2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc

Analysis

max time kernel
30s
max time network
150s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
08/10/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc.apk
Size 3.6MB
Sample241008-c5gnysyfre
SHA256 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
MD5 39fa2c58237de702fc3458251f358cab
SHA1 16e4e5003046f5d07a0fb1eff0dad56d9ce53be3
SHA512 023b77900582d0b6629d587f7411ce5153124cd3870b9533cf9afc5304b874e4353d8dabb7adf8a199768992123e707bc6a87ee682463c3bdccecc8a060e7126
SSDEEP 98304:kyHTjmHgJcyw+WoeX89z6Odp/9hBbW+te6lXhAyHmz:k+jmKcyPsXMl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.systemservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.systemservice

com.systemservice
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5054

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 b284e437f96f3e451de670b720f426ca5c2b410f0d1415965676ca044cf43a2e
MD5 1502e485a75c88f4465909bfe8710901
SHA1 9feb6cf7972b7f53ceec69f0561b122aec0af3bf
SHA512 6fb1574617ac37a755462ab7dc91186b7f6ca04ae74c8e55389e2c10e8201e9ecdf3400931646b8864b4162ef5e1183dd4018bd16f05470e9f05d26030674c2d
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSzE:8MEX0wIyNjazE
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 8640c0b8ce8f8b445243f724f938d90ec397688963e4925c68853eb7711da317
MD5 09fc1ccaaeadf713d2604c565a72f08c
SHA1 e74dd45f4a65d30f8293332a2b21d1e73d7a22d9
SHA512 da4d00331adc3faeb56b7aff94f8b3cc47d93a77eedae2ee09f51a10a5feb86534fae0bd999c5870c1de9f9c883929b3bfc48fc5d4586f111d256b79bad4d27e
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 1bbc08640321054b2ce260e6e6fc8576c40700544f870bf13895fe6ca90c8f44
MD5 11740b220c149f2a0df87b1a3d453ef4
SHA1 6d7d1a583975fe0f208cf84ff212447ac151f7a1
SHA512 00c394c44e96f20aff4ef6b4d95186b1d83e3a31b67bf6ed13eff792725147bb7f7062921ccd576e488ccaefde72a5508791aac9d7fd5a77d9c04b996c8151dd
SSDEEP 6:7+/l9Vln1gg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK1:7+t0qLiuWdwRmBEyPb2
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 20cfcd99ed090428be9522d5315e8826070ce9999fbbe8c69ac3e3d1d034210a
MD5 ca9d9c7a213d22f6e41a076e24c7237f
SHA1 54a85260d52729029d6c6372973bfddac9251b2f
SHA512 db28be23d9a8fd6c4d20bf0bcda3c0321725a3aa74609291e39efea7e8a568c133a3485ede74415a440efd8ae52a720383a36581492a07becfeedaa1eaae360d
SSDEEP 6:7+/l9sGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKb0//k:7+ty6qLJdTRmBEyPb7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download