Analysis
- max time kernel
138s - max time network
149s - platform
android_x64 - resource
android-x64-20240624-en - resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system - submitted
15/10/2024, 22:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5bcb9cb362b0b8d1b400a43301350b9e728cfb533f516d60e18dfe8d910219e4.apk
Resource
android-x86-arm-20240624-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
5bcb9cb362b0b8d1b400a43301350b9e728cfb533f516d60e18dfe8d910219e4.apk
Resource
android-x64-20240624-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
5bcb9cb362b0b8d1b400a43301350b9e728cfb533f516d60e18dfe8d910219e4.apk
Resource
android-x64-arm64-20240624-en
4 signatures
150 seconds
General
- Target 5bcb9cb362b0b8d1b400a43301350b9e728cfb533f516d60e18dfe8d910219e4.apk
- Size 1.0MB
- Sample241015-1wrpkatdlm
- SHA256 5bcb9cb362b0b8d1b400a43301350b9e728cfb533f516d60e18dfe8d910219e4
- MD5 417f9b19cdcafa72b6d6d211ea0a86bd
- SHA1 1af055f9a0430d646512801cf0919b0a0ceb8235
- SHA512 b742adf5bcc40d38903d0d4d3c557c8dfa8c1221a96ffa3b0f82ffcb2decd247e8fa5f86f6c0d5bcaeb0ff067fd1806b0d0e4835f54f0826b730a021df681a74
- SSDEEP 24576:c1wSAobV8WuWi89FLWQlRzrIOM0s/zXuPO3HWi7Z:gwKG89FLWQ/zkR/zXrWGZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener fm.expositor.app - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone fm.expositor.app - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver fm.expositor.app - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo fm.expositor.app - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo fm.expositor.app
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /storage/emulated/0/Download/ads/clst.dat
- Size 15B
- SHA256 23fea75398b0b81acf0ae44272de25cb42323ed18bafc1c2ebb6b80cb36fce4c
- MD5 96d70b1ada0ad8b7ec6169deae0490fc
- SHA1 e7bfb0840a67a32a886e7c1edcce6c6b6dd775b6
- SHA512 5a75fd6068fe5b8da19881ed4bcbc26d9a661afc0789c39a5e66e63a2ae87047d18d70e222e146f9331c95e61cd950cc52839da83d3e0b2baf2f5edb8eb6ce95
- MD5 SHA1 SHA512