2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc

Analysis

max time kernel
18s
max time network
157s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
20/09/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc.apk
Size 3.6MB
Sample240920-blevks1cph
SHA256 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
MD5 39fa2c58237de702fc3458251f358cab
SHA1 16e4e5003046f5d07a0fb1eff0dad56d9ce53be3
SHA512 023b77900582d0b6629d587f7411ce5153124cd3870b9533cf9afc5304b874e4353d8dabb7adf8a199768992123e707bc6a87ee682463c3bdccecc8a060e7126
SSDEEP 98304:kyHTjmHgJcyw+WoeX89z6Odp/9hBbW+te6lXhAyHmz:k+jmKcyPsXMl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.systemservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.systemservice

com.systemservice
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5041

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 af69e1327238134afff8ce574ce933cb21133f7a9ca30f5ec497975d8f72187f
MD5 b6890fc01e6f9a3e519ddf59f5ab4868
SHA1 e8bd383fb788475333b64cc195994e96a7e402c3
SHA512 e81403781012f8fd803f7175dadc3bffd2435917aed7869118acc05d6372f75da781e85e0a2799cdc94b385beb5a2c06d9aeab9258c01c03b7567feffa8c0cc7
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSwD:8MEX0wIyNjawD
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 cba5ba565e2e4879e7f8cdd7dba0296b3eafe0bf180a07476334af12140b4733
MD5 0ae783f48173d50ed820fb73335db336
SHA1 beb524fd125d7e7bc638377d02ee92337dfe3e5a
SHA512 a8b17a2e52def3eb6b3cac5922ed2bcfb380b36bfcc1f6998f01cece1d196eb0051d60182807069f83fff06fe386e9593a2f3be24996be5d307a781daecff219
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 732872849b04cb97845aaa363cffc3ab2213c1aeb643500ca095335a53b314ae
MD5 63fde5c1dcec276a5a119e123586a3d0
SHA1 4d65246cd203153c9a0fb987cad59fcc5da987ab
SHA512 bbe7334325b7032a1baaed9c264185f7f0a687c247586d0bc657f3133322e4f4f7f51aad0f49dab5210c563b576462ca9de293e89f65f4b434c43c140256d3cf
SSDEEP 6:7+/l9rlulFn1CWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKctn:7+ttUvqLiuWdwRmBEyPb1n
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 494197adbd42d21d4db19e26c48b60eb522705a6c1352b310c8398878c7ba53d
MD5 8489996e64a018ac98e18f1a96595cca
SHA1 c283fd8b9f982e799610ed6123ce5ebaa6a1fb1c
SHA512 20831ecec52a8d475d137f4c11ee56886a2388397d9c403bc620f610583084d183c72b2e973f7e725b576471ab0fe64541866ce4e6279c89d5b13d454ce42b5b
SSDEEP 6:7+/l9kl4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKyKa/8n:7+teiqLJdTRmBEyPbDKq8n
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download