2f586f16a1bd42d75c88bf609b4800918b6ce23b570d36277f16b8c9696b921f

Analysis

max time kernel
47s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
07-08-2024 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com.companyname.x_9club-Signed.apk
Size

36.2MB
MD5

6127b239eb47152afc7fea57e6940bde
SHA1

6b48c2a664b63b5a349552d0a8d0d31de89c2b1e
SHA256

2f586f16a1bd42d75c88bf609b4800918b6ce23b570d36277f16b8c9696b921f
SHA512

b016a2fe5c0af3b4f252432d2bc67bc76745b1c56483bd08214df968d0dc06c27dbcfa2b97c2f7c78218dda41b780fa154c24fa77dfd5e50c071874870adab37
SSDEEP

786432:BaR+7K3A9jjBELSKKU8vowBU3x/rb2ZB66Xph6iadmnogtbEE+Ox4XOueWbjaZAO:s4jbvP+xHYBRZjZJmUn4hy/

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

Processes:

com.companyname.x_9club

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.companyname.x_9club

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

com.companyname.x_9club

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.companyname.x_9club

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.companyname.x_9club

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.companyname.x_9club

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

Processes:

com.companyname.x_9club

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.companyname.x_9club

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.companyname.x_9club

description	ioc	Process
File opened for read	/proc/cpuinfo	com.companyname.x_9club

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.companyname.x_9club

description	ioc	Process
File opened for read	/proc/meminfo	com.companyname.x_9club

com.companyname.x_9club
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4967

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.companyname.x_9club/files/profileInstalled

Filesize
24B

MD5
71be95e94b276313babb97938615424a

SHA1
7c8b4df2cd29114c4d930728d6182f86188d3ab5

SHA256
a5f99d5dff53161046bb099a6c9cfffc9745ef03f4f64880acd19bac31564a34

SHA512
6d9733cacdcc5df3c8e9ccfabaf14119e9a1b01721c45e10f2d007e3911b34b778cf5f8cfac2634ae433c93ee03e20b93441abd3b039982b9e4f2b80d13999af

Download Submit