2e67d4c4c12ab161c8bc351fc4d9b8a256fb75a0c7172dfd07a313789704ca41

Analysis

max time kernel
179s
max time network
136s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
08-08-2024 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e67d4c4c12ab161c8bc351fc4d9b8a256fb75a0c7172dfd07a313789704ca41.apk
Size

11.0MB
MD5

5560db2a375361470c85eecffd0c4613
SHA1

b380d9f5a80d5787dcc4bf6ff393dd597286344c
SHA256

2e67d4c4c12ab161c8bc351fc4d9b8a256fb75a0c7172dfd07a313789704ca41
SHA512

14bd617869f1c610d41fa984b6d4d16af0d40ff3b0aeea694061ccfb907500a89ec982dcd9e057c0ce148f5f009fa85efdeb37637d9074e6c4bd630f87f6c676
SSDEEP

196608:aEiUVRPSNi+/FxHCcv1Dyv3LY+8piLril1TxXzg5ernWheKt:3VRQppQvt8pO+nXzqheKt

Score

6^/10

discovery evasion execution persistence

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
9	drive.google.com
8	drive.google.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

wl.tivi.bg

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	wl.tivi.bg

Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

wl.tivi.bg

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	wl.tivi.bg

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

Processes:

wl.tivi.bg

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	wl.tivi.bg

wl.tivi.bg
1⤵
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4259

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/wl.tivi.bg/cache/image_cache/v2.ols100.1/21/32E8v9Rq6oY3bFYyn7z8haLanLw.3911658892971924093.tmp

Filesize
378KB

MD5
5d52408c3a0bea6b69161cfe0f7e325d

SHA1
7e907e245f06f368737204a93c34a591635de3d3

SHA256
8e05e2479d870c6c128f4bd3af0ac56ac032cedb76085ea165b4f4cee049b5bc

SHA512
4c00eb4f5ccff42bd9122fef212dde890eca5d8b0d2aa4603f17d3f261f432faadf3212f5cb7fc9b597cbc175c6d47125cd4fa6f036c54c88b51bc506b2abf93

Download Submit
/data/data/wl.tivi.bg/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/wl.tivi.bg/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
11ace8ac5adae9d01f391d0f734f799c

SHA1
c549444bdef340507e6fa048860d3d72737ae80b

SHA256
f992cd09eb79f503684b51e0808493d427a076a4376ddbd56a694b50ff3d9fd0

SHA512
3c2575de4c28debdb5fea4c68d09f72001011f764d89d2019c58fac3c603cf421254f05f5e286493ccb2cee9d17bf1b7d8a5ed2c4338392b5e37302b00f1a751

Download Submit
/data/data/wl.tivi.bg/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/wl.tivi.bg/databases/com.google.android.datatransport.events-wal

Filesize
72KB

MD5
559d5c2ccc6212bba46093ce30b09994

SHA1
2aa3725dd12e3ef2d9a416962ce54779b1f5d9bb

SHA256
5c81dc6cbfd1d5eba93896ed2eaeb02d784b065a77bf33da805cd5848f5a2895

SHA512
1edd2be0fb4e2721f4d30f3e00866fc59272a5f45778665ed4f569f2e98e9a0a5561070ae1513576a14c68c295cb2131f4faff3f7c0261f3656ee2005c95bf6a

Download Submit
/data/data/wl.tivi.bg/files/blob/ci/7isroqi

Filesize
85B

MD5
ea836646d86154851d4325fafd4b6091

SHA1
a64115dd093a87f8fd723ce8dfe64eba0d359be6

SHA256
6392fdc54a3b006d39d6bfd8a1a921bb3ad1fdd6a3ac2bc8b4ffbf39661e5392

SHA512
1360bc67e0086ae2e060506889e798f9e66ab86fb297bc37739bbff155d7bd745a384eb8a1b6b2ff16e0318ee925e1db8fe366e9f04a5c1b0b532ef073f45612

Download Submit
/data/data/wl.tivi.bg/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/wl.tivi.bg/lib-main/dso_deps

Filesize
256B

MD5
ee5fbf78206069eca11e509d7440abbe

SHA1
10b9354b147745d7edc3e92fedc441684938299b

SHA256
ce782c3e043d5ece08c3b8d8e27f929584110e1a2c0c8fb82c353a6d53491f5b

SHA512
0f6f00981abecc65bcd2f878894ef5f8fe2cab83804bbb4746e94808c7771a9f7dddaf130ab0fee8d7337896db70077814cbfcf7d8d9e6a7ec1f9b3292df0b55

Download Submit
/data/data/wl.tivi.bg/lib-main/dso_manifest

Filesize
5B

MD5
c06857e9ea338f3f3a24bb78f8fbdf6f

SHA1
c5a0a2529d2deb60fec041b4fbd722a2ebe31702

SHA256
957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027

SHA512
29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1

Download Submit
/data/data/wl.tivi.bg/lib-main/dso_state

Filesize
1B

MD5
55a54008ad1ba589aa210d2629c1df41

SHA1
bf8b4530d8d246dd74ac53a13471bba17941dff7

SHA256
4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a

SHA512
7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

Download Submit
/data/data/wl.tivi.bg/lib-main/dso_state

Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit