2f586f16a1bd42d75c88bf609b4800918b6ce23b570d36277f16b8c9696b921f

Analysis

max time kernel
46s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
07-08-2024 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com.companyname.x_9club-Signed.apk
Size

36.2MB
MD5

6127b239eb47152afc7fea57e6940bde
SHA1

6b48c2a664b63b5a349552d0a8d0d31de89c2b1e
SHA256

2f586f16a1bd42d75c88bf609b4800918b6ce23b570d36277f16b8c9696b921f
SHA512

b016a2fe5c0af3b4f252432d2bc67bc76745b1c56483bd08214df968d0dc06c27dbcfa2b97c2f7c78218dda41b780fa154c24fa77dfd5e50c071874870adab37
SSDEEP

786432:BaR+7K3A9jjBELSKKU8vowBU3x/rb2ZB66Xph6iadmnogtbEE+Ox4XOueWbjaZAO:s4jbvP+xHYBRZjZJmUn4hy/

Score

6^/10

discovery impact persistence

Malware Config

Signatures

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

com.companyname.x_9club

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.companyname.x_9club

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.companyname.x_9club

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.companyname.x_9club

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

Processes:

com.companyname.x_9club

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.companyname.x_9club

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.companyname.x_9club

description	ioc	Process
File opened for read	/proc/cpuinfo	com.companyname.x_9club

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.companyname.x_9club

description	ioc	Process
File opened for read	/proc/meminfo	com.companyname.x_9club

com.companyname.x_9club
1⤵
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4264

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.companyname.x_9club/files/profileInstalled

Filesize
24B

MD5
c0e96545de081ed252b4927b64956257

SHA1
105ea6906b04682be9d89b5e66a0aa7bd8090b75

SHA256
ef0d20922b7d03f16ea9c155ec4332399bbd64fbe806eb39e48ce3c036564569

SHA512
ee3bf8800a6300b0054fe53ddabcbe09ebc54be5b6ccf6fa0a8b02f4c340b1979f93bfdbde7fde987f4fe1dfc64cadc33f00a0b23865ef5b890101c2cfdc4b1a

Download Submit