2f05f054fdf24f11ba6e81bc8f51e9719c85e190052a79e4c70af1f64bbe6be5

Analysis

max time kernel
22s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
09/09/2024, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f05f054fdf24f11ba6e81bc8f51e9719c85e190052a79e4c70af1f64bbe6be5.apk
Size

1.6MB
MD5

57a0041ff5791fa52227145dc94b073f
SHA1

46c6696fc2084192e4931c1b164fce7e8c235e92
SHA256

2f05f054fdf24f11ba6e81bc8f51e9719c85e190052a79e4c70af1f64bbe6be5
SHA512

3b573c7a90dc4edd6dc2866d01f24a9c89cb81fa21cf2d30f08ac05b10a6ff2c7e8b5b66047a249b74adf79af4e4704063b955353fa38e6cdf26aa90606be793
SSDEEP

24576:QDDzfaReQQc+k8MAjXhBSaMBggbGR4hEDIDMXtbRgdXtngrhER0v:QPzfaRudPHsaMBggyhcD49RgdXt+hEKv

Score

6^/10

discovery persistence

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	whatismyip.akamai.com

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.cannav.cuasimodo.jumper

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cannav.cuasimodo.jumper

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cannav.cuasimodo.jumper

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cannav.cuasimodo.jumper

com.cannav.cuasimodo.jumper
1⤵
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4277

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads