ec8927344fdc09c66f4b45a5cba929d65b407742d54e532a29d37097d1107c9a

General

Target
ec8927344fdc09c66f4b45a5cba929d65b407742d54e532a29d37097d1107c9a.apk
Size 4.5MB
Sample241016-2e3wyazerr
SHA256 ec8927344fdc09c66f4b45a5cba929d65b407742d54e532a29d37097d1107c9a
MD5 896202fe4e3ef104fcfa1ddb8dc12bdc
SHA1 468e78a0f1d94dca6fac7988e88c15fad06d9d6f
SHA512 f0e510d70a49a50b8a343d7bca9d96c2d52221b13c26bfd6cc8d487cee4311337982b66ecd37e827ba53bcb3f0d38dc8bcd56c7ac7542e0143101618e92fba06
SSDEEP 98304:JM5Mv87MQ6NyJhq7E3iQqUjBYCvvUcxPmxKULGYqTGqWfrSV:SO8l5X/HdvvUcxP0KUJH5ro
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.rhmsoft.codeund9013

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.rhmsoft.codeund9013

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.rhmsoft.codeund9013

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.rhmsoft.codeund9013

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.rhmsoft.codeund9013

com.rhmsoft.codeund9013
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5108

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

20241016223042291.log

Path /data/data/com.rhmsoft.codeund9013/logs/20241016223042291.log
Size 20KB
SHA256 2a862d5ee35f35eb42fb666f3b1d255c4d8fb9153e8a33369a1942e53875bdb1
MD5 6d66511ea6b295ea51c42ae11b7adbba
SHA1 30c142aece2ddc824c51f46c8bbbba63b375e97b
SHA512 532cac8d6282569d39cf52c73a114d1003f8d1f15b64db47d09a774651ca231bc112f694c415d37ffae795e686659f37b0e9f977a6cfe75353cc07811cc11197
SSDEEP 192:gs3NyKNWfFLvrqZlvn/QeUD2I8EIcSu30De5Dedzc9zLGfzkRz9gzD8nYqiiQUIY:gs3QKNWtKo9/+ARpg+JD
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb

Path /data/data/com.rhmsoft.codeund9013/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.rhmsoft.codeund9013/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 4508cbee83c82cf5d2346e04aa625be5c018e38ccbc26c8d42fe28e4dc485677
MD5 2209a5f280d23f876cfe314b84e399cf
SHA1 a2ec5ca626eaefa0e76a2976fdb5853dfef6b2d2
SHA512 26d9b3a14d3cded2be9c56320f88f1914fe2040e61428c5cf781b9f2cd7c449f053748cb729569a54f8bca541b49538039c615fa03bc4b114d59515ac8328f81
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.rhmsoft.codeund9013/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.rhmsoft.codeund9013/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 9c90a1e2cb2c02a44118a9fd3e9f5bbe594ee3f8994c577fa1b5c64760063880
MD5 ca108406e4097e9a45b69fb5dde42040
SHA1 61c5f98e67a3aa203ecc76263bca59467bd4b60f
SHA512 fb538aa52ee791cacf7d69668b173c2432e3f29cf4fea6abb91d386d5406519b398634bbeda278dbfb9c1b67525234e6a15dae8282e59671a85c93404a08f3c7
SSDEEP 6:Kj39Ug9FZdrlOERX4PBX4ogLugMBX4suuK+/x+sjHL9j3kvTOw2:KzzdTRmBEyPbP/osbL1UTOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.rhmsoft.codeund9013/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 801d76baba4b7ef759b0cc70a061eec414b8b2e64e148938e943edafb581d074
MD5 5a0b7090b09968189b636efae16b3ab3
SHA1 60e2f01ff9513907c7d9bb6d71b91a49930b7969
SHA512 4d9d66c07d39a9292f7775c0fe0d04ea5bc1ebf8fe90f17992e7d72e94a6b2dac1f5926287a6edd96b179c8721c29a228c7b98625ff97bbddeb911e0e1089aa7
SSDEEP 96:x6+hdjnHtDRMpf8UzS6+BD8q0ExP/otZr:NdjnHt9Mpf8UzS6+BD8q0E5/o/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads