Resubmissions
04-08-2024 12:30
240804-ppf4psvfkq 10Analysis
-
max time kernel
175s -
max time network
174s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
04-08-2024 12:30
General
-
Target
Undead_Defense_Tycoon_Script.apk
-
Size
3.2MB
-
MD5
fc35546a7395a68b6440de033afa789d
-
SHA1
4afc8724e58084164148b7ce518ede8b203dce3c
-
SHA256
c1b81966fa17c4e7d5137f13b2f4d04704c97d66a54d57dcfc1f42ad1f4029e7
-
SHA512
ae32d9e7d7403a6ab0429da69fe4f803001a077327a0f103ccc9bcb90b17973ef10be8dc2cbf1909549a04f1eff5e85c81c2dfc2d99ba7fa93369efa47beca6c
-
SSDEEP
98304:BaqBN1el9eL+FB8Y2nzDNWbVAneM/EjF+894S:oqX1nk52n05AehERS
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.herocraft.game.birdsonwire.freemium1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
727B
MD59521f578414bd8a3e758f4e0c243eb20
SHA1ecf295e6075a27a1a0b5e6768b3df0e97b7e800a
SHA25635610131bd6f5d10206b999aa351fbec6846fd4f72e37c7b3ddb48d053401b13
SHA5126d1b1e2e9bb8fe8596dbcefad7106a025a3ec4b3c7c30cb5762df528d37dc559d3c184289d4dbbd6f9c915dc76d602e0db2329d565fa2841e7a66c6019553d65
-
Filesize
567B
MD568a62f7ab4012b2de624f90429ddb8a6
SHA1d5bad7d171dc4ae6fa69c19671856d4e51cb5693
SHA2566c6baabcff4825d6d3953ff8d9d60e74cfab3321f37d6bce971c11ef37854e19
SHA512dfa8e9b0806407c7ff280eb2dc8c8106b667e9e6e259d3f279310484edc2bfaae81f8ca2014936aeb9ba167a38ae064d7f0be14f0078971b757531a78a903f36
-
Filesize
242B
MD5f19888b1645f005f7b5b87b934f7737c
SHA1eea6b92c985e94a03b7a25c4a86dba6144c1eda7
SHA2568f6fc416e42ffaaa3b3774eb86da16a25b7a5bc69ca1aea3a335ed0cf4d2e60e
SHA512bc613990b04c59ade6d8f0998cf42f976e2def114200c1e56c18d1938104216379dc57d89e16a8640359daf73ea7a3e74653939f7de3cfc61758f955ae05c06b
-
Filesize
242B
MD56e03b5cee1e86ac1dc6837b8b1234104
SHA114dcce3899f769b23cb245a56e13ada0bdc276b1
SHA2565f78c4df76040aefec7e05fbc9c5648bb9bc11f09f40409e3fe1ff42997fc52f
SHA51252fa5ed0c9acdd21a348801e12ab2efab960bedd6d5dc39db1537e4943cb2950f7d677a6339a81f6616fbd69545648ee821c1b207de8f26c8e6a3cd8493750d8
-
Filesize
2.3MB
MD5a2c0379f196c91a175f47b801895518a
SHA1549b6e1c77021378b4189f736b7eb7437a9d9497
SHA25635cdc216518a388e7842f6b67a2c65ea06ca5302286087df3a9db29603b9aa21
SHA512e3ebb67eb0a9c9e13db1dd29474bf93af6e0e3b9607623c0a70672bfb4f2505abc1f2c23e1592175317bc4f384fb7966954f0d37e6f331f7eb724ff5e6be4205
-
Filesize
6.4MB
MD5670d8683a3c1765ced65f8b60bfacdba
SHA124bc8f1ec3e925316fa05918fed1962379debe15
SHA256fc48615db02bf829b738c5efef9cfc368b27c0a40fe69d4fa165cf59b0d6cc9f
SHA512c6e7c7104c31d2b567874fed9684c172b1dc722d084ab998b0159420554e27ce044ed8b0099194919c18d782ac9d075962c966c602eaaf021f36d9d262bbc9a8