Resubmissions
04-08-2024 12:30
240804-ppf4psvfkq 10Analysis
-
max time kernel
179s -
max time network
137s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
04-08-2024 12:30
General
-
Target
e8947bc9fb2bd597daba3064d5fab275d8df2beac92f301063f22fe276dcbc10.apk
-
Size
3.5MB
-
MD5
990bf5a2e9a7c90c75c9c07bf4a5e634
-
SHA1
ade24475ee8a9a2a0eec43772bbc02aeacb5926c
-
SHA256
e8947bc9fb2bd597daba3064d5fab275d8df2beac92f301063f22fe276dcbc10
-
SHA512
40419371a8dd596e8930e298e0d5470efd168a6d1a8425b8aa6eeb4e495cbc49580f234ac4278117600e2ff516ebdd867e6d395d67c80ce56660d1c8ca9ec92f
-
SSDEEP
98304:8mRW7NIyWHAt/2qcPf7K+KjXZKBEjzZST:8R7Wgt/GPjKPFK2XC
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.herocraft.game.birdsonwire.freemium1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.herocraft.game.birdsonwire.freemium/databases/com.google.android.datatransport.events-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.herocraft.game.birdsonwire.freemium/files/pxxFilesize
229B
MD5d8f5443da12abe2f2f41ec045b8ec608
SHA1a6bcace4ee434ddc697036c352bdf8d2e1a196af
SHA25646da53a47f0cc1e559e940fa0ea797336c9413fb442911779d98a5aebbee3091
SHA512be486e4fde193890700c7ab64891bce0057656a9f62cfeaa404e65540a0f0393da34da8b20e1c90a23bbf971fb868d8172ce91d35c53f244ff7954b172976236
-
/data/data/com.herocraft.game.birdsonwire.freemium/files/pxxFilesize
229B
MD5469b84bd32218f45f278275a90cab77a
SHA11f2bf3261f6dffcfe6ff12935cee528900088df9
SHA256758bae075d257b15de49b80d56352373628c35acf7fbcff13c81395607055f32
SHA5121c858472790cdf60c1e0fcc9d0435f664169efd0d05a19418cb92b74bcfc716219d4ee2f409ad14d30b83eb4325c7a680ea95319bc1b8522a1c979cb97afd572
-
/data/data/com.herocraft.game.birdsonwire.freemium/files/quFilesize
731B
MD594117f538fb09d18309b16fcd5328262
SHA129943f611a22a41ac864609d9049ba6266d435f5
SHA256b09abe2f92ad963571c606b68e4183aa689247ca2dccd40e039722c447db3599
SHA5120b0868704bca5718ea86deccc82fd08024c1d7b52ffb76d17c016f7c7cd17b8c7715ff8108f0ffb13d65d2232ff5883b048eb9491e99229d907b50cdb7fbe16d
-
Anonymous-DexFile@0xd3463000-0xd372550cFilesize
2.8MB
MD5862273f2c6de4c25816b5cb1ae006df9
SHA17c4c0026bc157cfc104ad91980d3c40b2d5e78ce
SHA256c77d7de1df41842245f63cf10e13aed92fca563b8aa81a3888b4f142a5314f90
SHA512688ffa31ce578992ad659df808bce82f88e4b86c000c08ce4b6873f6dd743cca5e65583fb0f98b408ebd45cfebe2634290f12607429f26a5a37a716771eecd06