Analysis

  • max time kernel
    35s
  • max time network
    84s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    17/09/2024, 15:58

General

  • Target

    oogleWebBrowserAndroid.apk

  • Size

    12.1MB

  • MD5

    d0d130c855a790da28fdd744535ef07f

  • SHA1

    e9760321509f198ffd80667cc8fa34c4c76f4cc7

  • SHA256

    e6746d0069dea77ecd1d7a611c45e5af220643c23f7b473e1bc2ed8aa2923475

  • SHA512

    e6a08e435d5ea53de01c765c7747e2bcfea9dc99e67ac4e8b5d5cdfd7f07894e9554b04aca9d0310a7cc09b180bfa84f7e9192c03e79ae8f664a230a740a2a5f

  • SSDEEP

    196608:wvyd7pyOZgwi70nk6zLxs1yuyc3u4Ly3UUnKEO++lUU4tjBZPqECEtZWk:wvi7E4gh0k6z2UHc3u4GnKA+lUx

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 8 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Requests cell location 1 TTPs 1 IoCs

    Uses Android APIs to to get current cell information.

  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • oogle.chrome.web
    1⤵
    • Checks if the Android device is rooted.
    • Checks Android system properties for emulator presence.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    PID:4618

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/oogle.chrome.web/databases/StartApp-d6864f2502af7851

    Filesize

    16KB

    MD5

    428576b58d095fcbcf754f946d17ddd5

    SHA1

    29d4ec44ecbf6fb9f14fe93f380dae98c2627dc2

    SHA256

    26e7cf344eb4c57a02d2a4f4f5904909b0450b45dbb85c9ac77afc0e6ad66da4

    SHA512

    48d95d601f1ed5a142b96c53f208d67399ce34c5a897d37ac15f53eba95377f0f4e23167a84970a12c56ac396811def11a68d648da0c0b20d9daa84b58ca7bb3

  • /data/data/oogle.chrome.web/databases/StartApp-d6864f2502af7851-journal

    Filesize

    512B

    MD5

    a982f962e1901ff141f5b6686a2d526c

    SHA1

    43c0981da2c49d8003e53099534ec47433011ba9

    SHA256

    ef2ccdab6e51dba4e7e65f81dbe4639c1e5b3af3d938f66f355185062c4278e2

    SHA512

    79b1e424195f585af1112bc0af1c1ca52730093864a15274f7e152c2f97a95071d379fe5468e618569619f3c97ffec1dc8b72f76d6afc02e741919fcd066e5b1

  • /data/data/oogle.chrome.web/databases/StartApp-d6864f2502af7851-journal

    Filesize

    8KB

    MD5

    baa5811156c6d4ef433fbd1027bb289e

    SHA1

    116d389b396a59c5f48762bd919e6d661eec09ea

    SHA256

    62ecc73c35880a35e8fa45b2fb6318d4c3517e1fcb73d414399788a40da4166c

    SHA512

    d384ef6df6fe0b9b4d36a7d4fe2ee988aef37ac5a119a6e6f1b3d7197fa5c17e578212c7f40c60215b94807bc5e3ab2fc0bc7fbfaf25070ced44152d7b85a86c

  • /data/data/oogle.chrome.web/databases/StartApp-d6864f2502af7851-journal

    Filesize

    8KB

    MD5

    e0e7195e3d90cdb1156f939b55c4ed96

    SHA1

    acd949a51c3a2a01985fb8d2f4770f5075f63614

    SHA256

    3f4bbb0387fa4f4f0d7de12ce28528b0cb5b6fb6cdc17a407744d10153871cd8

    SHA512

    42e2a4c04b5087a303274a561e8bed073867732c867b55c84006c59fec621a75e20dc899a2d582c4fa37ac753db2052b9efebc08ee874b7035bb3b3ada36aa10

  • /data/data/oogle.chrome.web/databases/StartApp-d6864f2502af7851-journal

    Filesize

    8KB

    MD5

    c725fd56641bd1e610b9cf5c03391292

    SHA1

    38b49f798fa452997e3a38ee9d5578d4be326880

    SHA256

    f8306e44214ed1c2d4577752024ad529ddb8d10473259fa26aaddc1f756230e3

    SHA512

    590b8d7cb6c0d52b3f883ecdb8e3e9a9a0750c75ca971bc8cdeea6659cf67f3e63cd8025958b583372128361abb0f189f0f19c22b1063e73e4110de27a3e70cd

  • /data/data/oogle.chrome.web/databases/StartApp-d6864f2502af7851-journal

    Filesize

    8KB

    MD5

    58268f0ebff2234d84d03503c640ebea

    SHA1

    4d2ad4a87ab8521bc456d4f5e022d418e9f7b614

    SHA256

    2c42d1cd29e93a3fbe87417683f2f70affad7eed4e23c7fc1f21f96ec6398e3e

    SHA512

    0c60a4591cbca33b4ef88e949a924d911c1e65bdf3d15759020b06c4e2d2d36a2bb2484f3f78ac1b0c874721517e8824f5172bc26c03b7f26be0796fd5ff512d

  • /data/data/oogle.chrome.web/databases/StartApp-d6864f2502af7851-journal

    Filesize

    8KB

    MD5

    61b2a3f25a533074f9d19e882c6049ff

    SHA1

    08226bf80da7e1b7ed20e6ff4f88aea49a88e25b

    SHA256

    b5fe6843fe20a475643b98eccadb2040eee2f2aec9d47b4bf57eaf03190c458d

    SHA512

    ca48cd87b68c51f1dfab33dcf065d666e4908b87471520c1b9ba77639a967e5d96967d297b3baa6e7169451cdbd18fca26e0046941853d22035f237b54cb057a

  • /data/data/oogle.chrome.web/databases/appnext_dbs472

    Filesize

    36KB

    MD5

    71e8f7c2c6076fe23bc2d327c36b6741

    SHA1

    b41546ba5c52491383b0085c6369271e2b477c6b

    SHA256

    c5853d8ac738f52a04ccca77cf25a04ddc9934c3ebe3fbf40b76802ac9875c59

    SHA512

    aa797426cdf6468002a73e69ae254a2d71dc893618bc333c2ebde4c4f1427c6a6be9e9599b01750f5042579d61f55cc544a3db9aea3bfca1ab1deec5abba1961

  • /data/data/oogle.chrome.web/databases/appnext_dbs472

    Filesize

    20KB

    MD5

    9c2ac147bcc0268a43846a0e54c70808

    SHA1

    febd2254beffabccb58e7f931192df44fd67f69d

    SHA256

    40a5258597ab75d72f99d1fa2194fa6daad131528c4f7c7b84396694aedec5c5

    SHA512

    3c6185bffb8ba1de3cea9309ce5968611d78b1a46a92fa4455dcd518ac73f8f5c5ddc092153dfda17b272eb660e025bd6bee531c73cdc2e8444f06b5a18ec7d3

  • /data/data/oogle.chrome.web/databases/appnext_dbs472

    Filesize

    20KB

    MD5

    44751529a3ebb387fc635bd7dbdba48d

    SHA1

    54674071b3cff57b2a84c250d127e5d1de18a992

    SHA256

    4d22b54b9a86a4986dbebc1fb3ce07926ac1a65f38508c87d2f89f626022a6a8

    SHA512

    6947af1263c11363e478a28b8e91bc58796e6bacbf8057bdc1fa2dc0cdc0c3112a5e53c3a17a49d69dd3eba2f01da8d4cbbac821a1e54f01de1e86d71ed95737

  • /data/data/oogle.chrome.web/databases/appnext_dbs472-journal

    Filesize

    512B

    MD5

    2c7a521a15d1ea52d759940f261e8dce

    SHA1

    2f5f3a9f11387c9b60bb05d6581d8b81a516ea11

    SHA256

    1719e35670793ff7f7db5c5179881348f2388f4a79b052ba0f69994f002f3de4

    SHA512

    6d29419e47cc0ace57a5d3ecad6cfc946036a9eb8d1ea676f7f72a3775033ce710dd4027da5c5d5a6f8752c0f6cc3bb41904fd9986ea1d2f8604a73dec51cc50

  • /data/data/oogle.chrome.web/databases/appnext_dbs472-journal

    Filesize

    8KB

    MD5

    ffb9157caaf4087c7e6ad7addff8ad4b

    SHA1

    4c09cd238c611de8e2a6313efc8bfe69d3dc1eb2

    SHA256

    a9239e6466dac56ff40bd43bfa2f15d8fbc0770a111e6e02ef4133966a1fdbf1

    SHA512

    b59ae8d75b51252a409369fecf05e16e4fa078dd40a78cfb9159308316d736570dc161e7f9f82ff1c6b7d5d99777078db15b906fe37faeab9f50d401622acc48

  • /data/data/oogle.chrome.web/databases/appnext_dbs472-journal

    Filesize

    8KB

    MD5

    d9a47141f44305374aa779d5959fb4fc

    SHA1

    738fd18a9a3a876ea053147e7355cbae24c4d761

    SHA256

    0ef819711f190d4c9bea6077f4ee9310671ed69875a5f3cd05b07b7631fbbd92

    SHA512

    8f5cb89b3a8504dc6e06a458d63cf9b6333662a7ec03970700b114c3f831a39aedf0b8a282a48304918ef85dac331fb2f33d7fe1bb0998dcc5d58c081387b1e7

  • /data/data/oogle.chrome.web/databases/appnext_dbs472-journal

    Filesize

    8KB

    MD5

    38c47a5ae7f858db942298043326311a

    SHA1

    6e540b1e176d7bfc389c02de2addda242df1afef

    SHA256

    418c5fc2fdd416e0ef78370e43f29fea46830c84527405e9c76cadc1751a4061

    SHA512

    c58d67961e5fe6c4917bca9cc61a24d7666e087935680f9336e542a516d076cff7ae54830e2fba89455595564f14d5d0fb3a8838dc7dc1690622600e3c964992

  • /data/data/oogle.chrome.web/databases/appnext_dbs472-journal

    Filesize

    8KB

    MD5

    5130b66f0b8ba7da387825b3fda6569f

    SHA1

    186a5d994e583c83ec90179575bfc8d38fdce9ee

    SHA256

    ff2bee56ac151a04060893d0db243977f1f81a2c0855fe8da327a9281db8eb8a

    SHA512

    6c825d96c37ff5b691ccaac5df7d98f450cbdfdfaf8df0780a937751f874a752854a01fe5d8c73324d73025e35e4bda26320272186a5367574d2c8978526ffbc

  • /data/data/oogle.chrome.web/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    dd86ba8ca8332be839abe05662eeffdc

    SHA1

    f424ed2fbda9913bce3cebfecb4df0862f4cf370

    SHA256

    ed3420372ecf7ae52236d827997f5614aae367f27c3d8331a0a7eedd532e8ddf

    SHA512

    f8d93163e71a6091e90443a3e9d940f9086529133e46b1b7a9dfe89a5f0bbe2498e87fc68fc6d3da607529bfdb570e570183e6d4dc7ffec1cd7c95879538d692

  • /data/data/oogle.chrome.web/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    6bac04f0d76d4243dced4fb2db3fcf28

    SHA1

    3aaf8672fcff246a64f0e1df680a9f7885448861

    SHA256

    0782613a1bb6537b0d5eec344319cdacb708b2ee3239e7c54ca77e63dfb407b5

    SHA512

    f9ee4a94df6f861a8c1b7d9615a83a38ada4eb1470439116b239f75e47bfcfabd776825a5d88df734d2ce4f5716245080a58a611a0f74a08fae597e204351d81

  • /data/data/oogle.chrome.web/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    b543f57edb5d2eab329ac37e689a56dc

    SHA1

    48728b48aaeeb36022ff9460e5af90372f6030fc

    SHA256

    2affc4e33f82cab1c9ca321f2231ac9d30e069cb0cc3dc8a6f067183d8d9e07c

    SHA512

    8b2fe20a6294ad6e7266bd270859f5b7209854c66e4a1a325c46d4bfdbeac14b083dda65853703306b4b826f6235e7af6c6326dfaed5304064f5d40e1abefabe

  • /data/data/oogle.chrome.web/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    073fc9eec1fe213fd1262690a4d568ba

    SHA1

    a492ed66fecece066de0b623ac5bade874bf8fba

    SHA256

    bc77d79c16073ab4b2c0d383462e559973525ffe07d44dfea3790c39f6f848e8

    SHA512

    90ee0a0d13b17cf221bde07478d0584a2b4f499736c0f039fc37a66ec6617ac2d0503828e76a54dccca50efe8dbd00a66c364fd8f1b62a0ec72e79eb45c58f5c

  • /data/data/oogle.chrome.web/databases/google_app_measurement_local.db-journal

    Filesize

    512B

    MD5

    9d79bfcb60e900ae7fdc3e5b4da6391e

    SHA1

    32badd4bda07defc8e2acc9c206000b8b91cf3c4

    SHA256

    2518a24d6e7bd266394e7bb8f5e39e1987f0a12479247ea453328a0aeb3840e7

    SHA512

    5fc74a33e33e952e2a7f1da841786e357d6d1341359823225bae7490d70192b6e608ed812cc629634fb1776d21413629c073667c7980ad7812c8f8692106e13c

  • /data/data/oogle.chrome.web/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    476243c8c7cd08cbe70f8478a40d5a68

    SHA1

    ddda87b3679ec67d8dffc47fa00a3502e5a3693e

    SHA256

    35d11bc064739de575c82f19ae20c389780fd25857edbc9389eed32a7f0e6ec3

    SHA512

    817fc7f844bcea45bb47239a7294d487ab21492255cc18c7858198a9cbba60c30667fe6a52c2ef7e39a0467cdc9e548006a6be0938aba8cee776c3eb6fcdd129

  • /data/data/oogle.chrome.web/databases/google_app_measurement_local.db-journal

    Filesize

    4KB

    MD5

    4d2e1bab7a3d2d59575d04e68cdd9093

    SHA1

    5981da331bf892874888287bf02c83dafef086b1

    SHA256

    8103921f347a0e23f7b8cccec627b259c2049d36df642f8f2f0ffb33daeee7fa

    SHA512

    5e2fcb0bbde04cd11acbd490cbf2e611ab1550c8b13aae34f60d9b508a15d99903ae23591cd9bf03f189ffdc4372c3f5e8c933d3ba2ca1df65f644b0cdfbd66b

  • /data/data/oogle.chrome.web/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    aa21bfd4955eabce4ccab59f6d68f96b

    SHA1

    797b25552e3437be75b86cc8a7d5b54e473a2641

    SHA256

    4e5068699c069cfc276bce234373819279e570b2957d6d4bc1a4914003f74759

    SHA512

    72fc9534026daceec6cd48a5952c9c28d177daf7e118f6c6413d2c0190b6fbb0f3cd0b25c1a73a76ce6b036b85c8e2d9739774302bf6e6aa438b1f725bb5ed7b

  • /data/data/oogle.chrome.web/files/StartappAdInfoMetadata

    Filesize

    1KB

    MD5

    02f1d94fa0d6c8906a90061e68a870af

    SHA1

    fba60578ec60b1e504911c6597886212a941bd53

    SHA256

    a83d1ed5bb96a5ccf291ec3faf81e882002ab9ad8bf31dcb09970001c8710aed

    SHA512

    68e9ac8ce48db971817493cf8d5c38a6e9c8fecb44df998801e09000511c075acbe18810cc5f739ea6d76ae520264f4d14a949d5197f9448aa4334031cf4a376

  • /data/data/oogle.chrome.web/files/StartappAdsMetadata

    Filesize

    2KB

    MD5

    02d28ac2d17fe30a954942fb6fa47657

    SHA1

    a738a7d3a1fbb396a5387819b8106011bfbd35a0

    SHA256

    75e40d68562700c230e7c6ad2bd89d8304d6baaf1a37eb82bcfa8f05439c4a91

    SHA512

    a061b0074781ae0d97f1351fd955342a852b7fe893a9fe992461c044be73fec04336d8508704801573aef6afdf7d356f6e4274f15d7642db8d3103467f884420

  • /data/data/oogle.chrome.web/files/StartappBannerMetadata

    Filesize

    719B

    MD5

    008ad37c8d89f1f02004d2b63a20fdbb

    SHA1

    62536b74feba7abaa70b7b0c7d304abcdf623308

    SHA256

    248c48a58bcd53389c33ef11839900915e7a50deb9747c1ed258b2a8e2a415fc

    SHA512

    3782948b8c629005d360bb1170d157ef09d0d1b0fe64eb067144f20673e37e619074f880b07dd3ffed023c80176b9f99328ded0b7a6b61a1479d32d124e717a8

  • /data/data/oogle.chrome.web/files/StartappCacheMetadata

    Filesize

    785B

    MD5

    1cc961a176032fc935e671957856ddcb

    SHA1

    818562479af03f2cc3c1936bff5c7b13f5a6ca6f

    SHA256

    e6e9d42a25a60b9a933ac266abcad0f2575f3b7e7ff39f880b0845b7e4e4b0df

    SHA512

    c6761d342ce60ec7d7f8fe47f51503dd4ef7cce2d3dd399de9a9683477e70f17659edf35516f33ba107f8fe8088f8a1424e02a377bfe2909f590074aa7e6391c

  • /data/data/oogle.chrome.web/files/StartappSplashMetadata

    Filesize

    1KB

    MD5

    203a342363f3c8ccd4061caa2ac216e4

    SHA1

    cb71e91b8bec2d09609f607dcd04c7b8b38d4d38

    SHA256

    19bc60ff318b14608531a652b324455be016e710f24ceb4c3ece24f5d2f6e0cd

    SHA512

    72663d37343139c54b34c057975bcce95e8f8998d470771b5ac3ee4fd3c47779630007f05b36eae28ccdb98ff2915a5f740b12828baaecd596cbdc2d36c7d074

  • /data/data/oogle.chrome.web/files/shared_prefs_sdk_ad_prefs

    Filesize

    153B

    MD5

    65026ee778e1372d9f4aed742772e893

    SHA1

    5a5f1c821d7639424f3c75a44468ab5f7dd4e8cc

    SHA256

    15070f52136d5a8332f8d70f790bd7bb04cd6a99b386d40e0abedc40c42caa3c

    SHA512

    589c4a12c6b6ec1a1cca957da758aaa900e68a23b4bc2f42524b0e8dd34f6c5378541d9293eae1ae8d478bf5b5229ce4218c058fc3b399eb5756afeb05c68616

  • /data/data/oogle.chrome.web/files/vinebre_ac.txt

    Filesize

    19B

    MD5

    297bc6cb5046fc9286bd35b1ad12e0da

    SHA1

    c66478bd8d6d9ecfd8f85842f6cf8a1078393ce5

    SHA256

    7961242d2330fb281025853177b251f9b5bdc347501e8ba64148f730f6364a4c

    SHA512

    36e192f08a128d7ddf38119919a39a068330974d3e983a2853cd031515e5361faa604814595047d5b6dbf97502cccfbe0a0da5fe19c589757218af1100a603dc

  • /data/data/oogle.chrome.web/no_backup/com.google.InstanceId.properties

    Filesize

    2KB

    MD5

    1dffa9309b97b7374e6605cd640fd52e

    SHA1

    868693385004be8fa010ff96252664e6fa4441d7

    SHA256

    412f318bbcbbd31ae5c9c5201ff21b03806551f480f6b253f4455841de1e9979

    SHA512

    204e41ff2b9bcf6ef13ee32052dce6bdca4b343c13bbbeb237c257372fd9e5c71c0f209f2b17e56b0cd624b8988e262ec57766bc6d44ef6ab8c57db5f641fbc4

  • /data/data/oogle.chrome.web/oat/x86_64/[email protected]

    Filesize

    514B

    MD5

    b35b2537066b5718db601cf00381f9a2

    SHA1

    83ebaee6a89163ef2899e78ca8df362e2a8b0228

    SHA256

    ffba6b9c3de559e0bfcdcabc9c3685d1e0a7901ac092103338efee3ddbda0566

    SHA512

    45a9bf9d744defe989db2692679ad16edf65c97a398973abaecfd97a609a9ed3e90f357b446d0a39c73d00e11d13fba54722c2f5cbff23f01cb6c8b6b142ef11

  • /data/user/0/oogle.chrome.web/[email protected]

    Filesize

    3.2MB

    MD5

    69cf159b893eefff9a8106cc3ee37e03

    SHA1

    165207adfe8c6047ce9f3dd38aed50796c1660d1

    SHA256

    26fb1a790377e11135bf8bfa7552cc2797d351df60154ea032ceeb4463776fdf

    SHA512

    379960366739517c1c856834227aaa1a30a20a9bab730d4229f200192f2c643b69a3e2e114dbdd743a69577e0b7b477c0d14e71c31ee491e137ec405f79e71aa