b7f5e0f2a7a70d10cdb4cf65d4e242d67ca5c6c06df23745016fcf4cc1a7554f

Analysis

max time kernel
179s
max time network
143s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
12-08-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7f5e0f2a7a70d10cdb4cf65d4e242d67ca5c6c06df23745016fcf4cc1a7554f.apk
Size

2.6MB
MD5

122d31cf6875873070c62d94db756d42
SHA1

83511218655c8faf3665156a3c3d7f80d4fa3cb0
SHA256

b7f5e0f2a7a70d10cdb4cf65d4e242d67ca5c6c06df23745016fcf4cc1a7554f
SHA512

13612775851f168099c2ce63951c9720f2325ae05b262d53be98ef1dbf2c4412da7216ed90bd7db705183f10772340e4fc2d7a2ad30486bbdddcf7fcd9c860c3
SSDEEP

49152:XZxIBcHiuOVHCluKTpQ4mDjrB90EjaXi2fz5DMv2dHi4UtpHsnzPFc6wFAFyZgd6:XZxIBI5OViMDjrBmEj52fz5C2dC46szk

Score

6^/10

discovery evasion persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	nssgz.wtqd.rp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	nssgz.wtqd.rp

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	nssgz.wtqd.rp

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	nssgz.wtqd.rp

nssgz.wtqd.rp
1⤵
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4218

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/nssgz.wtqd.rp/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/nssgz.wtqd.rp/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
882fc2a6b6233c0e7a156b0e90f7993b

SHA1
b106587f17f9f01803f39efcbe7b81c439377417

SHA256
f741cfac664ca3bee4cc520d5315d36383563278a08638012cf2bb84bf59b14c

SHA512
ad7666c326e9807f910b4a5a3a675002b0548819668a6655c3b46b362441eceed3119d9f874c49aba7d6428758751921c15f2e09f979872cfe96772640736aee

Download Submit
/data/data/nssgz.wtqd.rp/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
dfa058c2f26e252730acfd164924ee8d

SHA1
92e4845adc77923594cb2b0011c297c4585db0ea

SHA256
02931228da7fa6b4fe1834ebfca142856e31117ad78a56393cb9fdf50e0a2e21

SHA512
3988464d440c78e2427387288dc4d4bb052750560eeb453656bfddbc9019f9eb22cf064b1451f0fa1c5121eb52118e3fbf3e810fd6df6f3481c55dd5c9fb22a8

Download Submit
/data/data/nssgz.wtqd.rp/files/PersistedInstallation3412419693501730110tmp

Filesize
90B

MD5
cd9480523bb8d67e3610d5f4bba98ff3

SHA1
02a3e8d0099ea3cbcf0d2747900435010c2e6125

SHA256
59b87a9b7584ffe99b325e5e1f838ef603aa4b13ac0644673efc36ffea36c61b

SHA512
c350faf823b89837ec44de4e45d204dc64c2cf68c63fa424fa5a94c635569141a11ef9f1fb3f8f365a36346d3d45d2b747d8e4514677a14c1c840e18cbb2b8e2

Download Submit
/data/data/nssgz.wtqd.rp/files/PersistedInstallation5087117632966805670tmp

Filesize
566B

MD5
5d5f878f4d37aa7c1146a2657fd72900

SHA1
e479aa7586861d60fd80223ef66fdfa1d97ab976

SHA256
1a6cab495cd4642a9ebac6470d54301d5b8b2328ee16a665c52259aa77269836

SHA512
c8bffd4f7d776fbc791775e73cc5b4f3538bd9d5b7bdba18e3578cd47380786cd403ca577d69f10b326ae07960249ae966ef0a99fab86b9e59944de208a275c3

Download Submit
/data/data/nssgz.wtqd.rp/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/nssgz.wtqd.rp/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
a3f74190d28c5765b02321ad2287907e

SHA1
4b2854f0de67f695e126774956b6f44cd5ec00a8

SHA256
876554a64b0559c8064ed474854ee5451f873c84bdd5a2b8d4a73c48dcd36c7e

SHA512
c10aea70aaaa78d0472855f6b90957dd215c74d730ad68e6f24a9e7e7d24adb0f13581f189aa38f82beccfe17f8c9fe93603ce74f5515708788c676206addb5f

Download Submit
/data/data/nssgz.wtqd.rp/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/nssgz.wtqd.rp/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
5a147ffac6e0853010d13623d7cc094b

SHA1
adf35bea5773557921b790062b28bb2faff15471

SHA256
aa2c5be1b828d54594649956446b9500562f8e608a1cc88d5964deda68ef7ab3

SHA512
7c925e0514731a048815814a498d3d09e13faab50be59d32b7ea39da0582b4087e9943d7dff7b9c5dd7ef9b3303aebe1a6b4fda81a7ab3bcb24fd5629963a653

Download Submit
/data/data/nssgz.wtqd.rp/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
2bdc01cbf1f564bf88c1058c0a107d28

SHA1
35e745337aa3c1994b647300de9b5d1f02442214

SHA256
16d7283f713362aec2451b8df6a8c68be0ace93bd34c5df0e61557db5c04762b

SHA512
c595bd6aaed64718dd3dd2d5257f348e453d0dd38f3d651a289fa2e01346f890c0d55b0e924e5868dfc25d701838b2d1a81904a8af302c9ca4652b49340efc29

Download Submit