2e67d4c4c12ab161c8bc351fc4d9b8a256fb75a0c7172dfd07a313789704ca41

Analysis

max time kernel
19s
max time network
22s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
08-08-2024 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tivi.bg.apk
Size

11.0MB
MD5

5560db2a375361470c85eecffd0c4613
SHA1

b380d9f5a80d5787dcc4bf6ff393dd597286344c
SHA256

2e67d4c4c12ab161c8bc351fc4d9b8a256fb75a0c7172dfd07a313789704ca41
SHA512

14bd617869f1c610d41fa984b6d4d16af0d40ff3b0aeea694061ccfb907500a89ec982dcd9e057c0ce148f5f009fa85efdeb37637d9074e6c4bd630f87f6c676
SSDEEP

196608:aEiUVRPSNi+/FxHCcv1Dyv3LY+8piLril1TxXzg5ernWheKt:3VRQppQvt8pO+nXzqheKt

Score

6^/10

discovery evasion execution persistence

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
8	drive.google.com
9	drive.google.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

wl.tivi.bg

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	wl.tivi.bg

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

wl.tivi.bg

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	wl.tivi.bg

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

Processes:

wl.tivi.bg

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	wl.tivi.bg

wl.tivi.bg
1⤵
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4251

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/wl.tivi.bg/cache/image_cache/v2.ols100.1/21/32E8v9Rq6oY3bFYyn7z8haLanLw.9210561672665353768.tmp

Filesize
378KB

MD5
5d52408c3a0bea6b69161cfe0f7e325d

SHA1
7e907e245f06f368737204a93c34a591635de3d3

SHA256
8e05e2479d870c6c128f4bd3af0ac56ac032cedb76085ea165b4f4cee049b5bc

SHA512
4c00eb4f5ccff42bd9122fef212dde890eca5d8b0d2aa4603f17d3f261f432faadf3212f5cb7fc9b597cbc175c6d47125cd4fa6f036c54c88b51bc506b2abf93

Download Submit
/data/data/wl.tivi.bg/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/wl.tivi.bg/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
d430c28281c0ef0a9e6d718e48ac886d

SHA1
0bbac3f2131c4e57f0b91a9a970a7b839efb5a47

SHA256
594bd3e6e56b1f6c266a1dd3b652585ada07111bca6da14f288312c9d3b5dd58

SHA512
77f642d0e3397184f41cb2420fa7ae2eebea914cf79cb09c59c4ce5cebb14a3ae566f1b0e7d6a210504a4cde2ffb36e3bfc3e9d9fb5bbc9ac45900e84a6dd5ae

Download Submit
/data/data/wl.tivi.bg/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/wl.tivi.bg/databases/com.google.android.datatransport.events-wal

Filesize
72KB

MD5
adffb5916b7c04cf4ee4a65257e856d7

SHA1
9c6ca462f9abaa91db2852e40d635cc6a3d9fb8f

SHA256
678eef0211d24c2f8761e64a98cc5b9a440e66432d6aab972f7d5fac3b88b5ee

SHA512
2e974eab9c30fa04d9906c34fd3ffb20a72cf3e10fc152b16b00bb8f2b3cf4c77f2f1f31fc3bf618c1ca9eed1b1e190c8596571428f4e5f34927e17aedcdb776

Download Submit
/data/data/wl.tivi.bg/files/blob/ci/7isroqi

Filesize
85B

MD5
d715e931c1450655916261b3a24cb657

SHA1
573044a80a0fea27807c5db08b6fc84b0f08a613

SHA256
c329ade6b5f74ae4da58bf38849b5d9062eee27ad3353ddc1775bbf724c9a5d4

SHA512
51c35f6f2d595fbd9839cb76cfef4ce11376f09b04f9a9f13ad1536c0e7cfe5dfa503df366ba35953fbc3c2f0567e9d13a94f22069f8a249fc6a86bf2207f06d

Download Submit
/data/data/wl.tivi.bg/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/wl.tivi.bg/lib-main/dso_deps

Filesize
256B

MD5
205b03a2cc014cb11e5e94f0565adee7

SHA1
274c2e726ef1e7a64160be19d5b103d94277dd19

SHA256
c3c85f6dd6161d846079fae919d9a4a66b86806e74ae59141f4df9cb5f94bf40

SHA512
c720a8ad189766fb3541b4097869ef1c0c57dd38e449db52e9a2f6c71ec6bcae90a735f1e32c7c35cf3d1241c0379b7b8cbe40c23ff404aa41a2757084012157

Download Submit
/data/data/wl.tivi.bg/lib-main/dso_manifest

Filesize
5B

MD5
c06857e9ea338f3f3a24bb78f8fbdf6f

SHA1
c5a0a2529d2deb60fec041b4fbd722a2ebe31702

SHA256
957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027

SHA512
29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1

Download Submit
/data/data/wl.tivi.bg/lib-main/dso_state

Filesize
1B

MD5
55a54008ad1ba589aa210d2629c1df41

SHA1
bf8b4530d8d246dd74ac53a13471bba17941dff7

SHA256
4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a

SHA512
7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

Download Submit
/data/data/wl.tivi.bg/lib-main/dso_state

Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit