01783250d07051c2091bae724c3228a78afb128f29e7a41c3aa77a67be6b4edc

Analysis

max time kernel
47s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
08/10/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01783250d07051c2091bae724c3228a78afb128f29e7a41c3aa77a67be6b4edc.apk
Size

4.8MB
MD5

3b62e4c146184750be71d0dd96557fbe
SHA1

d84a93d5be08a5a3533c42ef5272d3a35f613a8a
SHA256

01783250d07051c2091bae724c3228a78afb128f29e7a41c3aa77a67be6b4edc
SHA512

273e9e7b07d876d5818aa0ef6d6d4b7b6fe75c8bb26b3ceb7683d7d0904f4745e79197f149ceddfb43e86266f4f89701fa2cd3754cb715e26e13c7845f6ca7ac
SSDEEP

49152:AdY7H2iB0/eaYueh6casq82VGgoZ9o/KrEOnXOgbqHWHdfzopJDuoagcVhkl:AdYT144hBasVho/KrEAXvWCNzwJD+Ul

Score

6^/10

discovery persistence

Malware Config

Signatures

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ohOz.WVvQHP

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ohOz.WVvQHP

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ohOz.WVvQHP

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ohOz.WVvQHP

com.ohOz.WVvQHP
1⤵
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4213

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ohOz.WVvQHP/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/com.ohOz.WVvQHP/files/profileInstalled

Filesize
24B

MD5
784b54c6455efde4620eb6458a3faddd

SHA1
2ba2ec5be8f050b24ed10dec169afe369f3ecde4

SHA256
2b6693c433d70ee8b6b819ed566374721db7c6b9b568dff679f1b484828f75f6

SHA512
16116cbcf67325fb3432caa5bbb6c501dfe6ef5bf62a7e9124dfea7348116a61ab7c0efa136d11462f45714303e37962a127961ccda361998f5367bdf0ab832d

Download Submit
/storage/emulated/0/Android/data/com.ohOz.WVvQHP/files/apk/govFirewall.apk

Filesize
9.6MB

MD5
882f9510d6bf1f8bf264d24e1bb741ac

SHA1
600c3737caf9412de397d7078fd781cc93343d27

SHA256
437f2dd12f69964d11be12a5a1f0df844f410faa4d4972927bf89dd5301be9db

SHA512
99ec6d8187feb97d8d2db5ce49b0b2e8e46eb2102a7563ee68e93fb3caa1acc6a8c58161cd50d9906a22b2a2a6714e7abe68bd6fcb2c7563e99eb5d353f04cd1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads