aa9d9e70c3991232e6badb50755d57cd252bca4315e03a0b2f3533b699699caa

Analysis

max time kernel
75s
max time network
79s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
02-09-2024 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43573.apk
Size

6.2MB
MD5

e2bf29248eec138a13308a7468d24328
SHA1

e733ef650b35dbc7c2fd397b6f7b115600f54f2a
SHA256

aa9d9e70c3991232e6badb50755d57cd252bca4315e03a0b2f3533b699699caa
SHA512

faab5a439be0ccab8439e4cc7a4cd244f99a968cc9358531a2d81fcae199dc328d0b97af3a17376b3c85d588e72bcfa2cb6317ecb1906a2b0998aec71ef8269b
SSDEEP

98304:EzBfIzfrvVXJhUNR5TgThyJjlRw0D4sn69/KqroTVXnBLEc/uEW4ceCH58TSTJy:EzRiLUNPgAlnEDUTLE9eCH3o

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.cpuid.cpu_z

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.cpuid.cpu_z/cache/1651189566953.jar	4451	com.cpuid.cpu_z

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cpuid.cpu_z

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cpuid.cpu_z

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cpuid.cpu_z

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.cpuid.cpu_z

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cpuid.cpu_z

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cpuid.cpu_z

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cpuid.cpu_z

com.cpuid.cpu_z
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4451

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cpuid.cpu_z/cache/1651189566953.jar

Filesize
10KB

MD5
fddc8199c9f0b70d3c16e4bad7d741fe

SHA1
3d6a1f108d2a7a2c167fd771a785442fedcc958d

SHA256
a692ed69c9e6eb354d89c431da4814f6592f15b62bad7f0d43c0650d085fa4eb

SHA512
24d981c28b114ef3125b657780eb3e47ab05608d2fd4ef04c042198db3f3c343207ea31add35b6e448f68c212b955e0c4e3abdec9e9110ef99187ec61e57dab7

Download Submit
/data/data/com.cpuid.cpu_z/cache/oat/1651189566953.jar.cur.prof

Filesize
148B

MD5
ffc1733aec1026b0352943fe1adf1e04

SHA1
6ffb4c63d48987d656c5414c3649949089b1d76e

SHA256
ea6ce279c1868ebedd65732b3226db6071eae783454edbf0fb029f5a6ef9c5e4

SHA512
985737ccab0a8a56d18a7c3fbfe4238047ad08852424c2af6946ebef820f3d0ae474e5722123f189c6c0307a921c10b13ef6b9232d85e0717d086eb1bdda1c3c

Download Submit
/data/data/com.cpuid.cpu_z/files/cpuz02.dat

Filesize
142B

MD5
f0fbbaa773e0f0e0ead06932adfa45f0

SHA1
1a42a22224c65e870b4bc145a9516d66228cace2

SHA256
e4d7ea87cc2401beddfb04ab346f9fb3082b348d8d984d6f3d95880772a0f3de

SHA512
d5be928895c60eeb3eaafa52ace2f1a194e873885a4eee1991b10cea0d51b32ca8503858add7cc440c5f6a78ea7fba2d96d9e2af1c2d064efa12e8c166990f71

Download Submit
/data/data/com.cpuid.cpu_z/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/com.cpuid.cpu_z/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
ae69e1ad62674bc44dc3b721255b6a3a

SHA1
424838128c063d3a5216a3cb8d084d3d1fcf11b6

SHA256
b78ef9db5ede4545444cd6d72a2d035e3b84baee2b658fb0e8c9e609804fd891

SHA512
d39975d5a77519009d0efe404bd1aa1df379ed46b6efff26613d0df142a6f98e25170a8ef9fb6c2ee72a98aa4b94e0a39a8b98b11e82f6a7a564213105038018

Download Submit
/data/data/com.cpuid.cpu_z/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.cpuid.cpu_z/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
a4863a76b11141b92f7723817c16048d

SHA1
4ea3f7c468e3f33a1bc3532fc2f658949f8803a1

SHA256
6244cfbcb272cdbd2729e71c5f81fae2c54716065175e929151c9ec6d1c955e6

SHA512
3416deb693d18a0d3b5d4b5f97eff72392ddc8f7fcadf0f3429d68348aab90b63b838ebf48c9b9dc472e8d2a412db9083834511f82b633a053e077632d8e18ba

Download Submit
/data/data/com.cpuid.cpu_z/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
07d73ec5e2eb896faaf3a5655759b546

SHA1
dcfa31cd061b30b661cb1a88b19692fd142ee4ee

SHA256
4918b6f269ec4a34be9d0c14fa441c85bc8256ffd4a75d0528d0b2a2ac9ebc6e

SHA512
74b1ace76766497862ff57da915387268450702c236dd186519bbf1a5f9806179a5f1d3c89d92eabb5f14c1d60c22c81a8f058d91dd9b05e6b2926c8b93df951

Download Submit
/data/user/0/com.cpuid.cpu_z/cache/1651189566953.jar

Filesize
20KB

MD5
1b5587523df3644706b5518dc6f5f7f5

SHA1
1a4115d9b38fb9367752c1abde270f1da4d51ea6

SHA256
1f37ad9f8b5cb9ae9d584d9c382fc0cd9a4596c26f62d9ecb74d9c32720ee1e6

SHA512
130d306cb4717440562345fc65bed1bac9bbd0a943571231f0215af58ce913936afa7979b6ed1eb98884b882a801abc673870603e956da74958f288836c318e2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads