49b5610e0fa6168a1bc961cf6494e9f6f5d313c4cd914fdf6007833e4732fa83

Analysis

max time kernel
50s
max time network
155s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
03/10/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49b5610e0fa6168a1bc961cf6494e9f6f5d313c4cd914fdf6007833e4732fa83.apk
Size

4.4MB
MD5

3fd035447c39dac75b4a94f52b12a7f9
SHA1

0babca3d83c5919996d88d62a744d38c51db3ae5
SHA256

49b5610e0fa6168a1bc961cf6494e9f6f5d313c4cd914fdf6007833e4732fa83
SHA512

81cdeda96048054039e3f1c1edb19be03157eb38a64fa3426802938ab3f7011227152c4ce4cd91cbe16fb7704c100f0c45ec29835aef70ce708cff962ba4b7ca
SSDEEP

98304:VEgPouqiF7Pqe0G2KNJIwaALKSmOwnzuKZWMYrSU:VErBepFaAXdwZOrt

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.rhmsoft.codeund9013

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.rhmsoft.codeund9013

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.rhmsoft.codeund9013

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.rhmsoft.codeund9013

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.rhmsoft.codeund9013

com.rhmsoft.codeund9013
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4962

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.rhmsoft.codeund9013/logs/20241003220959786.log

Filesize
33KB

MD5
305a2b766eba09c555c9fdfc3ad2a83d

SHA1
acf2e3831836518c3fca34a7c8e793a07c84f2de

SHA256
590f2b73f352bdc0235f02416b03b04bbd7dd6b4d9681cd4643fbde6e774587b

SHA512
fdda7d255b48f313f4beef44aed3d7a9f935ee1862627d65ca99442df8e2a704a8f3d718bc93c93e4615b6e9a04d8d694d39e5fcd49060a4c89c0ab6a0812a4f

Download Submit
/data/data/com.rhmsoft.codeund9013/logs/20241003220959797.log

Filesize
20KB

MD5
4750ae99b50fe2cefb23135a95fdfa59

SHA1
5e67e1765777f24904df5968c90ec139c94e2035

SHA256
6c2f2e92e5bf47f56f4d29c71558a941d1214d889363939a1589dd51cf144934

SHA512
12959684e43c07821c612ccb7ed6d4d5c03f1f69c84770621f574937140cd1c542eaa68a9ce2de5250910c8edda51896a8016a23b06c1ef9b947c55b862b726f

Download Submit
/data/data/com.rhmsoft.codeund9013/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.rhmsoft.codeund9013/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
e0bfa89f8c4d91383a0788c2796c0cb5

SHA1
60375a089ed9ad53e3fa27ec2cc413f805fdea7b

SHA256
9ef39825b20698c338a644a1e95352899146f301b139f1b8675888c038b916c3

SHA512
b657181c03204c2ce072df741bb0659c67c77f97194de6c84ddf58e10cd99101e760c5a875725ef2026ef79ea6e9bf5e109566fedaaff013976f1dad0e9c4e83

Download Submit
/data/data/com.rhmsoft.codeund9013/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.rhmsoft.codeund9013/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
a49e38bde9e8b19185ec561b938a875f

SHA1
4f570c599875d58e70dd73bb994f39431831be21

SHA256
1fa6afe3c8430c1a3cf2dfd4265d7f117fd5bc3693fa2fc00311375b62837364

SHA512
1961286b26ea05403d0bdfaea49cfa93e7edb90cf4bf214a72b3ea16921a500c71d2254b9a90abb6575d4488e7b3e24e8cbd84be9e6766f5a5869e07a1dd17f4

Download Submit
/data/data/com.rhmsoft.codeund9013/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
6466d416503583fdb10964bdf4f017e4

SHA1
516580a454fe8bfaf7b39742fb07558dcb30c60a

SHA256
f0dcc571609b845cefa27482af407cd92c4fb40e200651fdad2b984f0b3766b6

SHA512
5f66452ac3e58b4d149026c5c3cbdfb7980b746983bf806a787a12b9f3f637ceeda28bb81477d9a8a10f56e107d2cfaa9b233a75f14ed58fc2fa51076dd30d33

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads