Analysis

  • max time kernel
    114s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    21-09-2024 20:01

General

  • Target

    DuckVision.apk

  • Size

    10.7MB

  • MD5

    1668946c755ca2986314ed9c55bc7579

  • SHA1

    b61afbbf307d0d2290ebeaec7f306d0214a5b062

  • SHA256

    29e56b9f22cace295ddaf5c4279cb0cdbfe406c5451aef31393a1cdf8aadfd4e

  • SHA512

    f5f5282718552300094fd659be420f6b353ea172806add67c60f78362ab0dd01b0fbf0e41b8d66240948c7ede09e3f4943a98a8fb74c595251e71814ec00ac55

  • SSDEEP

    196608:RaPcPJwR1jqtXisHNsNF8On3hi4UOzKe8kKh4Nz4iWRQ:Ra0iR1GtXi2WqufIeKo4y

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks the presence of a debugger
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • com.condor.duckvision
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    PID:4211

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.condor.duckvision/databases/com.google.android.datatransport.events

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.condor.duckvision/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    a47238aaf0294a29a4316fc47276a86a

    SHA1

    400758a2414f4e0e8a2f721f9fd7328c99cc7436

    SHA256

    ac4093d5dfcf2f8c2f94709a2317821b496b4a45c56017f92261de549244e613

    SHA512

    5a3cfaa2998ce9832183c6c7e09758cdd0b793109489bc3b310cfdb8b003f30dec1903e175f434039da0bb6a9f1cdb9e63410586d238eb24baee93f573592d17

  • /data/data/com.condor.duckvision/databases/com.google.android.datatransport.events-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.condor.duckvision/databases/com.google.android.datatransport.events-wal

    Filesize

    120KB

    MD5

    5a8550899b851857dea5626935c5ff6b

    SHA1

    1f7958fcd9378eb08254b20ca5d66a063d435a9c

    SHA256

    b8cff9d044070f29bc2153553ed92fc06844004882fb86337abff661ce9a98f0

    SHA512

    5c40667f7d9e5dca2d590b8a962a517873dbd70d54c1dcd114cc9288ba94a971403bc1ca9377812df9247f99b7ca7f3791b9f7a756e65b4a1f84ffb1fc412233

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    5f69fcf4c92832974a8664881cd1100f

    SHA1

    6a94bab190c98550c0bb1684e0db6b8f0c355a0e

    SHA256

    7d27bf83d5aef150219b01013b13ff336cafd42f5f37299aba3df4e8b526b9f0

    SHA512

    d5c7005a0d42afa0182fba84d3a88ad0da9a63f39f2e00e9b60d2bc96877e165e8b52347a0df5250204c18b9918c05496e73b3e029f07462a73e77e597330d1c

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    38acbc588dc047401828eab108f2e6b9

    SHA1

    0a1e60a796d55c11fe0aeb4b7d6ed7f9d6c612cd

    SHA256

    3943a345003bd71e84830216fc38617bd9d0d05c8df56f5aa76e5c87bb2cbb82

    SHA512

    a5e75ad099451bb6f80d332119c947fc6f676c865fd4a82eda9a0aaa560cd7d3a4ed89b59799c4cd32fae57f3340bd0656f239e3ec7c8a4c48b7ca214290c9bf

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    c08e63df5b085708a01ed22522fe93d8

    SHA1

    c834449951f299481ccd419f1c1b8ad0503bdd4e

    SHA256

    ed191ad65497f369e4dc5e37cd8e28b48167019f872e5a7b44a39962eb39c2fd

    SHA512

    32303265bc8d80a368f2f847be6326602fcba524ee92b012c7299f4c27b4eaf540800266625918371bcd0cfcf37af8b8e6ec66bf3fde75797f69dea349b2f762

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    ae51ca0bc4e07acdcf252222151f4034

    SHA1

    babe6d9889c59ae9f9ff221a4c0ed922f0be8b57

    SHA256

    da9c9b0a3f536ad8737ad550f2978c2fdd477184c9a025eea1851eb492a2a6b8

    SHA512

    3147dc7e44b166923521545feced699354c2d64026ec07914b27060bff32198b7d7f9f97a8050981b9ad80eda62f28d419d7f5f5621a81d1cd1d4ef069d73294

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    f701b60d45c1521b61b027cc81a2f188

    SHA1

    83b5c84568e044cb97431db118ff5145d70ae9db

    SHA256

    58deda44dff17d67c2222872db7135b8c181ddbea2abcb3647ba243b18c0cc25

    SHA512

    a5dbb5bd2b1111767ca5277679a320da5ad9a32332cda121fee7e68fdb43308332be5a54b7d66f5c3dcc6ab48298e209d65280c83bbdc9b33b747e7f1fcd7bb5

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    b09472a00bfae4981d7c2a112f46eec9

    SHA1

    c75137346a90efcfe76fe2349a5d8fb1ff69fb98

    SHA256

    2f366fab9b8d9acd9baa29db2d80e6f7214d3033de7c88551492359f53afeea3

    SHA512

    0b96866bb41daf071c8400983a32c8eac4f2603815990775c2b7d77e1a717ffeb36cb3f23a8dd379bd4e05298a5c72af2ad1dca2a516348cce6cfbbcbcc50266

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db-journal

    Filesize

    512B

    MD5

    708432d83a9f3d7dfbd56f2e04a3bdbd

    SHA1

    4bdae5d58d1b17a454faad440cfde987dada3b18

    SHA256

    08ba7485322f5796d7543808bfa3b6e350931227964cc6f132b9b47e6eb02109

    SHA512

    7b0f74c24071c5dc8d73b4908f43585ccf30ef5dc3bcff0c06e70a0d8054d549e934549026e0e5084a1618f1f2ec88a01272a54e28b6130ef79d4ab05489626f

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db-wal

    Filesize

    36KB

    MD5

    43473ceceed93afd830d7b6d506362d3

    SHA1

    0e2fe01967e371d6df3983dd95e99883c00363d2

    SHA256

    7681e8509300c5aa45764fc5c3a134f8b7aa1516566e48577973b75ae893f608

    SHA512

    d60e3d017b36c3be1d1580c7823137542bb90acc1a78e9042c79e41ae9c53c9ef7dab2a256609d9c738a8ead25f75a639ddb13579c40418d5f31c576cf164692

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    aa948fde6f38eec92916a6e71eadacbb

    SHA1

    3e93c9bf7f26664077880964d314090a10afe9a7

    SHA256

    c3cb3564cecb1d6a669f98319b71720633a5e67cbf1cb6700e3c575fa4b629c9

    SHA512

    ff8827e2e764aca63f88f3a7d7a6a54bddf58f73dcd19c1f41212a39b21fd918d9416cbfeaf928906e823118fea9d692c389bb9b8ab7b32ed1d2583e850fcf3e

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    c775820cf0abae573b365d2b363f06f9

    SHA1

    2d275689ae1fc3f90bfbaf400125781baa68bfcb

    SHA256

    920487497877ab728cc9810e2ef98a9ce8987cc83d650c50ab34fbd72fb6fd07

    SHA512

    1da4409505ab37299a540821946f902465cd735e1e7cac589280e3df60006ef012ec4af8340209a185cadc3629d7241814ad0b4c1df10328407ea53abd31d724

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    e93b6e135e0b69f54a3d97961a769d09

    SHA1

    3ad93f0ee3fca5c8ae11e88e6abe90437fc21d54

    SHA256

    2f6f97de53e9da217e73a45f26af04231f3c5d56404a2af58ff4184904772fda

    SHA512

    96f62a77a7d38ad23bf03e0a9a90aff33814adbbd4694db0d062f27e95ceb8ad364fff7d5168a81d17da2be2d4de5fb0c77d7455d5fbbff76ed3984d99d62ff2

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    3026390f090bb8a55cab4348880ae236

    SHA1

    29599739e5907148673a578f48bfda7b35f20e0a

    SHA256

    e7ce5b4c91a545de9d5bc9ce2c9e4cca17d4604f126ed580b3d7bf2d7634078b

    SHA512

    2d3bcc722916d747325267bd17e8cd02091e0f14ea6db4caac26a623d9f52591fa3f6d8470915afe55a8911bed9154acc3a4125e2724992f3692108b12e25052

  • /data/data/com.condor.duckvision/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    241e840b9095f2af27c50863ca427004

    SHA1

    39811ec95ef48c3b9dc600ee424e55c1c7a70261

    SHA256

    6e37e6ece1ab76961f8d2a429a2049daad1a966abe95ce80b6252d6b266ea777

    SHA512

    b2de1779a2d3eab38c3e2e440b4143127d17973b998134c59c2b671f8e271d656f98b1f8825079a5d77041bc2592c3a0356d16c6325a5f058ec096685ace6ae1

  • /data/data/com.condor.duckvision/files/.crashlytics.v3/com.condor.duckvision/com.crashlytics.settings.json

    Filesize

    717B

    MD5

    4f1417247fb89b1795e62d8ee1172374

    SHA1

    21a19a4092c83909afbb064372632c30b2e59d00

    SHA256

    0440199bbe2c44c6c68c0497d7500871b92607f3a8a611f780f0ded05cdb1506

    SHA512

    67f131ee13fddc99104ab991d2ac5e209dbb8e5c62f863df8171591c925b7bf0826d49c4ff545041a46ff073f669e2e72f8bc5993415b402a3055dc65404fb5b

  • /data/data/com.condor.duckvision/files/.crashlytics.v3/com.condor.duckvision/open-sessions/66EF263300CD00011073F1B567AA0DD6/internal-keys

    Filesize

    207B

    MD5

    0c2d80bc3b9aeea13e1afffd1dbdef95

    SHA1

    469e58d9212bf2fc270e47559963abdf099e1b50

    SHA256

    24ea044e89761cf93849130dcece1d3c98dc4a813d2efb2389dcff1e448b9979

    SHA512

    74fbd60760a447f7b292f1302fc21d2aa8ae4bb591c4ccf2986c83c03a869853568423656ce0ad54846b1ea9a680021a5258241e376e20aae45cfbf056dd84f7

  • /data/data/com.condor.duckvision/files/.crashlytics.v3/com.condor.duckvision/open-sessions/66EF263300CD00011073F1B567AA0DD6/report

    Filesize

    791B

    MD5

    7f1e4d23f9462eb80b7265b9252a1428

    SHA1

    318ba58453f90b5b367af94bf635732b6675ee6f

    SHA256

    0e0b133dc60eb4ddd69542690032671592a51b6b85afd3ec8cc6c2efb44cce20

    SHA512

    5b94d61b2caae552bd5305fd67493184083af24e1dddf154322213e63babdc1fc25a84922b403f680e58f3209314fee942204f4dcba6e29af84c5fd97a7bed1c

  • /data/data/com.condor.duckvision/files/.crashlytics.v3/com.condor.duckvision/open-sessions/66EF263300CD00011073F1B567AA0DD6/userlog

    Filesize

    262B

    MD5

    a24fcdaa0bd2734fc739cae7f626d4d6

    SHA1

    a989cde8469e69664d8a4ce2f162c40ac61253b1

    SHA256

    e2a1f9a211c25fe3533bc3e4f8451b4e899e3696ef3b0b3e515b1e8044394c90

    SHA512

    1776a72b529935fd2a31a4490a34d278fcb53d6d302a0b2c030339d38cf36998308a24f13ba54ea06757a78cfcdf463ccf4bb05b5e93a1bc03dc62da75e09059

  • /data/data/com.condor.duckvision/files/.crashlytics.v3/com.condor.duckvision/open-sessions/66EF263300CD00011073F1B567AA0DD6/userlog.tmp

    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/data/com.condor.duckvision/files/PersistedInstallation2965779407311959268tmp

    Filesize

    569B

    MD5

    09ed2ce28efade61c859f9d926bf39d0

    SHA1

    0246c653ed011d86761097dae6b275f20700987f

    SHA256

    62fc6cafd67a9c186ac70bfb515ebbd7414c782ab40e4eb84f948a7853a2d875

    SHA512

    a7a2d643a89d5a0c711ae971cfc502092e26995bb66d1de7ee8e72eb30039c70709dd7dbdb2747e9993d095068510c6acf11d6da2eaf0b6ecf72a85d5543c2d7

  • /data/data/com.condor.duckvision/files/PersistedInstallation5038637931963453876tmp

    Filesize

    90B

    MD5

    8b8a9585980178984e4c6d2c8904d607

    SHA1

    4d4bbd3bfc80fb4c6e90aa39ed5599389eb65a93

    SHA256

    4837b61d78414aeb239abf1195c7bd899a14ecab71a988b6900394cb992b62dc

    SHA512

    ca315fecf5f10221abb80c23dd12a112d353b40979cefe214c60defd5eb3fd9d49e37d5055122432411d81e40ebbceb830550ba115b68cbd3ff708333f934823

  • /data/data/com.condor.duckvision/files/datastore/firebase_session_Y29tLmNvbmRvci5kdWNrdmlzaW9u_data.preferences_pb.tmp

    Filesize

    50B

    MD5

    02fd104fcc7d6f6ab3d80a6f8dd5f11a

    SHA1

    440ed1ec3741407efafc82ff0370ca19b4b5132c

    SHA256

    c88fa1b7956a2979b0e31e5eb252e8aa05d0de42b9314a139a33f3fecd2b4293

    SHA512

    aa89cc3b99a565928f2d1b0c41dfabb7b6c63f0aebb5eccef3e82c85744b1256adf4a7e5c28d193151e332b83cc003beef09c7eb94ecffcdf851579e601f1f3d

  • /data/data/com.condor.duckvision/files/datastore/firebase_session_Y29tLmNvbmRvci5kdWNrdmlzaW9u_settings.preferences_pb.tmp

    Filesize

    33B

    MD5

    a65b9b3e4670dc3b48a9609f816ad531

    SHA1

    682a73f2c248815fba0cb50c45031a53d6f8dbcf

    SHA256

    a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6

    SHA512

    6c06e6791dd41c1c8d8e0246e9bf7fed81dbdb5e918e7dd78cc2af1f002f8a532ec28335b229a0ec5c1ee220861092cb1a7c7f4060663394e420d80ed391179e

  • /data/data/com.condor.duckvision/files/datastore/firebase_session_Y29tLmNvbmRvci5kdWNrdmlzaW9u_settings.preferences_pb.tmp

    Filesize

    75B

    MD5

    06bd63584cc699cbc92ade3aeab0ac42

    SHA1

    e21167e5419847271e7f67b3b286916b8124165d

    SHA256

    1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef

    SHA512

    675f177e388425023df5e19cda634ab1e7673681feabfa7bb860089105353166491d15b8c86b5408833230dc5b0ac43e2b5a61e1d36ea0b40d6ce7166bfc385e

  • /data/data/com.condor.duckvision/files/datastore/firebase_session_Y29tLmNvbmRvci5kdWNrdmlzaW9u_settings.preferences_pb.tmp

    Filesize

    121B

    MD5

    1fbccf7b936a9b713de5d42c6d8a075d

    SHA1

    7c8bbdf9151e7f53e2675329d471e552446e9ad3

    SHA256

    232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513

    SHA512

    b9177426b3facda6d86b5a83d05805a4dd2f5357d4979ca7282a13ce3f08ef7e7a0c5922675ada826bde264450b1b4ddcc54eea4de62249fd3eab1ec9acf32cf

  • /data/data/com.condor.duckvision/files/datastore/firebase_session_Y29tLmNvbmRvci5kdWNrdmlzaW9u_settings.preferences_pb.tmp

    Filesize

    163B

    MD5

    14770edbc1290230aebe82f8dcc730a0

    SHA1

    f86874de3ff45c2dd7c982f9ada6b5fc979f082f

    SHA256

    7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2

    SHA512

    c6be6c93262e0c42527722af20fdd3be2c9936eb601280c36492e0bb2151bb63f88bfb150690ae361c75d01a33647c2440bb49e290af38c5c5af5a707320e3de

  • /data/data/com.condor.duckvision/files/datastore/firebase_session_Y29tLmNvbmRvci5kdWNrdmlzaW9u_settings.preferences_pb.tmp

    Filesize

    212B

    MD5

    1868da4555000efb08168d4dbcbb2338

    SHA1

    c871ea081daf8d5a9fe7f4190ac7576e95757fae

    SHA256

    cc3d3cfd871703849cd2046c76196a61be645f085c7b229874991bdd1c333faa

    SHA512

    d1243a5e34869608235ef3f72ca678d933ffac3465bef9e7f154c5a49134977d80844f9ec92b9cbac113b20f300e4c583bdaaadca2fa0ec0049b118ec09daea6

  • /data/data/com.condor.duckvision/files/frc_1:311042505632:android:a9aef538380b8c356442c5_firebase_fetch.json

    Filesize

    1KB

    MD5

    be72d5bc22fed89af846868da6d0fd93

    SHA1

    960f4fcf2f846f51a2c3752ba93f9042eef2976e

    SHA256

    7ae830273f14b609e8de901b858b49db0da3fc7b3113b0e1eff151cff26f9c87

    SHA512

    c8f3f4f12fa4d9f08d5613ff5745c74828ed9531e268114ea6dbdbff73764514d21adb94bc6fd4d71c89c944fa0ce2a87651ad941bec5729d05e8f967f553f2e

  • /data/data/com.condor.duckvision/files/profileInstalled

    Filesize

    24B

    MD5

    1b76cac795f06b77ac8a7538a21fafc2

    SHA1

    7d265f767db9d53481f56afbf2393558dd16eeec

    SHA256

    2994b33978dae0c6e8b9173f31157905b4eadc1033415318043d92cd186e7504

    SHA512

    aa116e3c7fadeea46aab85d22846b189d4e6558ea3fb820d44ba3367f917003420c7edc78167800988dcf65e76575d300ab5aa6854b248ac8f1d38af1b3251aa

  • /data/data/com.condor.duckvision/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

    Filesize

    8B

    MD5

    58e9277de462f75d62d65f7d904e9ce9

    SHA1

    48e86b11818af7a5eeeee9bceb868166d535e6a9

    SHA256

    231389c61ee2c6f3123a19dbd2ad470d46e97da4c18d77d742c26f2a6ce81284

    SHA512

    76b0ea381506b7c52b9549a45f348f4b2b1fac511350ba8249d762c1b8ed02be715adbe6aafbb92576ead07a38dc39f63178a7a2cc0b8c2c94bec08569c56c44

  • /data/misc/profiles/cur/0/com.condor.duckvision/primary.prof

    Filesize

    2KB

    MD5

    187a8ba0deb89c710f746e4e4e8f27ad

    SHA1

    ed69d672f5b8b0f9788764ea4e5f2f5822ff07d2

    SHA256

    94e9d4fad438dc2b79ac16ec8979eaa2b44830946be03667d043358b2e74895c

    SHA512

    739b9e26fd063767606b3c4f209ff6c67a0d1dedb0e5a506a07316bf6133c87621a501be0d9ac9a044b1120dd96d3e53d78f674e331a54efa42bebc79eaa9805

  • /data/misc/profiles/cur/0/com.condor.duckvision/primary.prof

    Filesize

    10KB

    MD5

    ec7795fbd7e9aba55299198346ef2163

    SHA1

    b23ffb68a5fb0f0369ba2ef8bec17853347dcd3d

    SHA256

    68484d86b893ecb1e64e2438ac2832819468c27db6bb409bd0cc554ca41c1e93

    SHA512

    a8446c4f2bab31b797e1b5798faab3c755c047877a9bff2d5add7941527093f9034e090d1949ab93b1ede23495c525cc017b1d428ea1a461bf1180378342d38f