5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb

Analysis

max time kernel
17s
max time network
157s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
28/09/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb.apk
Size 3.6MB
Sample240928-ctfyaavana
SHA256 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb
MD5 d836feab9d4bf3c6cf086bdc14724c8b
SHA1 c837cf7b181679a0081165e5fe4aa0eb94f748f8
SHA512 8c7801c5f1d8dfda39e0c65bdbea83feb8f217b41b69a245d01dd9e983a6a357c8b0b2be79123bed07e638655fc66ef3a093cc01be68c696ecfea5ab6c692dad
SSDEEP 98304:5s13ZL3Vf6JqeomaMDmQZ75ub8GoRJ6Odp/9hBbW+te6lXhAyHzwI:eTLVf6JumaMiQVWovl9jS+oS4I
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.systemservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.systemservice

com.systemservice
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4983

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 f6dab31a6ccbac704010925188a27d04165b68fd823f58185848dc4f860eca92
MD5 8585cc42ff0dd78180f4e9002d74cbb4
SHA1 26674ac9d8ce19a2810922c133b75b9b63e4fc73
SHA512 e10a5dde42e1e2817854f9bf00f5c7729805c20569816ae7b9d84189dc35af77728081610bdef52064222ad3c9e0a289da5d03047866e625e7b454d215b90e40
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSCV:8MEX0wIyNjaCV
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 ebde0e2f34eb6d8d368a7c11621894b35b4f39ab527a3b4203f260d2fedf7a2d
MD5 1ddaadbe15008b3b46c88a30206ddf03
SHA1 7d77a616533cb9b7b54f3250901440726a919d26
SHA512 5f1d85a78f142e506f594b7b84fc3eea110006f47d9ce3e1936273d9e576d0a5499207dc136080507a9f1ddebd325604459d4c5676b16266c896cc023ee5217f
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 e1c40988badf5fb2a04cb9b398a8e5da85a4f9f15ed332ad1b751829206dd213
MD5 c60557602f0f4bd97b7ccb8cfe08dcd1
SHA1 c10f421ba22ea8a4e209cb393a39d6b8dc9ddc6a
SHA512 2fb57d7dc9c8ee34418e60218b30445e5925adcbbb7609752ab37c8890ef0f59b22a75b3f792783a92eeb82cae7af4d6941875c659153a2ab9dd73e95bd5be11
SSDEEP 6:7+/l9Ln1Qg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKqUn:7+tsqLiuWdwRmBEyPbe
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 194ad3b67dd7c4891a4f455012a5388ba160f3cafda9843f8d72861d5559a004
MD5 b3856b0b71526944943c209390f21b1f
SHA1 235ddd243bdf7384036dfb445185cbd3126b013a
SHA512 8a45cba548a27e564343452ae6a8fe97e22d4a5b890d69c531d71aca526d0ebc4662af49cb95eb47545c94743d258cfe64ceff3f7d76432aed6bc4e43215b75c
SSDEEP 6:7+/l9EGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKtK//c:7+ttqLJdTRmBEyPbqKXc
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download