0edae656db4b5626b6dde1786af67d455a843d8fa6059a5a88eeb2b0ae214aa2

Analysis

max time kernel
137s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
25/09/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InstagramsrcsignCopy.apk
Size

5.5MB
MD5

a64b52af666ac8508f0c414de3284813
SHA1

6490034e0f75fa4da9cbeeb378e6142e69ae3c21
SHA256

0edae656db4b5626b6dde1786af67d455a843d8fa6059a5a88eeb2b0ae214aa2
SHA512

71bd20bbf513faf86022d0c2ac30fcb7725884f7aab73ce6b13fbce3cf8301158fb8582ca6889d22dd3bd113545a8b15a85c3dd1cc2a6084c058dd45da902f03
SSDEEP

98304:NwubXW62AALy6GqYZpcQb788aGg82Qr9pzbuV7zphCIJaL31M8UofrFF3NP2:NrXZJ6nicQHNaf8/IXrJaD1B3V2

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/data/local/xbin/su	sigma.male
/data/local/bin/su	sigma.male
/system/sd/xbin/su	sigma.male
/system/bin/failsafe/su	sigma.male
/system/xbin/su	sigma.male
/sbin/su	sigma.male
/system/bin/su	sigma.male
/data/local/su	sigma.male
/system/app/Superuser.apk	sigma.male

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	sigma.male

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	sigma.male

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	sigma.male

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	sigma.male

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	sigma.male

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	sigma.male

sigma.male
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5067

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Android/data/sigma.male/files/panel.txt

Filesize
19B

MD5
6e0075dcc0b7ac222bea767743b61a33

SHA1
44b3eaebc17568ca6e120747fef61521137068d9

SHA256
d0d1b610858419980e61586967769ed1bf001756aacbd5e00518b3b0eb83a402

SHA512
9950d09e464f74889ae85d70e72e57197b8a2713518bb7901b2c7b6e1ae51dc7e53547b2865f0226bfcc3bd5ea530453298512f8ecbc7b790da3339b5e05cf42

Download Submit
/storage/emulated/0/Android/data/sigma.male/files/uid.txt

Filesize
8B

MD5
139d9e123e92e9990862594704f3152c

SHA1
d21560fac753634342a9568be3d432bf8258b78d

SHA256
6ef75f4383f1a2c70a1ebac40db5a919684e0f3984e6a7149e45eaff117c1ff1

SHA512
f9d1857acbffba5aa1c9080980424faa7caa24f5edc22a51d8cbfabc334d6e4ed148fe54a437c4c0aa960787de579118a20442c77dfd22cc216dbf5a2e1dfbf5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads