1cff06f6542c2f6879bf2f54ca6f89fdabd9d3e41d67aa58670bfa7edd2768e9

Analysis

max time kernel
53s
max time network
159s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
01-08-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cff06f6542c2f6879bf2f54ca6f89fdabd9d3e41d67aa58670bfa7edd2768e9.apk
Size

4.7MB
MD5

47c3fec11449daecb163ce929d23fc9f
SHA1

59756b66f84a7c8c80e7377148b277678ba4edca
SHA256

1cff06f6542c2f6879bf2f54ca6f89fdabd9d3e41d67aa58670bfa7edd2768e9
SHA512

807a30bf8381a6ca5e174dc635526e393b7d408f6d453dc514161a49729cc6d767512c6b77283b62ad0c906c92a87610e869712ed96450407548604c66d3178f
SSDEEP

98304:bFbCkMYktsqYRK5JFFjQPA8cO7RiND+ZxSDWXu3F3sxnDKN4H4C5Ry:bFbCkMYxqYG1QPAfO7Ry6xSDiu35sT5k

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.google.Sabun

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.google.Sabun

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.google.Sabun

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.google.Sabun

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.google.Sabun

com.google.Sabun
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4946

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.google.Sabun/logs/20240801222624230.log

Filesize
20KB

MD5
8de3843474ff3f8c39d877ecc5edc79b

SHA1
14a8b361f7d8155c19823373f4a2d9759ba9357e

SHA256
a8c03ca410b864b3a763ecd874c536f84c50879e5ee68e67283eeb83f26352d2

SHA512
31a991d25bb412913bbe2215161424c99cf0736ffc074ee5f57ed07e85024d1592aac867f7c0d4770dc182728ba344dfca08da1548ceb9fe4c2b0aa28e26663f

Download Submit
/data/data/com.google.Sabun/logs/20240801222624237.log

Filesize
33KB

MD5
79c916dc0c8dad261ba8401ce4762d04

SHA1
90031b19afecda73f3a0b9a4c16bafeaf1705f45

SHA256
1d85794435d205ce706ad20e1c458af050c1bf67fc7ab8d4df67c796448ce378

SHA512
7a0f40cc0288468094e7af34425298ca873ae3b2a912b83f75e9f451a72f56a45cb504be67e3e5a9da64b532ae7349aa2cf11a5a34fc1a8c40c03a8a45e4a0c1

Download Submit
/data/data/com.google.Sabun/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.google.Sabun/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
042d5a44bd9799fec29914121b43122c

SHA1
72b36d71ec9e545aa548a875a5db8175d1f9b60b

SHA256
3b8af28553ef2033eccf4f36a305036e99453e50a1d9327c3bdde5a43f67a469

SHA512
f98e010f5bc17b16b1aac7bf657e165d466de94a55be4e15c9ae62b3dfa5863db08798722d3d78d7138c1e7f92df89d37df12449341a920d607845cf8a672e13

Download Submit
/data/data/com.google.Sabun/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.google.Sabun/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
5a5efd78c2386c67769e0c95d226ed61

SHA1
e83f835ca3e9af96e12c2f6c537c9a612616e961

SHA256
acf1a0fbbe77eaa2458a5c158920160c9ca8ffa0a45d20e6e18594a71e95bbae

SHA512
ce91a629242f72bad56c951879a0244d1d57dd136fa1ef9ac4962245fb2f8cc76f2bf3f16edc426369f4284240a597eca69be62e05302b4c24c7edabc830467b

Download Submit
/data/data/com.google.Sabun/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
f6029017443f5fb16dd4b1a3a0d300b4

SHA1
19ad730a0c6e43fb44f663768263df8215ce3e5b

SHA256
729feebc621ecb6525e0352230e2a98875dccffddc8a31f63540d81c0e755dfa

SHA512
2051db9d5dde85763727af788a6e7df75b7256ec7c7ae8a79fa83ea18ae933fa4a939b6a66199c5f9108323044bc149bbe5b96a5ffba04ee8cd9e2306356cf71

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads