e0d2f2aff69cafdaf1099e5d0a1bf3ad32413e7c971c0ffc113f6fb5b0819b5c

Analysis

max time kernel
9s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
12-09-2024 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

8.4MB
MD5

d5cffe9867da6f30e270fb508c40ab8e
SHA1

4860eebd427379b8bf991b2110f9cd336b86fe7c
SHA256

e0d2f2aff69cafdaf1099e5d0a1bf3ad32413e7c971c0ffc113f6fb5b0819b5c
SHA512

6b653475b032ccf2b8944be4f68bcff4fc6f9eddeaef374650b211fe7b67101ecdab446df1bb6436aa42bb91dfc27342c2dce6bbfcd7c25d46d20b61115af8a9
SSDEEP

196608:BKBC9YVEYRq+2Bq9lIu6i4MvwTjIvPTBrOb6:BK3Emq+2GP6PMvlvPlr

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/Doctor.con/cache/natives_sec_blob1755363102103725355.dex	4318	Doctor.con
/data/user/0/Doctor.con/cache/natives_sec_blob1755363102103725355.dex	4348	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/Doctor.con/cache/natives_sec_blob1755363102103725355.dex --output-vdex-fd=46 --oat-fd=48 --oat-location=/data/user/0/Doctor.con/cache/oat/x86/natives_sec_blob1755363102103725355.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/Doctor.con/cache/natives_sec_blob1755363102103725355.dex	4318	Doctor.con

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	Doctor.con

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	Doctor.con

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	Doctor.con

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	Doctor.con

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	Doctor.con

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	Doctor.con

Doctor.con
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4318
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/Doctor.con/cache/natives_sec_blob1755363102103725355.dex --output-vdex-fd=46 --oat-fd=48 --oat-location=/data/user/0/Doctor.con/cache/oat/x86/natives_sec_blob1755363102103725355.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4348

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact