7502ee1c429e1b43f02bdad3e48d2c630d883204378e9b9e5b3b40c455b86813

Analysis

max time kernel
12s
max time network
191s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
29-08-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7502ee1c429e1b43f02bdad3e48d2c630d883204378e9b9e5b3b40c455b86813.apk
Size

4.3MB
MD5

c7eafd8c6eb2ca63b3ffe0e163914b0a
SHA1

7965823ae2f99b9fd61857592a809ed39973a3c6
SHA256

7502ee1c429e1b43f02bdad3e48d2c630d883204378e9b9e5b3b40c455b86813
SHA512

0245e2553519d8ff8dc2b1db70a5d1ad01e81ebeeb15e898a297c1de9d65b02b42553d0faa23ecb9de4476287035e398c3874f55b96505071f37b3e306a4a7d8
SSDEEP

98304:1vFYlAXWe8ENPQXJ5N7ef/A4XPvNhd2bp5Hz5z00wqZQOFXt/4yq4Jwm:1oRaNP0wAA1hd2b/HS0wqZQO1t/RSm

Score

7^/10

banker collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.akgqozbih.xkvxfgyln

ioc	pid	process
/data/user/0/com.akgqozbih.xkvxfgyln/app_dex/classes.dex	5014	com.akgqozbih.xkvxfgyln
/data/user/0/com.akgqozbih.xkvxfgyln/app_dex/classes.dex	5014	com.akgqozbih.xkvxfgyln

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.akgqozbih.xkvxfgyln

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.akgqozbih.xkvxfgyln
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.akgqozbih.xkvxfgyln

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.akgqozbih.xkvxfgyln
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.akgqozbih.xkvxfgyln

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.akgqozbih.xkvxfgyln
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.akgqozbih.xkvxfgyln

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.akgqozbih.xkvxfgyln
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.akgqozbih.xkvxfgyln

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.akgqozbih.xkvxfgyln
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.akgqozbih.xkvxfgyln

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.akgqozbih.xkvxfgyln
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.akgqozbih.xkvxfgyln

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.akgqozbih.xkvxfgyln
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

com.akgqozbih.xkvxfgyln

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.akgqozbih.xkvxfgyln
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.akgqozbih.xkvxfgyln

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.akgqozbih.xkvxfgyln
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.akgqozbih.xkvxfgyln

description ioc process

File opened for read /proc/cpuinfo com.akgqozbih.xkvxfgyln
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.akgqozbih.xkvxfgyln

description ioc process

File opened for read /proc/meminfo com.akgqozbih.xkvxfgyln

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.akgqozbih.xkvxfgyln

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.akgqozbih.xkvxfgyln

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.akgqozbih.xkvxfgyln

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.akgqozbih.xkvxfgyln

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.akgqozbih.xkvxfgyln

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.akgqozbih.xkvxfgyln

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.akgqozbih.xkvxfgyln

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.akgqozbih.xkvxfgyln

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.akgqozbih.xkvxfgyln

description	ioc	process
File opened for read	/proc/cpuinfo	com.akgqozbih.xkvxfgyln

description	ioc	process
File opened for read	/proc/meminfo	com.akgqozbih.xkvxfgyln

com.akgqozbih.xkvxfgyln
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5014

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.akgqozbih.xkvxfgyln/app_dex/classes.dex

Filesize
2.9MB

MD5
c11761871d6f0cbe447d284c7f3c3f71

SHA1
20f9744a023684444c435ebad41a5cf9c60ed0f5

SHA256
bae2e9921aa52759f59974584067386d943227c3d7c838052d682a3e2fd60fca

SHA512
88a6103ce70615c0d64cdaf6f26b1d6d83cccb05b4cbbf89798c209b42743562404d1312d2ee9ee1debb898634a3b4f78a6aa4c312bee3e37d18e667312e328b

Download Submit
/data/data/com.akgqozbih.xkvxfgyln/cache/classes.dex

Filesize
1.0MB

MD5
ecdf907df3c61804b81f93bdcf3c8d51

SHA1
a13fb71adbd4e55beadbd6776b0694c99fbe0e3d

SHA256
ea10efda8ea30a80a5aecebb5932cebd9531f310f896feb724f939d7b1ff4946

SHA512
ce65fdfe85b1d5d4c8a8b0b6a50a785afc8b96bfcf30e8c6480b58281eba1627e171cfd8db0cecc0bbb56905fdb9c295c358c8c66bededc39d37e459a3f3383e

Download Submit
/data/data/com.akgqozbih.xkvxfgyln/cache/classes.zip

Filesize
1.0MB

MD5
36d707d2b9d701cd5fa864c602fc43ae

SHA1
8145f1380d5f4df753dfdb4cd44a9ed52e4c0e24

SHA256
41f5247c46eed72fb7be73953a9ec857925b3b17210e5c611bbe8b17de33e552

SHA512
c0689078aacd8909f826d324a7c7c58cb2ff68306d74485701fb75df7f0903d7cbbed12d36d564105cd788eb356628f3e7c31f0f31bb482da861e526bcb0c7ce

Download Submit
/data/data/com.akgqozbih.xkvxfgyln/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.akgqozbih.xkvxfgyln/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
b0cc944f9fa93c6ac08e370bdfd991b3

SHA1
a7cdd44dff5b29e31d84d7bc2caaa4baae08358c

SHA256
d16f9729e04bfc3296e487fdbbe105b04432da04a84db235dea59586bd8334b8

SHA512
e2ba3f5519691709e71f71a50f437032d17f53f59986545d286aa7349e3c18526c6bd1c0459ae4ca145fc98f80bcd096a110a164896fdd74bed018ed1a41454e

Download Submit
/data/data/com.akgqozbih.xkvxfgyln/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.akgqozbih.xkvxfgyln/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f64897de8eaff73cec5d98e8ed429017

SHA1
9d616b04bfae6892ce1ab7a13b72105d2f85257c

SHA256
76e6900cb664338b5b54af2460a4430a0ca6cfa004101599fca0ccb2b918e3a6

SHA512
323c4784422cf5d699d2d1a2fff99d0ceca73dac167745b2e27186657d102d85887c594bfd3923afe15383ca08e69d0880d51f79ea0ec5745eda67cd9ba30517

Download Submit
/data/data/com.akgqozbih.xkvxfgyln/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
631e8e6e03f427bfcbda11c757c1d2d8

SHA1
546343a933ee89320540364ca6f8d86740e39294

SHA256
7add2b1f8a0479e16885c048eb8cf10370af5b0025aed5abcb1d318fc5de0615

SHA512
f4174ad3569cc8cc2f3570de32036ea28b09967d1a945c00389a31b5fc92415c23e57d110df57ce12bf52499c6aab779e5804f737f7e079789135aeeccd25339

Download Submit
/data/data/com.akgqozbih.xkvxfgyln/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
a6c8ae1afd9a6a8c758e7e5d18041bb2

SHA1
6048907ab0b496b43758e1c8e7edcbb206c8829e

SHA256
94ab9770931d0229141bd2fcc07a834d2205ab46049e5733d614b5f38831c402

SHA512
47f86ac0e3243e67c48b96a6d91e7d05bb01a3709218cd5679711042df1fe64b64410bdfaeef5ff4f0706e8ee631ed775e7bf6ec969e933e25aff7019245b75c

Download Submit