643c1d5240fe9bc4c4beb2799d6647db58c35f8ac0ef40715c9b4a30f12cb4a3

Analysis

max time kernel
176s
max time network
165s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
17/08/2024, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
base.apk
Size 2.7MB
Sample240817-q2vcjaycnc
SHA256 643c1d5240fe9bc4c4beb2799d6647db58c35f8ac0ef40715c9b4a30f12cb4a3
MD5 0ab9ec86b5d33b8c4e10be8cae550810
SHA1 a535aafe5f236cf4ae0248d3eb13271ef1a7749f
SHA512 a2842a54622e122b75b0be9353aa82d1104cca5ed4fc706482205389b0065a4757218950589432d1e7bfe7ab8a796fc24c8e75f5ba2311f30a2849ee9785d94f
SSDEEP 49152:M/rWK7M6cakjvjyQrmVqjnkCmgXVA5ovP9ucIjRwwNPM/3UrqKsUQtnzjJshp:aSn6caUvjVKVZJglHXuuDCitzVsT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	app.Madsal.org

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	app.Madsal.org

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	app.Madsal.org

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	app.Madsal.org

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	app.Madsal.org

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	app.Madsal.org

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	app.Madsal.org

app.Madsal.org
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4930

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

Path /data/data/app.Madsal.org/cache/1
Size 12B
SHA256 f164c2b5fd53b8a772dcab060642b37241218e8a26bb03d9b93040a96978f862
MD5 453a51fc681b0a4c692ee00a84321919
SHA1 dd37acfa6178d03c260e960aaba67d01d19ce08b
SHA512 4243eab3bda6521e575f9441a99c0906ec5637328f51720ae69b8ba85e54c088936424a322b19f7336c58cf3d400207c8cdfcf72c96e0f79bc94b6aa02d36279
MD5 SHA1 SHA512

Submit Download

Path /data/data/app.Madsal.org/cache/2
Size 27B
SHA256 3e95ce3e224f1179f83093432e03747c3f8b15b84e9052096f9e979d71cdbe76
MD5 ea1adc3a57eafdcec03587edcf343e30
SHA1 358286a31e135ca55b747fca085116fce4a1b2a2
SHA512 a25bdcfe3e68d7a97b25d041fb305651c92cba64c70b1dc25206fb089cca47782d77c07a753ca805f20ec3a7766b5d8937c28c3accdefd8f82e4e12ce2a50f88
MD5 SHA1 SHA512

Submit Download

~test.test

Path /data/data/app.Madsal.org/cache/~test.test
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/app.Madsal.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 5655f771ef0b548afbf9aa547cf1acebc70d3087f41ef9c0edbe6dce80abd66b
MD5 b8c4577473d40e92e4965e3ba33bccb0
SHA1 96ac066281ec412c413a819bf127f77c80d619cd
SHA512 41ab0a0f197df38dfa679a0b67e1c30a0cd8d7dde226105d656003c6409f39c86e4df6fd9657e0f2c0bd309f7662bb615384a54dbb8d4a2a8ea05d8100df029c
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6gRU:TLiEy9zmzrfRmBEyPbP/P+/0Fl657
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/app.Madsal.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 c2f4a63a86227e98626a3e50852fabe4c42af65fdd018cd981470646b37a0c3f
MD5 179f0fb37b006116916777d93f0d5383
SHA1 0ed6a2afb90abfdf2973430d89bacfafd6a52a8a
SHA512 55d6b7915c3a788d5bcd1cc62b5cf9f77fcba7e5eec8d35f2b6c1fe54084bc33a4b48f7818294da036c6dbad2b66353c4ee37a6f6970905b2369cef7406f5919
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlbmk+/0Fl657:TLQpmzr0GSP/h1499FJlF4
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/app.Madsal.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 3a1126072fb73d931811cbea0d7b58e3bc3528f96ededfd422ba618ef4845be7
MD5 ef3008cb457c4d0ee9d84481a8b12357
SHA1 059d86a591391f5293e026dd5c51f72a5efd7afa
SHA512 ce793ed45266812ce5cd60f14a7914e32d7ce502dc25f5c38d00b08974b9ff1abe46f1d88d3e02bc6d57fcb0d33297981e269f8bff9251e40430229d140a63e5
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/9FAiOLauK/6AUvkWlto9Z49blqYFlbmk+/0Fl657:TLEvpmzr0GSP/9PKary5tw499FJlF4
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/app.Madsal.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 aa39b5fca0f656b1dd4d4b16bb16f4f5766896db372faa7d686cb22edfce6caa
MD5 aabbf9445dc3ab58bfdeb65e0b1acb2d
SHA1 339d0e699a80926d01f799d0101cc498a0fe75f7
SHA512 028586816152570d9fa619bd80a08dd3ffc3b423c759262f8ca82d6702b374ea5d618ba8a10929a4178ed2e1efb8bee662dfd09b24562b3bf29f82720adcb62c
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/sFAiOLauK/6AUvkWlto9Z49blqYFlbmk+/0Fl65v:TL6Xpmzr0GSP/sPKary5tw499FJlFo
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/app.Madsal.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9
MD5 adf6082723784327d7d1b34adf974e7d
SHA1 b1502f70eb881a1dfe41139cb719fefb877ee37c
SHA512 762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b
SSDEEP 6:l9bNFlgls1qlvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W:TLuEev9zmzrfRmBEyPbP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/app.Madsal.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download