97e63e6063345318325b666c54cdffb474725349d948626ef5671bb22020e335

Analysis

max time kernel
162s
max time network
183s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
02-08-2024 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97e63e6063345318325b666c54cdffb474725349d948626ef5671bb22020e335.apk
Size

44KB
MD5

6c92b035eb2d537146d480dfb1d0cec8
SHA1

825fe03f6a74c64c67c9d3397e171c9fd0c1bbaa
SHA256

97e63e6063345318325b666c54cdffb474725349d948626ef5671bb22020e335
SHA512

e6de2a14225f0d14d669b799a00974255ec6e266ee454e3326e422088c21bb2836b93b11f9a6d6d3367e1ed0e5140ee4a7f1df78e9dc5843079e4eca0c7a3e0a
SSDEEP

768:qUAcH4h5nNNW35xw2m0sQZnBF2pDAY9NAWW/GCFzKmK/3Sd7:qj35NedFZnOAY9NAWWdFzkvC7

Score

7^/10

collection credential_access evasion impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.flayvr.flayvr

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
24	drive.google.com
26	drive.google.com

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.flayvr.flayvr

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.flayvr.flayvr

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.flayvr.flayvr

com.flayvr.flayvr
1⤵
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Checks CPU information
- Checks memory information
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads