Analysis
-
max time kernel
49s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
06-08-2024 06:36
Behavioral task
behavioral1
Sample
9club_v3.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
9club_v3.apk
Resource
android-x64-20240624-en
General
-
Target
9club_v3.apk
-
Size
24.2MB
-
MD5
dbaf20fc22d3ca0c06ff0d1b5cc52285
-
SHA1
58cc93b27b7e9e5828cd2de2b577f87a86a5819c
-
SHA256
85455a3b9d96860573db023408e75db826ede5ca5f33a232b349d2e8492ab01b
-
SHA512
6f1feb79246052ed29688c53a2e7cb3aa38495f030e4c2fc4d045363827c7cd716656c16457484e1c396921b35817086e8275852b6003dbff3b472a714fee686
-
SSDEEP
393216:4b+uvmtm6g5AU+kYAGP8hpApadToRLYjj6L28BCstMyuZJKeSzdmB0vO6UMaZ:4b+uvmtvgCU+xAG0vy6B8eZJKeImqDUx
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
com.companyname.x_9clubdescription ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.companyname.x_9club -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.companyname.x_9clubdescription ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.companyname.x_9club -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.companyname.x_9clubdescription ioc Process Framework service call android.app.IActivityManager.registerReceiver com.companyname.x_9club -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.companyname.x_9clubdescription ioc Process Framework API call javax.crypto.Cipher.doFinal com.companyname.x_9club -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.companyname.x_9clubdescription ioc Process File opened for read /proc/cpuinfo com.companyname.x_9club -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.companyname.x_9clubdescription ioc Process File opened for read /proc/meminfo com.companyname.x_9club
Processes
-
com.companyname.x_9club1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5054