRSutTb/XUn9NUDExs6

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.google.ssearch
/system/xbin/su	com.google.ssearch

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.google.ssearch

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.google.ssearch

com.google.ssearch
1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4223
- /system/bin/chmod 4755 /data/data/com.google.ssearch/gjsvro
  2⤵
  PID:4257
- /system/bin/ndk_translation_program_runner_binfmt_misc /data/data/com.google.ssearch/gjsvro /data/data/com.google.ssearch/gjsvro /data/data/com.google.ssearch
  2⤵
  PID:4278
- /system/bin/chmod 4755 /data/data/com.google.ssearch/gjsvro
  2⤵
  PID:4346
- su
  2⤵
  PID:4368
- /system/bin/chmod 4755 /data/data/com.google.ssearch/gjsvro
  2⤵
  PID:4450
- su
  2⤵
  PID:4469
- /system/bin/chmod 4755 /data/data/com.google.ssearch/gjsvro
  2⤵
  PID:4528
- su
  2⤵
  PID:4546

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact