2f586f16a1bd42d75c88bf609b4800918b6ce23b570d36277f16b8c9696b921f

Analysis

max time kernel
47s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
07-08-2024 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f586f16a1bd42d75c88bf609b4800918b6ce23b570d36277f16b8c9696b921f.apk
Size

36.2MB
MD5

6127b239eb47152afc7fea57e6940bde
SHA1

6b48c2a664b63b5a349552d0a8d0d31de89c2b1e
SHA256

2f586f16a1bd42d75c88bf609b4800918b6ce23b570d36277f16b8c9696b921f
SHA512

b016a2fe5c0af3b4f252432d2bc67bc76745b1c56483bd08214df968d0dc06c27dbcfa2b97c2f7c78218dda41b780fa154c24fa77dfd5e50c071874870adab37
SSDEEP

786432:BaR+7K3A9jjBELSKKU8vowBU3x/rb2ZB66Xph6iadmnogtbEE+Ox4XOueWbjaZAO:s4jbvP+xHYBRZjZJmUn4hy/

Score

6^/10

discovery impact persistence

Malware Config

Signatures

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

com.companyname.x_9club

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.companyname.x_9club

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.companyname.x_9club

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.companyname.x_9club

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

Processes:

com.companyname.x_9club

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.companyname.x_9club

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.companyname.x_9club

description	ioc	Process
File opened for read	/proc/cpuinfo	com.companyname.x_9club

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.companyname.x_9club

description	ioc	Process
File opened for read	/proc/meminfo	com.companyname.x_9club

com.companyname.x_9club
1⤵
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4250

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.companyname.x_9club/files/profileInstalled

Filesize
24B

MD5
eade3bca34902a5f4a527e6c7e9a0da4

SHA1
b8a09f2026574c3db9e9923bc9d0ae1db2201088

SHA256
93f3d6479b3726a0f1ba7c7e92aa186924d819f3e36784ab00d5d4074f4f8813

SHA512
ea82ead94e0949e7cb78fc4e5a86362838ff573264d84481ac67e955d13b259396a08faf80996b2f3e9b918ade990cbfeac64e5fbc21adc3cc93690d83c75be6

Download Submit