b6e40c545d0e3092399cda5204595c3afedd6e0df01edeb836dc15e4811244fd

General

Target
b6e40c545d0e3092399cda5204595c3afedd6e0df01edeb836dc15e4811244fd.apk
Size 4.4MB
Sample241016-2pr77axcrd
SHA256 b6e40c545d0e3092399cda5204595c3afedd6e0df01edeb836dc15e4811244fd
MD5 86b75b1a837d9b45357f2383900a647b
SHA1 0f27578ac717097d4137964d7ff68f6e750561eb
SHA512 01b12b61b23c3aeaf0c966839c040cc49bc17c1ca0d40c5a84520c742ffa8c00e98428941bd00e85672cf8f64095db2a58e78a1de527f15c4b7bee68a30f4b04
SSDEEP 98304:oJtCBZaUpgyI5/YcRhNifES684FOhz+QKJryCKDjmm:2tJ/Y8jim8JhKVs17
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.rhmsoft.codeund9014

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.rhmsoft.codeund9014

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.rhmsoft.codeund9014

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.rhmsoft.codeund9014

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.rhmsoft.codeund9014

com.rhmsoft.codeund9014
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4927

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

20241016224557726.log

Path /data/data/com.rhmsoft.codeund9014/logs/20241016224557726.log
Size 33KB
SHA256 65c9eed48a4bbfa60fed03fa58047e8c693500f9a3ef29aceb2ad85eaa912ea6
MD5 d79e5dc2ec2f38cf3d3838e3db7aee45
SHA1 6529547c40b1c5dad6f832070a6063977beda6f0
SHA512 fccc7d15ee964797cc40f2bcd705a2887e816bcc6bedeff1a8fcfe02c46e83ba895e096147fe842d46eafd4ae296293311a6586268bffa2d459b6ed6905c81f8
SSDEEP 192:b37v9EH2XBSFUUwTuB2Bpxe25U39Ddt7Iemrr1vQYkV3EDRICAtDlGLK4gVC3SuV:b37vKH2XB4V4BhdoHM
MD5 SHA1 SHA512 SSDEEP

Submit Download

20241016224557737.log

Path /data/data/com.rhmsoft.codeund9014/logs/20241016224557737.log
Size 60KB
SHA256 3bb4d09d8dd91b960b0a9aa50d854fceadfc73e28d182ecbce287f3245a12354
MD5 8bf8d8d12b9b7eb0e23ecb430310369d
SHA1 0095c72bee9b2eba64d4c4c1a9082ebffbc183c3
SHA512 662e53edd3d927e437da23464b668b8fdb13058ab6f71e2d87f012e95195c1cee82c27899c716d641547449fed1564834a131d58c593123886617d44a1d4b3b4
SSDEEP 1536:6PSk8Xnr2N/1vFg5HkFajz6pSbR1uW3N+3tw7MwYVQipIryhBDHVQkXnl98Tjrh6:6PSk8Xnr2N/1vFg5HkFajz6pSbR1uW3i
MD5 SHA1 SHA512 SSDEEP

Submit Download

20241016224557752.log

Path /data/data/com.rhmsoft.codeund9014/logs/20241016224557752.log
Size 20KB
SHA256 83d29da13b7da06dd79699239f7c05f78585324130f162ab40630189ea28ceb9
MD5 05d6380800ad8c879cdd35b543ce60a4
SHA1 6d2143a16950d335bb610aabf063ec96511b3f6b
SHA512 4e50b6a9df7cd388962acb7b90574ff561ed4350ed10c872813ad832a23b0f2a325071575fa510531666d2587633d3557cc66ae5802e9490732b38038838974a
SSDEEP 192:1I3hzfwwFjR1TN1s9tBjObgDyHOtOEPkp41DHjDs1wutz3eDwNG3/z5eh4IEDgJ0:i31w+zbchR
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb

Path /data/data/com.rhmsoft.codeund9014/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.rhmsoft.codeund9014/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 0f470f6345dada26a08a0a13121d6cfa6a37a54140cb5572340010e887a73e63
MD5 450723255e8d549ced26d2e6bcd87315
SHA1 3f5f7035ffaae513ff08b820af0bc37cced04683
SHA512 848b437ef2a02fcd9f37a9666f73f18c572611d8c7652bd8dc7e9df1a1314e68bbcc59eb2c222d8bf348c0db0d4ebe949f42625b5e9a1df758c057ee3b57bbc6
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.rhmsoft.codeund9014/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.rhmsoft.codeund9014/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 36514a4fdad82b746d8043b2ecff872aa8981056912234dc1c1e9cb0d6401367
MD5 d96090c3f9e06dbf04a8a896f2212717
SHA1 46498f802352c17f3b140f271440fb99f1e7e8db
SHA512 09c6663c1837ab8a0138c363014187a3a06ea1b5999af93071e8329108f5ceb62d5eb33a37cc83c53e430c5abcec59607fc37455b9ab21b4fcfaa9a3fbb526fa
SSDEEP 6:KG0vAQ0vv6Wg9FZdrlOERX4PBX4ogLugMBX4suuK+/c0vq/U0vmL0vj4WOw2:K5QIzdTRmBEyPbP//6vv5vxOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.rhmsoft.codeund9014/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 19ce74d043f4aaafb286608ea448c0479eaa8368420b3eac2cb2dab49366264a
MD5 ce28ad861d0880f3a56311f715b5f85b
SHA1 a1dfcb07ad69f1e0bf61f5d30ac9bd3d8837ace5
SHA512 1d61deba0a77693b5f8c5708763b7226b1c45bfa32bf0592b13acadde151766cc39610bda1fe9bd50b7899b13424d35f84b774d1d5eb2d659d8f033e89e3bec8
SSDEEP 48:By9Y66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI6:K6+hdjnHtDRMpf8UzS6+BD8q0ExPALfy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads