Analysis
-
max time kernel
85s -
max time network
164s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
26-07-2024 03:02
General
-
Target
62bbab5bfac8c118a6cbadde76700f1602cd674e1c17d89db7cafb6eefb82283.apk
-
Size
2.2MB
-
MD5
724c6e623dae2a8ca9d66bf2c8bf0533
-
SHA1
c22c798060f2cc839c52badc0ba8f88eb4bdb8ab
-
SHA256
62bbab5bfac8c118a6cbadde76700f1602cd674e1c17d89db7cafb6eefb82283
-
SHA512
4988071c6dc6a39c68ec26792aa253d9a0b90c8b55877fe1c17440fca8f3ccf4c0cb844c9e27b3ad7cac251f980f99ec8c1867d7bba3c6b0374142ca08ab3279
-
SSDEEP
49152:Qh9fG52Q1/Dg8YTACD2DoRMM1buoAFh0Vkvz2eyH+rbw:+qX/DwTDFRMM5uo2lb2eyHl
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 1 IoCs
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.wikimediacom.CD.Ripper1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
Filesize
599B
MD5a6d8145016e95b363973cb16ce4e4da1
SHA1603e746e033719118609bbfd6a010a7bbc9825f5
SHA2565ada03d49f9a84306e24e591536ed33584d73519dc9a46e9d5cd75395e5ce8ca
SHA512f3964962024c4fa480b88efaabd37792c65a46044ae4d58f6a8a20cc57fb3a3e2eec954eb2414aefb153b1a0ea680fa972ec193734e71e025f307704665ae08d
-
Filesize
310B
MD5e399ea3bdae8e8e3f45657901d90067f
SHA11a5d781d2ec07936d950f863da21bd41b45680ca
SHA2561a0b9df3240bee9e21ee922b1298b2a686f26f866d0ad97a19cb49947405e532
SHA5127559a20a003a1fde99f9b3154a944ccf105f859356249c697b0bb9578d9bf48ceab0ebe3503b358a613a3b1cbda081dcf8bb72932af79a28d699b783043f4329
-
Filesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56