Analysis

  • max time kernel
    31s
  • max time network
    1833s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    07-08-2024 05:28

General

  • Target

    hack-app-data.apk

  • Size

    6.4MB

  • MD5

    2a19b8bcfd9dfa131f495b127df0bf32

  • SHA1

    e97b2b52cfc96a28a46cf615c69d74f4e1731a79

  • SHA256

    540036d3f23c660326a4f4399f5ec3b50beaec69cf1bc2b6a3ac87d52ec132bc

  • SHA512

    00c23970ebc98499eaa59f6269dbcb35f74678077d3bba25bfbc030fc735e9bb570bb8252f46087804acbe95c9cd619dc1d29d3b705a39652ca7b8b59b23642b

  • SSDEEP

    196608:mJWuz0Ip2Emygq7JbchJiiTWjCA03ZtWFW:mpz3p2EQq7hcpdtT

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 8 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Requests cell location 1 TTPs 2 IoCs

    Uses Android APIs to to get current cell information.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.gmail.heagoo.appdm
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu pipes.
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4934

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.gmail.heagoo.appdm/files/Mint-lastsavedfile
    Filesize

    34B

    MD5

    19fff570ed707d795c5bf628a6eadf9c

    SHA1

    411049c39050bf83b2ed0b66c689c69521137b5a

    SHA256

    fe3f327bb5dadc7ebf000dcb653e0a4d97c20aff0bdd52dcfa40f498b3062473

    SHA512

    40276999049b04356c3de3ea6d16cb4f8e3e2f1dd6908164c957284446ce4eddcc76f583fc90e90044a1c0fd4de069afbc310614a6791185e71b116b64cb8f93

  • /data/data/com.gmail.heagoo.appdm/files/MintSavedData-1-1723008534463.json
    Filesize

    668B

    MD5

    921561c8ba4cc4a516632ed2d8542e0e

    SHA1

    a42e8780906a1b17fc4fda2934e7c0c847c3fada

    SHA256

    db5d41c215bb085ec3fcc01889968746a1896bca956abebb6f8cf9e2deca0388

    SHA512

    17e83516e67a430560f7341544cb28c1f4237d967c1a57f0abea49c5d960a0a3d9d67a925ae67544791ea51fc2f89c433aca157623bc901abcfd13fb2c75eae0

  • /data/data/com.gmail.heagoo.appdm/files/StartappAdInfoMetadata
    Filesize

    1KB

    MD5

    a8c713fac1212618efdc86c53aa4b1eb

    SHA1

    afaa2551f88503f4f424b38a3bf119913fd5b129

    SHA256

    4bdfcfc78116d7c100ece9ae01283de4031cc1132b5b4f4ab12bc7a413ba351a

    SHA512

    431c189998df57581819e4f83ee4f6d11aa36d6d503b3e51cfb5982f511adf077642c70eef42e3419697a0455bea8ead264071f652a97a75ae1fd5924842a9a9

  • /data/data/com.gmail.heagoo.appdm/files/StartappAdInfoMetadata
    Filesize

    1KB

    MD5

    7654d7cbebe668af06a6fcddcd47dfeb

    SHA1

    3b0672e6be0fa79ff3733ced2d80ddf496ba71b3

    SHA256

    660a227cb1b0ad19617dc561fb2b5073e4dfc94cfcd648d2a75f38dc9552a095

    SHA512

    35e16acef5011f9431328c6e4173fec5472ade5881e990dc69c9070809c7aedce62bec2da594140118e22f41a48244d4990d9fb699e8f7cd93b3f148e583a86f

  • /data/data/com.gmail.heagoo.appdm/files/StartappAdsMetadata
    Filesize

    2KB

    MD5

    d767d5fb76e7b1bfd2d0400deeffebcf

    SHA1

    6d6c540c7ef7f5caec54fb6a4c91c628425e8b35

    SHA256

    c26c6254b4710db963119c0733885d773fdfde7480ba7b65d27bb3a524a6ebd6

    SHA512

    d1ef387d80a78e3802d10628b545d249273214198c7caf0928eace2f4bc0cbcc017519e78987c9840c1fa20c980aed507cfe2d47b5ad04e29254475535565513

  • /data/data/com.gmail.heagoo.appdm/files/StartappBannerMetadata
    Filesize

    719B

    MD5

    447b479a214536d00d4322b9dfa69227

    SHA1

    a29a06b52d86821fd8c607c66aa479db49b7556b

    SHA256

    2589cf6dbd4ef06bdcfeab283af9abf4f21f154ff382af8c6d3788497794c157

    SHA512

    6f3b93cde848935b4975d9959188aa43b71bab8cefbdf4fc692f4f467174ab377103b87765281e20e1b072c32f2b95595c4bf9be8b4da4b53ef928afeead831f

  • /data/data/com.gmail.heagoo.appdm/files/StartappBannerMetadata
    Filesize

    696B

    MD5

    427cd9180746ffb02c19583ec1f0aec8

    SHA1

    866ec49a076170564ff497613b7bbb88e1a62ac7

    SHA256

    6517fda4e17a504af6628a6e1b58c5711e905f72dc6ec2eda6b31ee2a90f6ce2

    SHA512

    eb14f7f02cd385d670413e4941b2aecf269427bfb81e9eef3088a52a85c5cbdc073eec490afebf9e94b3ba650dd704343fb96bef14957263cf605be1d368c03f

  • /data/data/com.gmail.heagoo.appdm/files/StartappCacheMetadata
    Filesize

    974B

    MD5

    f54754154700f9911983ee0f74d5d8a7

    SHA1

    01264a97cc94e850d0afb4bdc44167cfa84af066

    SHA256

    cdc40ee2a21245b793a9d2b525cb69ef2cb458c1c1407add604d9ad3e0869c48

    SHA512

    e03627cff4dd5cd97355d9d16e8abe952040a8e83cf4cfe8b16c85e6b020c797b4f96da8968864cc65883dac045210fe5b3f3cd67c604b2a954d6801ad341284

  • /data/data/com.gmail.heagoo.appdm/files/StartappCacheMetadata
    Filesize

    884B

    MD5

    4bde471e7a872f0ed7688cfb104adece

    SHA1

    c43a64c8687503dd8970cd5eb6018f5174fa0e1d

    SHA256

    dbc9aa7f48ecd75278130d3846b1ce2daaaadcda37feaf79ec2fd8b481539af6

    SHA512

    a3067face23e2727a57a889f3d1892a69cbb1bfa2cd5902317af34b558d6ff2879507dc891d294fd90c30073233cd197ca0d6ddd052052f9f685b34f776c8729

  • /data/data/com.gmail.heagoo.appdm/files/StartappMetadata
    Filesize

    6KB

    MD5

    bac2ff0dd5fce2cd99ea8b53617660e1

    SHA1

    47ea8d8e611a0e3bf93182f2b2ce3f46aa629a71

    SHA256

    7f77aebcf0de6c49dd36673ce0322456f1d8390acdc97fd4b1ef9540bb65ea49

    SHA512

    650c32e79a2bed236f85427af4440ec3230bff0a6e049215665e6e83887ebdabd1efc10d2c64da4753ffcb14dbfa9fdfbe1975ea8aaf02c57e8ff3cb02cff232

  • /data/data/com.gmail.heagoo.appdm/files/StartappMetadata
    Filesize

    3KB

    MD5

    88e1eaa903cd20aae3c17790fe4b06c1

    SHA1

    55ab3f2f2339b1f04dce43cf8774e896f7e15515

    SHA256

    ef5d50db320a670b902f52c0b7406358624d1ff8b35c8429b7b51571074415e2

    SHA512

    0ad3c0c564839f361ca7b38cb526e0e7adf4169db22cba2b6eaf40fe3350edd3e7c6afb7abd5d999ce0f14a364b9e66ed05edec152fabc648dbb5af9c4f33b39

  • /data/data/com.gmail.heagoo.appdm/files/StartappSplashMetadata
    Filesize

    1KB

    MD5

    156f6ea2ec88d8301ab9d7980d03e4fa

    SHA1

    9a494283950251aeebb5dec43fa21069c130fe96

    SHA256

    52782317bd11f7b40dca95912c288ee3917a767d9d6a85068eab0d683b275f29

    SHA512

    6bae49341198b4d900b0465c9f52a0cbd6e471cd87852f462e0bbd26d498cf683cf96b1ea7119233294f2f1be836065f9b4ce6e5dae158a4a693fc1cdbb877b9

  • /data/data/com.gmail.heagoo.appdm/files/StartappSplashMetadata
    Filesize

    1KB

    MD5

    f8a55848c437e9b3f5b378bdc146e471

    SHA1

    bdcaa0956be0049d0556c296e2d70bf7be3d62e1

    SHA256

    191055a84affd48c647273af3c6b5292b6ea457700a0d9040d5ae968c3293f6e

    SHA512

    5abe778b401d1996b329a4076b7a0a778ac8f1b7d030d46cbbb11456cf371d8987db23b587fa04ce3105c79242c86af64bb83f64ac622f879cb915b2ca0d6df7

  • /data/data/com.gmail.heagoo.appdm/files/adc3/026ae9c9824b3e483fa6c71fa88f57ae27816141
    Filesize

    41B

    MD5

    1fe0b487800843a82d02224706c6ed4f

    SHA1

    9b29e373ff48b542fcd9c988c68a8120d766d0b7

    SHA256

    c7243011daf27f9f7826a172e4d548569f6ac38d7acf0b7747d33a6c9c25d3d8

    SHA512

    92acd5d1aced406a936194cd7ad3a8280364c1a7921912149c6f261e5dbadf39f5d58d0d73f534f8c247859e950f38fa91381f8ee41a2f5628449abe484a55a5

  • /data/data/com.gmail.heagoo.appdm/files/adc3/AppInfo
    Filesize

    91B

    MD5

    77c4460b96d76ec98a13f62a7f30313b

    SHA1

    081e4dd3ff0ba95da68d7ee5147586e1ac78c256

    SHA256

    322432777bebd100a08393f22fb9364809e48ebbdec0542a31980c6fbc42b3f0

    SHA512

    5037ff1a446bcc8914a39beb2feabaea521688e771889c270d5f26b012a6fbec5cb40c6b95e5b1cfb4dbc56cc19ab262f6cf0f8745d42df1c65bc33824d4c11a

  • /data/data/com.gmail.heagoo.appdm/files/adc3/AppVersion
    Filesize

    26B

    MD5

    c4b2f4ccbff197198574f17c6f12d431

    SHA1

    637db2043ccf037507d4f4a7f0151b9214f5e626

    SHA256

    747dd585c25f968e513c2cf962eaa5aa8be77ba6c666de0960e96dac3a5d7ad2

    SHA512

    faad6d350ff5661bcaf3ad7a41164172df75995d7956111cdc40953d33bdc9ed4e0728ffba932cc792480e9cdbe28b2ce519423b2a40f2c9411b78249a4517e0

  • /data/data/com.gmail.heagoo.appdm/files/back_.png
    Filesize

    1KB

    MD5

    ebc06fd3d86c27a426932a83325eeffb

    SHA1

    461c990e677114de3baba2a33f0a60c0a10bb9d2

    SHA256

    ada010f03b82133ccddb4ac69a7c81a1d507121ef1d276c7c191bb55401c2230

    SHA512

    3b3c682dc3876f7c813bff1a38e53e0c20f6c776eeb8362a8a750b81d0a3132a207b01740a493c61a03261748399e020aec5fcb7354c723e4f5703efe5418b2b

  • /data/data/com.gmail.heagoo.appdm/files/back_dark.png
    Filesize

    1KB

    MD5

    355eb0af21063fefca005d93d6afa9c9

    SHA1

    f854e3d2f0c0470a54e55f31017f9c499bd3671d

    SHA256

    b50339f939827a8e5a918ee4ed1d8213e27f6d546a98313f90449b27a1ebc00d

    SHA512

    ffff59e303636383dccc1282dea4c13b8c46d9aea1d646d745f7d26607cfabc25aea8001af873942749129291abef5dc5a858e7360cbfc145f870b80689b34e9

  • /data/data/com.gmail.heagoo.appdm/files/browser_icon_dark.png
    Filesize

    1KB

    MD5

    cac9a26c27728066be7a285defc0df6c

    SHA1

    9931d42eea7663aaec4eb901bcf279b246c19e34

    SHA256

    9347cbd8e6e2af4d09759e55b7595474648619da07992d6485b9756ab4d8170d

    SHA512

    11a3abfc4558e6c887f1f809a3837ffe6f4c1702407db945319acacaa5e677f6b117c07ca676cda6438639a1ebc447a2993e0ff31be8ef797bd219700f508ba5

  • /data/data/com.gmail.heagoo.appdm/files/close_button.png
    Filesize

    2KB

    MD5

    2d858e8af5d9426fe061df5c82ffa6ff

    SHA1

    bc1b2eab876aa221b6449d11e482de24b777d58f

    SHA256

    73d875bdb982c50c666e30ba2b8ae2dceecc63cd0d5f8a35158edfe5f3303835

    SHA512

    aabaa75856cfc07bf65f3f2dae118e357cba83a45f0a900aa625f576de47c2753b0a00fb1913e45c1d743acc0f6e0100a4a6a326f402b0f4664ba181ad670c0c

  • /data/data/com.gmail.heagoo.appdm/files/empty_star.png
    Filesize

    895B

    MD5

    76ce13c6312eb334fd351e3b5cff4bf4

    SHA1

    203bd863b812c071ab3ae25bf4ab2f9c4d42942b

    SHA256

    f0a8e8d6b8bcb84e466f921dfb20a91fdd4e4b1777d9b0be6ad4d03d4a253af8

    SHA512

    d06ba34786090e3b027670a17910d2e35f48eb7bc639e6da1d08214534215797dadd1a56be44422b176801e5d1a1345cd2bf29e73acb6a49bc9a2f7670710783

  • /data/data/com.gmail.heagoo.appdm/files/filled_star.png
    Filesize

    753B

    MD5

    317f802aacfab6282b8f74f280e841c1

    SHA1

    3b746a76f6322e97fd6c09a43d03ac14631d93e1

    SHA256

    f37f9a17c20ca3068f4f9db08c262c62b7b86544532f612a78421bdee92f4196

    SHA512

    a714f902ede615507cef840dcc03a5eca183c21c82cc419a924587f38b6974f5aa45fcfcc2bac4d6cf82b81d1b6ad452540e0581751bfcad72e524c83757a301

  • /data/data/com.gmail.heagoo.appdm/files/forward_.png
    Filesize

    1KB

    MD5

    9ee047a6801bec9459a9dd5ec7068078

    SHA1

    1aaaffc208e2d86e53fc031e8413169850e65746

    SHA256

    9f63f6c9ed9d33f235c30508df34c3358b55cac8bfb4967fc3e15afc61a6fd12

    SHA512

    8245818df5ffe06c8f369c8d77479f9f2163d10dac36b0e37c834018b713dc8b063ec1de1862fe16a8c1a769b496652be880ddd48d6fcd24ad766a395bc3ff24

  • /data/data/com.gmail.heagoo.appdm/files/forward_dark.png
    Filesize

    1KB

    MD5

    12bfe20382337a84c0fc004a52b9ba9b

    SHA1

    ead15f7ef372c16f78060b8f8c5fc6e0ca6a96f9

    SHA256

    621fbcd864a7dceacffddb00a682148042732aeb675e22cd42b1a0937c6717a5

    SHA512

    7a346febc49154dd348be77f88c6e7ed5c7a531c2fed981f12c40e22a19e4e1a5c51fa766b3122898d97f05e1546a6f2a29b598b0ff441cc7de5e3c505aa33c4

  • /data/data/com.gmail.heagoo.appdm/files/half_star.png
    Filesize

    895B

    MD5

    a40e6a567b7aef329bda0ac200f7a23d

    SHA1

    2fa463649c7ba586b28670675a15e0d7a630c7e0

    SHA256

    ee0933e12dd4e302b1e18572d22f48861e8125e5d0201603e024d18ef5e38556

    SHA512

    5e77ca21445a09aa903ca08c10c1bcaf769d8273368b7981aacf1bbab08cefb7a521687e78d280828f46b625c99fde02050f5c914dd4d07fd742723f7713ee4f

  • /data/data/com.gmail.heagoo.appdm/files/logo.png
    Filesize

    2KB

    MD5

    45c24a8686a0978086c99f7039accc17

    SHA1

    c63ae2601322045390c7a4f230602b74ae18d2d8

    SHA256

    bc9c4aa36a0dd7efe16a8b3bca9172d970fd13d70d3e718aad17a78269079912

    SHA512

    d5861c64b9dc9139904c3bfc7da26fa6f3d9676a5b4203ad617c661d54d3716508fb02f282f5c204bf9d6a0c7162bbb565a44f2ceb96d825177065818b797727

  • /data/data/com.gmail.heagoo.appdm/files/mycp
    Filesize

    9KB

    MD5

    5ee00f0a2fe39b7bbfd6b9cd0bd8f88e

    SHA1

    326bab3a574c51c1d353939964f1b6026b2c3067

    SHA256

    91ce9d7824908beebeff6d3177d07e52a8f6069ba0926e084c2e6d4444053eff

    SHA512

    606ceabd0c004bf939b6f3e6b53993762aa4d1d727a277f7379b6be400c25e0f492af66068e3be29a4ba5de86a0098d8681c2a9932e1252285fca55286aac5c6

  • /data/data/com.gmail.heagoo.appdm/files/shared_prefs_sdk_ad_prefs
    Filesize

    153B

    MD5

    65026ee778e1372d9f4aed742772e893

    SHA1

    5a5f1c821d7639424f3c75a44468ab5f7dd4e8cc

    SHA256

    15070f52136d5a8332f8d70f790bd7bb04cd6a99b386d40e0abedc40c42caa3c

    SHA512

    589c4a12c6b6ec1a1cca957da758aaa900e68a23b4bc2f42524b0e8dd34f6c5378541d9293eae1ae8d478bf5b5229ce4218c058fc3b399eb5756afeb05c68616

  • /data/data/com.gmail.heagoo.appdm/files/shared_prefs_sdk_ad_prefs
    Filesize

    181B

    MD5

    5f1a61cd768d1d0d2ba1f41af39ed1d6

    SHA1

    e9efaab032c07d485ba10b77448eb05eafb5a8ce

    SHA256

    323711ea097e99a032b55fd7c52e319f64c28762778f63760046ba3f368bc082

    SHA512

    2a89c90459c010d2e0a943bc5fd085d0472d9c167e827dc7d25843b66a88e284330827767c4978a96ac3c763fa18242bb225590973fe0ca2fd321d28b04e4d12

  • /data/data/com.gmail.heagoo.appdm/files/x_dark.png
    Filesize

    676B

    MD5

    1b759349f0bf3e55c51e2a2c2802b3cf

    SHA1

    5a608a093fa5f513d1ba52e8a9e01f693c47da98

    SHA256

    59d83bb6ebc5394c048273ea9e1516a2bc7a6f80212d53f81ee44cb1f9b65443

    SHA512

    3b39d22d0f8368dac2e36884b0316c5aba24180f51cb3a993fdefcdcfd5a36823d6c02c75863cd5a3bc0808223dcadf9934d548c433332bb9528f0eb8cecc0a6