0996ed9acb21ea6f0a88c337e5b85bcf64e74f972458a6615078710ae5e7529f

Analysis

max time kernel
148s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
28/09/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PouUniverseSpyWare.apk
Size

24.1MB
MD5

df9fbe5add0819e5689c905ab5d56153
SHA1

fe7a0401d1221cb29b624e24e04f3f23c65dfd65
SHA256

0996ed9acb21ea6f0a88c337e5b85bcf64e74f972458a6615078710ae5e7529f
SHA512

bb531940a94b6f6e04f218eddd3d3fb985452bf11705072a324dfc3187a0bcba99f5717778b58a2af80df58948cd56fa2eb0f673935a176621687a8d7a28e5d2
SSDEEP

393216:P3On7OgumPypg+m9tak1e7b0x2TmEdlrsavEVyaKgZg:mn7bumP19takIox2S0gavEVyaKL

Score

7^/10

collection credential_access discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	me.pou.app

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	me.pou.app

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	me.pou.app

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	me.pou.app

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	me.pou.app

me.pou.app
1⤵
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4316

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/me.pou.app/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/me.pou.app/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
cf6295fa8c216f10abcb397a0248b398

SHA1
e83ae7ceef15d613f2d035f2af9d71169711e9bf

SHA256
2321738d2279237675aefc5cd0672c504f911f171b794ab9125a5d3637e99ce3

SHA512
dbed8016393b0974435b971a4c1ca492b1de7f7a067d9a980321073c1eb6b0d4b8cdde953508d8ae78ba01acce91c2426d3ba8ec6c64946eeff151b56635913f

Download Submit
/data/data/me.pou.app/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/me.pou.app/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
d4344aeb7b7e09bd6f535e71d5af604a

SHA1
eeac74c1f9721bb3c79c6a3c0ffa4a68505ad834

SHA256
32ad32dd9e73a175c5abff3b858d7b2c08fe8b4508860ac7269cfd498c8273e1

SHA512
41d157f6c7602f1985a4462f97828c7a0efc11454d2f56923d521692966eac4d4d8ff10321437801120f80f2b8e3f4237cd0c9def09222a8befeaffdf7273dfa

Download Submit
/data/data/me.pou.app/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
143e44c8a940b3ecb92b1dabeecc4250

SHA1
8f0de0c575e9beb0e269a89cfd7099d836b839a1

SHA256
249688fb4f774dbb6eea805b480d0b4461123526b2925dddb058c0b9eac66249

SHA512
7668ae0ec1e247fcf9c567a0650c92cc1c9d8261d3b1dd715c7f4f4bdcddf52adaa70f652f8cfdce01692f0797730162e1627c55ef3297d112c7cc02088cd6f3

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-2024-09-28.txt

Filesize
16B

MD5
b91ea17ab22fa4171a9dcff0821928e2

SHA1
1c0732926d019c4003c49ddc26fa6cfbafaee9ad

SHA256
77b4dc7e00340b8ec43533e78a407991be2b3b2acb88813abfc5fd34e53c9aac

SHA512
e442b9833b325426199d743753fb3c9430275301e4db6de8bfd78ee67ac71fcfc154ecbb4d1f7bd6c9c7d7dbaeb217dc63cd822f928b73d9e60d7236a75eaf09

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads