Analysis
-
max time kernel
31s -
max time network
1833s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
07-08-2024 05:28
Behavioral task
behavioral1
Sample
hack-app-data.apk
Resource
android-x64-20240624-en
General
-
Target
hack-app-data.apk
-
Size
6.4MB
-
MD5
2a19b8bcfd9dfa131f495b127df0bf32
-
SHA1
e97b2b52cfc96a28a46cf615c69d74f4e1731a79
-
SHA256
540036d3f23c660326a4f4399f5ec3b50beaec69cf1bc2b6a3ac87d52ec132bc
-
SHA512
00c23970ebc98499eaa59f6269dbcb35f74678077d3bba25bfbc030fc735e9bb570bb8252f46087804acbe95c9cd619dc1d29d3b705a39652ca7b8b59b23642b
-
SSDEEP
196608:mJWuz0Ip2Emygq7JbchJiiTWjCA03ZtWFW:mpz3p2EQq7hcpdtT
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 8 IoCs
Processes:
com.gmail.heagoo.appdmioc process /system/bin/failsafe/su com.gmail.heagoo.appdm /system/sd/xbin/su com.gmail.heagoo.appdm /system/xbin/su com.gmail.heagoo.appdm /data/local/su com.gmail.heagoo.appdm /data/local/bin/su com.gmail.heagoo.appdm /data/local/xbin/su com.gmail.heagoo.appdm /sbin/su com.gmail.heagoo.appdm /system/bin/su com.gmail.heagoo.appdm -
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
Processes:
com.gmail.heagoo.appdmioc process /dev/socket/qemud com.gmail.heagoo.appdm /dev/qemu_pipe com.gmail.heagoo.appdm -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
com.gmail.heagoo.appdmdescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.gmail.heagoo.appdm -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.gmail.heagoo.appdmdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.gmail.heagoo.appdm -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
com.gmail.heagoo.appdmdescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults com.gmail.heagoo.appdm -
Requests cell location 1 TTPs 2 IoCs
Uses Android APIs to to get current cell information.
Processes:
com.gmail.heagoo.appdmdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.gmail.heagoo.appdm Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.gmail.heagoo.appdm -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.gmail.heagoo.appdmdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.gmail.heagoo.appdm -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.gmail.heagoo.appdmdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.gmail.heagoo.appdm -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.gmail.heagoo.appdmdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.gmail.heagoo.appdm -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.gmail.heagoo.appdmdescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.gmail.heagoo.appdm -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.gmail.heagoo.appdmdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.gmail.heagoo.appdm -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.gmail.heagoo.appdmdescription ioc process File opened for read /proc/cpuinfo com.gmail.heagoo.appdm -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.gmail.heagoo.appdmdescription ioc process File opened for read /proc/meminfo com.gmail.heagoo.appdm
Processes
-
com.gmail.heagoo.appdm1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4934
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34B
MD519fff570ed707d795c5bf628a6eadf9c
SHA1411049c39050bf83b2ed0b66c689c69521137b5a
SHA256fe3f327bb5dadc7ebf000dcb653e0a4d97c20aff0bdd52dcfa40f498b3062473
SHA51240276999049b04356c3de3ea6d16cb4f8e3e2f1dd6908164c957284446ce4eddcc76f583fc90e90044a1c0fd4de069afbc310614a6791185e71b116b64cb8f93
-
Filesize
668B
MD5921561c8ba4cc4a516632ed2d8542e0e
SHA1a42e8780906a1b17fc4fda2934e7c0c847c3fada
SHA256db5d41c215bb085ec3fcc01889968746a1896bca956abebb6f8cf9e2deca0388
SHA51217e83516e67a430560f7341544cb28c1f4237d967c1a57f0abea49c5d960a0a3d9d67a925ae67544791ea51fc2f89c433aca157623bc901abcfd13fb2c75eae0
-
Filesize
1KB
MD5a8c713fac1212618efdc86c53aa4b1eb
SHA1afaa2551f88503f4f424b38a3bf119913fd5b129
SHA2564bdfcfc78116d7c100ece9ae01283de4031cc1132b5b4f4ab12bc7a413ba351a
SHA512431c189998df57581819e4f83ee4f6d11aa36d6d503b3e51cfb5982f511adf077642c70eef42e3419697a0455bea8ead264071f652a97a75ae1fd5924842a9a9
-
Filesize
1KB
MD57654d7cbebe668af06a6fcddcd47dfeb
SHA13b0672e6be0fa79ff3733ced2d80ddf496ba71b3
SHA256660a227cb1b0ad19617dc561fb2b5073e4dfc94cfcd648d2a75f38dc9552a095
SHA51235e16acef5011f9431328c6e4173fec5472ade5881e990dc69c9070809c7aedce62bec2da594140118e22f41a48244d4990d9fb699e8f7cd93b3f148e583a86f
-
Filesize
2KB
MD5d767d5fb76e7b1bfd2d0400deeffebcf
SHA16d6c540c7ef7f5caec54fb6a4c91c628425e8b35
SHA256c26c6254b4710db963119c0733885d773fdfde7480ba7b65d27bb3a524a6ebd6
SHA512d1ef387d80a78e3802d10628b545d249273214198c7caf0928eace2f4bc0cbcc017519e78987c9840c1fa20c980aed507cfe2d47b5ad04e29254475535565513
-
Filesize
719B
MD5447b479a214536d00d4322b9dfa69227
SHA1a29a06b52d86821fd8c607c66aa479db49b7556b
SHA2562589cf6dbd4ef06bdcfeab283af9abf4f21f154ff382af8c6d3788497794c157
SHA5126f3b93cde848935b4975d9959188aa43b71bab8cefbdf4fc692f4f467174ab377103b87765281e20e1b072c32f2b95595c4bf9be8b4da4b53ef928afeead831f
-
Filesize
696B
MD5427cd9180746ffb02c19583ec1f0aec8
SHA1866ec49a076170564ff497613b7bbb88e1a62ac7
SHA2566517fda4e17a504af6628a6e1b58c5711e905f72dc6ec2eda6b31ee2a90f6ce2
SHA512eb14f7f02cd385d670413e4941b2aecf269427bfb81e9eef3088a52a85c5cbdc073eec490afebf9e94b3ba650dd704343fb96bef14957263cf605be1d368c03f
-
Filesize
974B
MD5f54754154700f9911983ee0f74d5d8a7
SHA101264a97cc94e850d0afb4bdc44167cfa84af066
SHA256cdc40ee2a21245b793a9d2b525cb69ef2cb458c1c1407add604d9ad3e0869c48
SHA512e03627cff4dd5cd97355d9d16e8abe952040a8e83cf4cfe8b16c85e6b020c797b4f96da8968864cc65883dac045210fe5b3f3cd67c604b2a954d6801ad341284
-
Filesize
884B
MD54bde471e7a872f0ed7688cfb104adece
SHA1c43a64c8687503dd8970cd5eb6018f5174fa0e1d
SHA256dbc9aa7f48ecd75278130d3846b1ce2daaaadcda37feaf79ec2fd8b481539af6
SHA512a3067face23e2727a57a889f3d1892a69cbb1bfa2cd5902317af34b558d6ff2879507dc891d294fd90c30073233cd197ca0d6ddd052052f9f685b34f776c8729
-
Filesize
6KB
MD5bac2ff0dd5fce2cd99ea8b53617660e1
SHA147ea8d8e611a0e3bf93182f2b2ce3f46aa629a71
SHA2567f77aebcf0de6c49dd36673ce0322456f1d8390acdc97fd4b1ef9540bb65ea49
SHA512650c32e79a2bed236f85427af4440ec3230bff0a6e049215665e6e83887ebdabd1efc10d2c64da4753ffcb14dbfa9fdfbe1975ea8aaf02c57e8ff3cb02cff232
-
Filesize
3KB
MD588e1eaa903cd20aae3c17790fe4b06c1
SHA155ab3f2f2339b1f04dce43cf8774e896f7e15515
SHA256ef5d50db320a670b902f52c0b7406358624d1ff8b35c8429b7b51571074415e2
SHA5120ad3c0c564839f361ca7b38cb526e0e7adf4169db22cba2b6eaf40fe3350edd3e7c6afb7abd5d999ce0f14a364b9e66ed05edec152fabc648dbb5af9c4f33b39
-
Filesize
1KB
MD5156f6ea2ec88d8301ab9d7980d03e4fa
SHA19a494283950251aeebb5dec43fa21069c130fe96
SHA25652782317bd11f7b40dca95912c288ee3917a767d9d6a85068eab0d683b275f29
SHA5126bae49341198b4d900b0465c9f52a0cbd6e471cd87852f462e0bbd26d498cf683cf96b1ea7119233294f2f1be836065f9b4ce6e5dae158a4a693fc1cdbb877b9
-
Filesize
1KB
MD5f8a55848c437e9b3f5b378bdc146e471
SHA1bdcaa0956be0049d0556c296e2d70bf7be3d62e1
SHA256191055a84affd48c647273af3c6b5292b6ea457700a0d9040d5ae968c3293f6e
SHA5125abe778b401d1996b329a4076b7a0a778ac8f1b7d030d46cbbb11456cf371d8987db23b587fa04ce3105c79242c86af64bb83f64ac622f879cb915b2ca0d6df7
-
Filesize
41B
MD51fe0b487800843a82d02224706c6ed4f
SHA19b29e373ff48b542fcd9c988c68a8120d766d0b7
SHA256c7243011daf27f9f7826a172e4d548569f6ac38d7acf0b7747d33a6c9c25d3d8
SHA51292acd5d1aced406a936194cd7ad3a8280364c1a7921912149c6f261e5dbadf39f5d58d0d73f534f8c247859e950f38fa91381f8ee41a2f5628449abe484a55a5
-
Filesize
91B
MD577c4460b96d76ec98a13f62a7f30313b
SHA1081e4dd3ff0ba95da68d7ee5147586e1ac78c256
SHA256322432777bebd100a08393f22fb9364809e48ebbdec0542a31980c6fbc42b3f0
SHA5125037ff1a446bcc8914a39beb2feabaea521688e771889c270d5f26b012a6fbec5cb40c6b95e5b1cfb4dbc56cc19ab262f6cf0f8745d42df1c65bc33824d4c11a
-
Filesize
26B
MD5c4b2f4ccbff197198574f17c6f12d431
SHA1637db2043ccf037507d4f4a7f0151b9214f5e626
SHA256747dd585c25f968e513c2cf962eaa5aa8be77ba6c666de0960e96dac3a5d7ad2
SHA512faad6d350ff5661bcaf3ad7a41164172df75995d7956111cdc40953d33bdc9ed4e0728ffba932cc792480e9cdbe28b2ce519423b2a40f2c9411b78249a4517e0
-
Filesize
1KB
MD5ebc06fd3d86c27a426932a83325eeffb
SHA1461c990e677114de3baba2a33f0a60c0a10bb9d2
SHA256ada010f03b82133ccddb4ac69a7c81a1d507121ef1d276c7c191bb55401c2230
SHA5123b3c682dc3876f7c813bff1a38e53e0c20f6c776eeb8362a8a750b81d0a3132a207b01740a493c61a03261748399e020aec5fcb7354c723e4f5703efe5418b2b
-
Filesize
1KB
MD5355eb0af21063fefca005d93d6afa9c9
SHA1f854e3d2f0c0470a54e55f31017f9c499bd3671d
SHA256b50339f939827a8e5a918ee4ed1d8213e27f6d546a98313f90449b27a1ebc00d
SHA512ffff59e303636383dccc1282dea4c13b8c46d9aea1d646d745f7d26607cfabc25aea8001af873942749129291abef5dc5a858e7360cbfc145f870b80689b34e9
-
Filesize
1KB
MD5cac9a26c27728066be7a285defc0df6c
SHA19931d42eea7663aaec4eb901bcf279b246c19e34
SHA2569347cbd8e6e2af4d09759e55b7595474648619da07992d6485b9756ab4d8170d
SHA51211a3abfc4558e6c887f1f809a3837ffe6f4c1702407db945319acacaa5e677f6b117c07ca676cda6438639a1ebc447a2993e0ff31be8ef797bd219700f508ba5
-
Filesize
2KB
MD52d858e8af5d9426fe061df5c82ffa6ff
SHA1bc1b2eab876aa221b6449d11e482de24b777d58f
SHA25673d875bdb982c50c666e30ba2b8ae2dceecc63cd0d5f8a35158edfe5f3303835
SHA512aabaa75856cfc07bf65f3f2dae118e357cba83a45f0a900aa625f576de47c2753b0a00fb1913e45c1d743acc0f6e0100a4a6a326f402b0f4664ba181ad670c0c
-
Filesize
895B
MD576ce13c6312eb334fd351e3b5cff4bf4
SHA1203bd863b812c071ab3ae25bf4ab2f9c4d42942b
SHA256f0a8e8d6b8bcb84e466f921dfb20a91fdd4e4b1777d9b0be6ad4d03d4a253af8
SHA512d06ba34786090e3b027670a17910d2e35f48eb7bc639e6da1d08214534215797dadd1a56be44422b176801e5d1a1345cd2bf29e73acb6a49bc9a2f7670710783
-
Filesize
753B
MD5317f802aacfab6282b8f74f280e841c1
SHA13b746a76f6322e97fd6c09a43d03ac14631d93e1
SHA256f37f9a17c20ca3068f4f9db08c262c62b7b86544532f612a78421bdee92f4196
SHA512a714f902ede615507cef840dcc03a5eca183c21c82cc419a924587f38b6974f5aa45fcfcc2bac4d6cf82b81d1b6ad452540e0581751bfcad72e524c83757a301
-
Filesize
1KB
MD59ee047a6801bec9459a9dd5ec7068078
SHA11aaaffc208e2d86e53fc031e8413169850e65746
SHA2569f63f6c9ed9d33f235c30508df34c3358b55cac8bfb4967fc3e15afc61a6fd12
SHA5128245818df5ffe06c8f369c8d77479f9f2163d10dac36b0e37c834018b713dc8b063ec1de1862fe16a8c1a769b496652be880ddd48d6fcd24ad766a395bc3ff24
-
Filesize
1KB
MD512bfe20382337a84c0fc004a52b9ba9b
SHA1ead15f7ef372c16f78060b8f8c5fc6e0ca6a96f9
SHA256621fbcd864a7dceacffddb00a682148042732aeb675e22cd42b1a0937c6717a5
SHA5127a346febc49154dd348be77f88c6e7ed5c7a531c2fed981f12c40e22a19e4e1a5c51fa766b3122898d97f05e1546a6f2a29b598b0ff441cc7de5e3c505aa33c4
-
Filesize
895B
MD5a40e6a567b7aef329bda0ac200f7a23d
SHA12fa463649c7ba586b28670675a15e0d7a630c7e0
SHA256ee0933e12dd4e302b1e18572d22f48861e8125e5d0201603e024d18ef5e38556
SHA5125e77ca21445a09aa903ca08c10c1bcaf769d8273368b7981aacf1bbab08cefb7a521687e78d280828f46b625c99fde02050f5c914dd4d07fd742723f7713ee4f
-
Filesize
2KB
MD545c24a8686a0978086c99f7039accc17
SHA1c63ae2601322045390c7a4f230602b74ae18d2d8
SHA256bc9c4aa36a0dd7efe16a8b3bca9172d970fd13d70d3e718aad17a78269079912
SHA512d5861c64b9dc9139904c3bfc7da26fa6f3d9676a5b4203ad617c661d54d3716508fb02f282f5c204bf9d6a0c7162bbb565a44f2ceb96d825177065818b797727
-
Filesize
9KB
MD55ee00f0a2fe39b7bbfd6b9cd0bd8f88e
SHA1326bab3a574c51c1d353939964f1b6026b2c3067
SHA25691ce9d7824908beebeff6d3177d07e52a8f6069ba0926e084c2e6d4444053eff
SHA512606ceabd0c004bf939b6f3e6b53993762aa4d1d727a277f7379b6be400c25e0f492af66068e3be29a4ba5de86a0098d8681c2a9932e1252285fca55286aac5c6
-
Filesize
153B
MD565026ee778e1372d9f4aed742772e893
SHA15a5f1c821d7639424f3c75a44468ab5f7dd4e8cc
SHA25615070f52136d5a8332f8d70f790bd7bb04cd6a99b386d40e0abedc40c42caa3c
SHA512589c4a12c6b6ec1a1cca957da758aaa900e68a23b4bc2f42524b0e8dd34f6c5378541d9293eae1ae8d478bf5b5229ce4218c058fc3b399eb5756afeb05c68616
-
Filesize
181B
MD55f1a61cd768d1d0d2ba1f41af39ed1d6
SHA1e9efaab032c07d485ba10b77448eb05eafb5a8ce
SHA256323711ea097e99a032b55fd7c52e319f64c28762778f63760046ba3f368bc082
SHA5122a89c90459c010d2e0a943bc5fd085d0472d9c167e827dc7d25843b66a88e284330827767c4978a96ac3c763fa18242bb225590973fe0ca2fd321d28b04e4d12
-
Filesize
676B
MD51b759349f0bf3e55c51e2a2c2802b3cf
SHA15a608a093fa5f513d1ba52e8a9e01f693c47da98
SHA25659d83bb6ebc5394c048273ea9e1516a2bc7a6f80212d53f81ee44cb1f9b65443
SHA5123b39d22d0f8368dac2e36884b0316c5aba24180f51cb3a993fdefcdcfd5a36823d6c02c75863cd5a3bc0808223dcadf9934d548c433332bb9528f0eb8cecc0a6