fa2b9a5ffb90f0ef7dba72bde9c97a85b34f99a8875387483d8b9dc4a768df46

Analysis

max time kernel
179s
max time network
128s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01-08-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa2b9a5ffb90f0ef7dba72bde9c97a85b34f99a8875387483d8b9dc4a768df46.apk
Size

4.8MB
MD5

263282ae6bb9e3f5a0202b896f231506
SHA1

ce953a6cb0baf40454be94257e5f61ff8935c5fb
SHA256

fa2b9a5ffb90f0ef7dba72bde9c97a85b34f99a8875387483d8b9dc4a768df46
SHA512

0776e5672b97f87a707952cc56008f6ad78888b45e30a542b9332b24076bebb402492924bfe1227629c73248b167449e7a9a8e5069a6621242b9ef54a54b459c
SSDEEP

98304:10YlVjrBbQMO8O2KGUJEeVa5loxWL6NCQ7Srlb28E2IH:aYlkn2sVFxOQ2NE2IH

Score

6^/10

discovery evasion persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	dmb.kxel.drf

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	dmb.kxel.drf

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	dmb.kxel.drf

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	dmb.kxel.drf

dmb.kxel.drf
1⤵
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4242

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/dmb.kxel.drf/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/dmb.kxel.drf/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
4a7d10fa5b0cf51100fb648d2b2a2c37

SHA1
eb2ccd45b4becccc79893a9c3855352019abe2bf

SHA256
dcd7693966e453393d2083b85701929bedd840050abb03933d0288036b79de7e

SHA512
6050e286d3a9addafc05f8b16748de36c33651c6687a301eb595195a100929e7e19d8899b6e1707bf61850228a13725d98d5ef26f532c6e32ce2befe6cc01d2c

Download Submit
/data/data/dmb.kxel.drf/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/dmb.kxel.drf/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
7546bae9566f09445d28b50bfc86e154

SHA1
7cad6b97d27fdeb972ac070c610c008cbec37465

SHA256
b4ab937f15cea24fa699c71d9314487fb4852c3a7e65a733f1f47ebfe13b50b0

SHA512
e0c5abf9f7141e4dd4bbb94566a26869005b96e07e975976ba7ac55dc03cce2006219ba48d910053d59e7e1f928676799cd4afd49e77fcb76347b7ac6c3e7f15

Download Submit
/data/data/dmb.kxel.drf/files/PersistedInstallation4161535513756803423tmp

Filesize
90B

MD5
b61c5f0cf410bd098dc67375aca69dd5

SHA1
accf6533d18298d7f39db50b84e1f6498dac7c0c

SHA256
f8e37516d87ae2973f8385d39585ea28983f871a1a11fbf6082022d002247e97

SHA512
6d22c3c68fb0fff9db1ad8acc38cf40653af5d91d836f69ecc3fcc4a35ec14e39ded6ba7a02de96262545f9e6c8a6fe151f950858b98268b278f526bd98b154e

Download Submit
/data/data/dmb.kxel.drf/files/PersistedInstallation6358935027833996950tmp

Filesize
569B

MD5
a3797cd7940701ea5303bcd4d0e9d9e4

SHA1
c85e5f0051501df901e65e32826a9390b42464f7

SHA256
c42a246f46b9d6dafda89748c6435717b2b4c7cba5fe53071d2c3d2c4fe3d8f2

SHA512
854ac5e6c63e296f0d1c574c2584ae1943619266ce3bdbfbc9813d04e5fc715912ab17640aea67fdbfd37fb8e63ea2e3bd94f8dbc945d4bfa3d4d323c7005baa

Download Submit
/data/data/dmb.kxel.drf/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/dmb.kxel.drf/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
e43a1477e1027885ae4f4c2a0b0defd0

SHA1
c8a884087d51f1378276629bf9534259a21594d3

SHA256
614bf736bec20d654caae1929ce207d9199e47d627bdefeb1b01ad1ed2b5fd2a

SHA512
3a0d7cbeba1dc12a2a4cab282caea8f95ee0822124db30a9bedecce8aa185c82ef93815333ad8c8ddf8c3c3e098f1f7e772feb3b2364d59b19974a20d91b4f94

Download Submit
/data/data/dmb.kxel.drf/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
f1f7f529eb9740fdd7876fa5842fccd0

SHA1
53910dbfef293abcbd3919f5cdc2f46790a68ff1

SHA256
00b9aee16064a70c620d5acd68648fac9ab31901d8dfbc3fa5a3ec31c6944843

SHA512
92b5ee15bb427339d9f3ffd3296704aa8dd54436c30cceb28d8125cd58e58127f7ce7fde70ca6248fe1f5bc2e4c2e63eeea5ef2e53d273329e9352b389396bbf

Download Submit
/data/data/dmb.kxel.drf/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
2e4e53be087d962f7d540ddd65e79e92

SHA1
2c346ec25607fd13e912135d578bd355ed20f8e8

SHA256
ddeb6906a65aca1a52191f92059ef0f2d5c37a7537a0c538e6d9614d8d194263

SHA512
75074ca81e4de88b7ca58460c6f95421f803ab1b85da4e1cac591139b18bc05327c0ff7ec2240becc70ed9294beb42aa85bf3b39238b6c7de79e428ea4c2e4f7

Download Submit