Analysis
- max time kernel
136s - max time network
159s - platform
android_x64 - resource
android-x64-20240624-en - resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system - submitted
02/08/2024, 22:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10048990dc7e46a41dc3c0b5491c59111e1125f0a57ecc698848472b50d92515.apk
Resource
android-x86-arm-20240624-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
10048990dc7e46a41dc3c0b5491c59111e1125f0a57ecc698848472b50d92515.apk
Resource
android-x64-20240624-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
10048990dc7e46a41dc3c0b5491c59111e1125f0a57ecc698848472b50d92515.apk
Resource
android-x64-arm64-20240624-en
6 signatures
150 seconds
General
- Target 10048990dc7e46a41dc3c0b5491c59111e1125f0a57ecc698848472b50d92515.apk
- Size 98KB
- Sample240802-1yl7vsxaqd
- SHA256 10048990dc7e46a41dc3c0b5491c59111e1125f0a57ecc698848472b50d92515
- MD5 fd304f27dfd5fe60d46f5fbc05b55817
- SHA1 a33d4d22ebddeb58e1ec063c2aedb60823c8d991
- SHA512 b2f17535e95aa9902b9a12ae703c17f824e9c8fb7a2c006a6377febbf40b65c544059d61ca2dfa48b9ce5b5c0b541c193cf3dce215e2c0daa5694416e6bee9e0
- SSDEEP 3072:Iy1eBh8scStAlKxjexWPxx2W3aRmp7l6LgNZHYjIm793PzDoZkbc:F1Ch8sjexWPD2W3EmNNZ4jIKz86bc
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
pid Process 4959 com.pestvpbc.jrpbwi - Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.pestvpbc.jrpbwi/app_qebzkgows/pehmuns.jar 4959 com.pestvpbc.jrpbwi - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.pestvpbc.jrpbwi - Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.pestvpbc.jrpbwi - Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.pestvpbc.jrpbwi - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.pestvpbc.jrpbwi - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.pestvpbc.jrpbwi
Processes
-
com.pestvpbc.jrpbwi1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4959
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.pestvpbc.jrpbwi/app_qebzkgows/pehmuns.jar
- Size 47KB
- SHA256 2d26ee7546473ed5bdd1dcc5b5ce906ac97e8243bbf3f60f5a22a9c2a52c25b4
- MD5 0b20a9c44c78c58d6edf3edbaf6c0a4c
- SHA1 27628ac30dc1e890ce99e4f4a019f74d5c82c6ee
- SHA512 aa0ef19d7a3affb20d30126f1785d717ef7b55616a4e300de395a0ff82fe9c801e4506a551f2a698abf2cbb966f3fa7f06dfdf4d4468f1c3039501ee249ff278
- SSDEEP 768:KbGOlBe97w6Y2iPxw7PuznuVoGmQypQwyRmshpImxvkdRYzTfHfM0+xCIhdDjah:KRaGw7kns2pQwE8McCr+xCI7DWh
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.pestvpbc.jrpbwi/app_qebzkgows/pehmuns.jar
- Size 109KB
- SHA256 5cb62df108af426b5f08b794ba000faf4cb6c67292e01a440443f8bda45a57a6
- MD5 675fb61b5398629fc82a874a7543df02
- SHA1 ff6eb302b90ec4317ff42b8c77587227d1a91771
- SHA512 00813b26bd9a1c0f9cac9c206a2eb81b685eaeb2009150615c08898d350a92776b3cace229b3e7c083010074faafd153b9117e431bdfd3ee86f852a0a34b68c4
- SSDEEP 1536:g+G8yA9LI9lqV22bz1EEOGdiwj7kJtzFT8Wpn/fkIqGnm5xX6AfzYBhPVgIfYruO:o8BI9E1bz1FOGdB8VlnxqGMl6nVgIuP
- MD5 SHA1 SHA512 SSDEEP