a12c5c0e20f1eb7960a2ee411301984b6e70987fb01dad2e7b70518d05a4cf25

Analysis

max time kernel
43s
max time network
52s
platform
android_x64
resource
android-x64-arm64-20240624-uk
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-uklocale:uk-uaos:android-11-x64system
submitted
14/10/2024, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Мобільний кур’єр.apk
Size 40.2MB
Sample241014-kejpmaxblm
SHA256 a12c5c0e20f1eb7960a2ee411301984b6e70987fb01dad2e7b70518d05a4cf25
MD5 2a294d8d3f1fc0330ac293a7557cd2b3
SHA1 4df861a824e160ceb46e69c2587ad4a6ab34de89
SHA512 4b220f8d7c8dbd5b8dc7c6ee8b1035bf4882cd5225bd4a13e188323e309ded192baa9be81b1864d9e5ff0aa10f762d8dc5f7f18bcd2e84df83341d35e15d429a
SSDEEP 786432:kV3oVMk5GtoUTO/1hEAm8jddXpzs6/z5eoIp:kV34MkEoUwWom
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	np.ua.awis_mobile
/system/xbin/su	np.ua.awis_mobile

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4573	np.ua.awis_mobile
/system_ext/framework/androidx.window.sidecar.jar	4573	np.ua.awis_mobile

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	np.ua.awis_mobile

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	np.ua.awis_mobile

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	ipinfo.io
28	ipinfo.io

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	np.ua.awis_mobile

Checks the presence of a debugger
evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	np.ua.awis_mobile

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	np.ua.awis_mobile

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	np.ua.awis_mobile

np.ua.awis_mobile
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4573

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/np.ua.awis_mobile/databases/com.google.android.datatransport.events
Size 56KB
SHA256 6e02653d852129321564fc40b6a476f554897b0fcfe96689807c10c23a648f78
MD5 57c5b00fb5e333e403ca4664d7c89748
SHA1 f441543ab923b94f3a24dc283ab914e699d58efc
SHA512 4a3b2c7bf882202770f8399ff1cfbc712dd9c5e4405fdac349a8d6f9f5af3dd1413c0ca23220093a0923b45088fd32166386cb141851a2ec35c6521ef3ff15af
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSpC:rAMEX0wIyNjapC
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/np.ua.awis_mobile/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 bf523d56b26465e965d4b4884dc84a1ac2aee3639b4f6673b3ceba515812431e
MD5 b048ca8d58a604811a565375c84f99d4
SHA1 e1c561dc550f1e01e8af88b16210f993f10f2b09
SHA512 5304c227f384c9586cffaaa0d17b6f0624ce8f5e0bb976907847c89898cb83b203dcfb35aa800eb58e7997d220ab7fc057e83a1d436c5a3bea073cdd785ed502
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/np.ua.awis_mobile/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 94f64e3f47391144bd0857df061bf24249721209fae21e85f088e968106f8695
MD5 d376c60fd238483beb38f7adddfd9c6c
SHA1 f5b550296e8edb2c5402c7f837e5cc922e850e85
SHA512 66ff1c68de2600e5d1dda5263171c45a840b6ff8367c9a49ac9b2342bd2d77e0f75cf4a9e2df347cf41c68979b9d4921113bbf2ccf1fee0944d7288a37f90ac4
SSDEEP 6:7+/l9lMeOn1Xvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK+f:7+tovqLiuWdYRmBEyPbPf
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/np.ua.awis_mobile/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 00a37083bf1f0251fcd2da79a3d2e9ebd82985b072e02c2dadec1c89119c27c9
MD5 25d7e11a700ebeee74b36e80875df4ab
SHA1 91753a984f09f7d61732e07957162291b2d170e8
SHA512 9fdad379ff774cacafc321473d11a629adda65dbf7018ac957ee5b503e6c4f7a6c2637a2c48093e979d24d52626f4509feb436386790d4774eba5f870a0c4ef2
SSDEEP 6:7+/l9wtuHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKsp/U:7+t9vqLJdeWRmBEyPbnU
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db
Size 28KB
SHA256 4636b0eadfcb15e4beefe480eaad11d07ab32b9d0e7f810749194cb7ac13c92f
MD5 df05d2c6b03df75152a6bea5feea1a0d
SHA1 ff0474e2a5a79342fac85f264b5b608b2a4de937
SHA512 b4acbadf853827d4f92dfeab46e4133d727ffff5aa433d252299b6150626f9b3184b1682c06aa26a307f782e07ab736d08010e825284b82cc088463ae8bdc13d
SSDEEP 24:TLuLVXixByqQWWEqrUhCafBGBGSiG04kolqBF:TihX9hWfqrUhnBZSKbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 512B
SHA256 1d2103dd202acda511049607c25eefb3b93b0ae21225b879fe222829212475c2
MD5 5e6965c5dd2e770edbcf3b538db1d963
SHA1 fb5733e9e2a030b2175b65c478a006dda0550280
SHA512 881e4d6bd1201f9ef9d49e678a544494b9318d8ebddf928169d9fdda85d344f538d051f7925eeecba22ffb81907c008ae70103c658e246f5fa62f707223d7c22
MD5 SHA1 SHA512

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 8KB
SHA256 c9890d09d405e9d682e5d6ce8d6338b69d7a81a72e73a0f25437d3b392642515
MD5 3d475b7fcc126b6fa8893bc469c1226b
SHA1 2a07944b7295c370b13b4389cb0a5e9c6eafa83c
SHA512 2ac8c5fa52dcab676508eb48c9992fc2158413fb3e866912568ee49ec7b167fd67acfbfea2eb5ebf8521a3bf91d6087e64dcd8961f056b0d0d90ac05c5b726a3
SSDEEP 6:7+/l9nYl4n1Qvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK8tNQ:7+tFYzqLiuWdYRmBEyPb/NQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 4KB
SHA256 548c1299aee8b235ca1cb457d8112262109ee5e1aa05ce5734f973e1b983b1d0
MD5 09cfa8fc7647e976ed1c8f73d8fc2178
SHA1 99a043753fb592d4877a07a5b2df838fc1a11c61
SHA512 9337e05936f86113754862f9c29d7f6d93f2b62bc4815194c0a9ba1484f9bd30aefc6e0a0c86da57e53e3b870be05c78661e55c59fbae9a72e409887c24bd4f3
SSDEEP 6:7+/lT3APg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKV:7+tTIqLJdeWRmBEyPba
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 8KB
SHA256 755311b527bc9720221fb398aba759ee453d453a86bb19a3c5a3925902eba57a
MD5 8fa5ea82adff6314a0e94a2191c4e58b
SHA1 c2472a5262e3f1ebe6596fac1e35af67e94b4baf
SHA512 6b647e0801119bd98c87306f153791d77a68fb776e2f750cfd93ea503d0f3fe34351e3fefc523d1e8a618af95b55a0b8dc14932bbef8c87ce62540df6eb78d72
SSDEEP 6:7+/l9uQFPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuK2t/y:7+tk2qLmqKRmBEyPbn1y
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 8KB
SHA256 8b6485839a459fffc87cfd9c3acc3ff2a28fdd66991386f73814db61083396f8
MD5 b21f6a6a7e07b0a665a3f0a9fd0d5dc4
SHA1 af057c31d1cdd9b7e5af58b3f7f4ac485de7179d
SHA512 0bbd4ffe910ca66f64d0bbaf7afff48d47ad5ab9305e0d27e5be6df00c9a002e93ce3d7c22c50ce31b2a573e16fc29a7c0f33984cb4cacc2d380457e301fa9ec
SSDEEP 12:7+tcinqLyKP8yNTSFbyYrrQXxFgjOt97aXJjzjkGyRmBEyPbYJW:7+tcGqLy2JqrUhCafBGBGSYA
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db-journal

Path /data/data/np.ua.awis_mobile/databases/google_analytics_v4.db-journal
Size 12KB
SHA256 4efdcf5b03cfc69a3cde98d46e054fec65d5f036c1fdfc7749f043967d49b4bb
MD5 62515980bfacdf43fa9cfb2bb1a8aa8a
SHA1 c716adaa4c51598e22a2a96bac6df52ab8610312
SHA512 ba39111e6aa6ff33cc057ce85180e132d8a1b5a080da080ce78632abd910b977368c41048a632a69bbd119c4704b241e14036e0978a57d127ab81c2820d2771c
SSDEEP 24:7+tryz4kol38YBzqLeLVXixByqQWWEqrUhCafBGBGS8:7M+zzwzqShX9hWfqrUhnBZS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 b4830a343b3312bbc1cb081d8cb3387da318a65d60e2f81ee241c0b59a46315e
MD5 a8d441337a27a573e2245ed704c69d11
SHA1 1b59034530699338b85731f1c5d3a7d6b38766c3
SHA512 6a5c60ff66b22c5d1ea466f271fc317ea889206e19e35c428f94c0086086b39c7e91a583c87c19d97d876ff23c7b4f6fd42980f6aae1ddc77d34725e1cfff317
SSDEEP 12:TLiEq9zmzrfRmBEyPbP/P+/0Fl6NEMei7:TL4pmzr0GSP/PlFsEMeK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 793a3b903bf8dd982818feddc58c5e5279c897ece35da2ea1c3552f4c0482d47
MD5 84f61109e7c589aa39abb1eb3325c1c2
SHA1 b38692c4f0f70ab4622cf26807a9aac4c94f71f8
SHA512 e94e3c170822e490f66017f8b13e11afa0fff4535342958d327f6fdd50df151232ac6a5dd268388caeae34bbca1fd571c39d41dcede1ff856c5e9807f2d9c5bb
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlzluK+/0Fl6NEMei7:TLopmzr0GSP/h1499F3plFsEMeK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 dadd35408afbbfd0f5527de336170ef4b6697592114f7f39201598ac86ea868a
MD5 f82f5e94e9c4a8b2a64f61a500d054a5
SHA1 18c394e8da9861d33867912413e34803ddec17bf
SHA512 172d9c166f6daf81d52db8b4f523ba437c86b401b876707e8382f484316dd03e4e344b01a25e3868c52c06c6b89d35c60a37da4e06168bd301372d77393a61a6
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/ROLax1HOAUjuUyWl2m49blqYFlzluK+/0Fl6NEMei7:TLYpmzr0GSP/RKax4/5499F3plFsEMeK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 1227c37bba7feaedf5b89f0e61484ff0807fc462a8169be3f1ab6ad28e75634a
MD5 bb2ec3f6cb6088a9b64515b3291dc6c0
SHA1 f15b771b3440b3288782ada8071c29fa0a31f141
SHA512 311c0b6b9f943cf1ebe72540c1606aa3e3560696b74d302ee3999739cdc167579a255e68b768ae763a6c6b6dc86e9b9bebceda40a0293849dd4fc1d46ac1d2d9
SSDEEP 24:TL6vpmzr0GSP/CKax4/5499F3plFsEMe+:T2vArSP/3ax4/m53VYe+
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/np.ua.awis_mobile/databases/google_app_measurement_local.db
Size 16KB
SHA256 c6b39f25e2d169a083bb4a59c23ecb01c6f5897523c9f7602b23e0223b3a882e
MD5 0dbe941bd73be5c463e1af69029ab6d7
SHA1 bcbbd1587574bb5046c5f76141785a3df1ed103b
SHA512 9fbb1fe347fc0bf53cb07123d97264c93aafd7573d940d80ad99216a2bbfc659eafb66774381ee2ba9d9f3823a39c461954f5423ed8632326e8c85348d8de9ee
SSDEEP 6:l9bNFlkls16/nlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WQrSX:TL6E6v9zmzrfRmBEyPbP/WQm
MD5 SHA1 SHA512 SSDEEP

Submit Download