a12c5c0e20f1eb7960a2ee411301984b6e70987fb01dad2e7b70518d05a4cf25

Analysis

max time kernel
35s
max time network
150s
platform
android-10_x64
resource
android-x64-20240910-uk
resource tags

arch:x64arch:x86image:android-x64-20240910-uklocale:uk-uaos:android-10-x64system
submitted
14/10/2024, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Мобільний кур’єр.apk
Size 40.2MB
Sample241014-kejpmaxblm
SHA256 a12c5c0e20f1eb7960a2ee411301984b6e70987fb01dad2e7b70518d05a4cf25
MD5 2a294d8d3f1fc0330ac293a7557cd2b3
SHA1 4df861a824e160ceb46e69c2587ad4a6ab34de89
SHA512 4b220f8d7c8dbd5b8dc7c6ee8b1035bf4882cd5225bd4a13e188323e309ded192baa9be81b1864d9e5ff0aa10f762d8dc5f7f18bcd2e84df83341d35e15d429a
SSDEEP 786432:kV3oVMk5GtoUTO/1hEAm8jddXpzs6/z5eoIp:kV34MkEoUwWom
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	np.ua.awis_mobile
/system/xbin/su	np.ua.awis_mobile

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	np.ua.awis_mobile

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	np.ua.awis_mobile

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ipinfo.io
17	ipinfo.io

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	np.ua.awis_mobile

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	np.ua.awis_mobile

Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	np.ua.awis_mobile

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	np.ua.awis_mobile

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	np.ua.awis_mobile

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	np.ua.awis_mobile

np.ua.awis_mobile
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5086

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/np.ua.awis_mobile/databases/com.google.android.datatransport.events
Size 56KB
SHA256 93f4f9d41b7e2d09a8483b9006e48eff1566e3fc9a3f868b59aea46397a1f5e5
MD5 77470ad362efd3c188fdbeb826dfdf46
SHA1 b46eb4e5cbb85c6456f05f9082bbd6ea2c938890
SHA512 52f85b1c910a15e834a38b7935885fe7a6c1a3d931fb32cae4b62ad1467e0f06b86d2b7869ea05f3235591493075126893e65c25afbbb5184d31fb7c19b42bd7
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSa1:8MEX0wIyNjaa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/np.ua.awis_mobile/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 c59f9e5b25eb7a96f263bc81fa66eddcd4fbb7bd7c42effc40942df07c3bcd8b
MD5 3ef5e417da56231a270ce8ee0d0171ca
SHA1 4f61f938da0be579135edf57fd41d4c30c11776d
SHA512 0f9cb8fe6fc417446f59b62f5a91480b24bca500ea9d46bbb8a0a8c7f1b9e1caa00b375d6f99129c4fd0b0cbfa957925820379b7fbf432b97d4950a9d6e11481
SSDEEP 6:7+/l92WPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKA6lC/e/:7+tpqLJdTRmBEyPbHOSe/
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/np.ua.awis_mobile/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 686f13a2d1d010413bec6b1fa073313b4168c8ee5f0c12ef51d15fd68bb6eaaf
MD5 5ad7dae8ef0db9c0116e1f9cb1f1e4fd
SHA1 ed2cbc2784711fa6e95bbe225d5555b4067b653d
SHA512 616879c8132345ed0dfce33f283223cb5278e7f3bc30757ae29dd37b89cf464902ccf7d61d9b1914ec2cb09498e8372201b32439fd61831e1b611348024dcfc8
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/np.ua.awis_mobile/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 7307fb76302a0eb560bf54d9ffa83c6e354577879321eaee726e1b90b37fc79c
MD5 e766c24e8c10d93e207a82544615db4e
SHA1 80232428e15fd8ec903a8bcffad94a3341844045
SHA512 3d6fbb1dfa717db9d7e9b4fd0e9d0d061e6a5a14ebce18d37e0603279939606a77b69cb49f34650b1cb93e578d2f170610c1e04c9df1291e3985efd955918418
SSDEEP 6:7+/l92Gn1eg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKn:7+tsqLiuWdwRmBEyPbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db
Size 28KB
SHA256 7c3b2d401d2310de3b79c81c20fcf86d1e59a5ae3c7b99a5c33cf7996d2815b7
MD5 3a2fbf4b09bdecb502418437a9140997
SHA1 2cea2f1718aad9079ff26540a9b91d0a231a7bb1
SHA512 bc37bdd232eab9ebfb61c6391d65c053d47ac706ea80dad6df8f60ee75a97397b774f00e8164d0fc3ddf3ece177e01e8e261b83ec31896a06c8a7accd111e633
SSDEEP 24:TLGLVXixByqQWWEqrUhCafBGBGSiGkYkolq/l:TqhX9hWfqrUhnBZS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 512B
SHA256 6fca9c5b8f3f8ebd60d28de457b2cce3f228ea63b0f7618202af7f01a50c7200
MD5 ecabf4eb7c82138afb0ed28f86aaaf43
SHA1 8dbf684ca11e0b7b5d135192e588d6c85a98ac09
SHA512 ed8131abf1bfe92763a93a87ab2392355bea9e8c40c2c96319b9e5fda42697bb47c2e9e1338911ce62a51bcbb9a6bcab202d17e449b195cf331afc3e77a6a107
MD5 SHA1 SHA512

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 8KB
SHA256 87f0faa3a24af1d53c334277f4b90d5ee9711de59f7deaa85dedb74ddef5896e
MD5 6131b731970bf79615a1418831ef7d1d
SHA1 5034d9052a7c0535be7c3615f78fbde9cf899642
SHA512 3a5393bbba2a5dcf77c9e36d879e761c0f395b3e005e1796c2ef6bf2c67ea6852e566c59d77e4439153d5b405aa7a70c0553c69c7fa95b6178011f784035e2d0
SSDEEP 6:7+/l9pHn1jWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKz:7+tFWqLiuWdwRmBEyPbs
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 4KB
SHA256 0492b6737437c0be0ad62c50247644050c9cbb1003c3f4ec41737dcae1da1bdb
MD5 eeb628fcbb626ff6978a7fb71f87f046
SHA1 690fdd69cbcdcd657b7412307023b6a38354012e
SHA512 78231075103cfb1749f461c0a06d05fe674a689e769595243cef58f01677bafdc5b7453386596a374146c615a0fe48d325467cde84d53fd295ae0045f4751b52
SSDEEP 6:7+/lAFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKmy:7+tmqLJdTRmBEyPbly
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 8KB
SHA256 2e43511ec55cf89c85a4cec3376c3b1f31a9710808b9fe45b2477a9c98fdf714
MD5 7c6c2b697e3d6eb68b36233f93b94a55
SHA1 217557da8e329df5622c345d2b9ed6b847758972
SHA512 62ed67108f7fb8f091c32e1a05d96545e27bc0b5f2390df3645e6ae7c19ee178993977067bcc4e328b5ecbadfedd28092545cf5ac3dabd552b42f13691b5d026
SSDEEP 6:7+/l9DAnGPg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuK++C/u:7+th66qLmqCRmBEyPb1u
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 8KB
SHA256 c8d953fac5f3540dae44d9f19c66e020d0175c6b7bd568702c54e5583f855930
MD5 6e3cd7a67b71595d784d9375866edc89
SHA1 9d1e8fe304b6b9e1587d4080e3870124110a6419
SHA512 62e2a1bea2897e302ba7196e5010bb573035d7a2800c749b786f363c64eca6a64c53f09d98e010e92bd1e92c8517fc8ad0bea15e4d44a3c2cb96d6df5d8732ca
SSDEEP 12:7+t5EnqLyKEfyNTSFbyYrrQXxFgjOt97aXJjzjkGyRmBEyPb0lJ3n:7+tqqLy9aqrUhCafBGBGS0l1
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 12KB
SHA256 afa54e92bb770c06790ffc4ed03fbbbd096440ecbdec2081009843450f6c9a6e
MD5 f9d8cfe28ec162fe6ebc0b89d91316ff
SHA1 df382fb5ed3c007dcc815428c2cd72b4a4e34da1
SHA512 94f32b655e9b108e4d0c5397c1818c1c4cacf84a9eefb11ca559ba653b7bb44968215f9a614070783593f5915b0fecf083cbae0c299f948f0fb820fc2cd56e1d
SSDEEP 24:7+txKVYkolKY/VqLWLVXixByqQWWEqrUhCafBGBGSHa:7MgTiq6hX9hWfqrUhnBZS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 6025c54d859e37860e286d3a15a05a534293f97f2863341b3fdac406f3ddd501
MD5 1cc3e91284bd656b0c117129f2fc6511
SHA1 2616c11d14520f438e59df1348bd723e96752585
SHA512 8b4a19a268d559a8e72c4a1fc2638e0e71af1317a98e7015782255575e71a50fd59beb380df7257705f76d2eb54e22fed021a34f27e4b56100aee53faa99e921
SSDEEP 12:TLiEy9zmzrfRmBEyPbP/P+/0Fl6cVQE/oi7:TLApmzr0GSP/PlFbVQ5K
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 906e4a223fd5758fa3ad3a25cdead016c91526b3b8228a6e6900a34b7081fc7d
MD5 b37691acd2be5ff7ebcd21f5ff66b4ef
SHA1 3ac3ed9b564ef82614a9c29b1b2a64d0f0407171
SHA512 718b2fa180cc9072321566f76b914ca50fb311a83018cda7d4e9bb7e641631c4b436bf4a2bd37373789a50eac5179c5b256961f97683f3c0b25eb09016ae59ee
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlD8LF+/0Fl6cVQE/oi7:TLQpmzr0GSP/h1499FOFlFbVQ5K
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 6377af873a9a630c6473b9ae4e94b8cb88b499657423109bb5505460a946a378
MD5 9e26af490473b26d49af5a2b04b66440
SHA1 c8423f729f2ca77980fe8c74258301e9796732fb
SHA512 5e60e802f54a7406d82d3d5b4575b3de4d27e04dab27045c2cc47525cabd4eefef82afc9567d545613dcf5d90a6a6c40ee25c119d37588c6546711b439434e1a
SSDEEP 24:TLEvpmzr0GSP/RKax4/zL499FOFlFbVQ5K:T4vArSP/Max4/zs5O5JQ5K
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 923cbb5a401fbacdb0d42107ac9bf4155207ef113d471c18287bdaa4391cd65f
MD5 1b6f90884a7623866adb8d80b2405ddd
SHA1 50a53cd67bda96bbcc0929d2c10585f79416c315
SHA512 661d0e5a9d82ab198d0d8af1d7188ab2618413fcc8c9f1a1474e4af3d7609ade96c5036f6695e7906f6f6e392f9512d2f7fa620434b0603605cbecfc7a58fc97
SSDEEP 24:TL6Xpmzr0GSP/CKax4/zL499FOFlFbVQ5+:T2XArSP/3ax4/zs5O5JQ5+
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 25023ec00b704eb81e4dcf4debf57e818ce1a281bad5550a9c98e571e72c4391
MD5 d97786a907e43a0d35e4eff299d42281
SHA1 d8f177bc725c70321fbf5c5acd9cdae58cfe2639
SHA512 35c0405806cab2952e6e3d1a35bbf80b0b30d33e9f8e420e858899a9839edc3833d70f556b80c752c95e213c3029468e6f8c6edc749b148232b6aae80eb8c049
SSDEEP 6:l9bNFlkls1KlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WQrSX:TL6EK9zmzrfRmBEyPbP/WQm
MD5 SHA1 SHA512 SSDEEP

Submit Download