0b8864054b8bd58b7e42440dd9736392c015959841232ea044998d877b7c743f

Analysis

max time kernel
19s
max time network
129s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
17/10/2024, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MyBro.apk
Size 1.5MB
Sample241017-gs73laydln
SHA256 2f8faa2c03cea4ddf9112251a57a29a93aa2619ff7613b2dcf738a78d0c9f054
MD5 1254af5d5e7681b78703c9e89b3d4977
SHA1 012bc4b2b33b5b2b9d15e7b877e1ab7a7531b768
SHA512 cf2e5757b40e64bee900bc4ca97cbdf885357bf23b88a96427a082d52c1c1408db8b037bd8bd83fd59274f5cd0f081e98e29b10db6f17bb873fed716b1b6d594
SSDEEP 24576:o9Q977IPzWch8MbRezSJbZFgBnxfxeDFan0G1EJIpxsaMczSDykE:X9PIPzWch8sRtJbYVx2FpJIXsK2DK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.llq

Reads the content of the browser bookmarks. 1 TTPs 2 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://browser/bookmarks	com.llq
URI accessed for write	content://browser/bookmarks	com.llq

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.llq

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.llq

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.llq

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.llq

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.llq

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.llq

com.llq
1⤵
- Obtains sensitive information copied to the device clipboard
- Reads the content of the browser bookmarks.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5095

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Data from Local System

T1533

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

ZIRCO

Path /data/data/com.llq/databases/ZIRCO
Size 24KB
SHA256 a7cb874d8a37b8b146ef4adc534c816327d583c5380be9dfe640ce3e60d91358
MD5 5157e49a68e7a39cb3a034d265b66799
SHA1 df70635912001b0de4714ee71968680d3827ffb6
SHA512 8028d474eafe306ad3f9060606554b916b980d02115e3915eaec64b71ead752bdb490a488e0c8d67389d42c081c39861284a0185cb751d4997edc11ef45d8f8c
SSDEEP 12:TLKgq4Xa1U9Q6LTSFbyYAyO9eFu/9Q6DfRmBEyPbD3Owzkaq:TLKtO7qAT91Fz0GSzz7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZIRCO-journal

Path /data/data/com.llq/databases/ZIRCO-journal
Size 512B
SHA256 dc2aba0a8dddded31c945b133b52331edaa5dda048c0c31758c4ba3d812c9d6f
MD5 d8e357d84e85882bdc7f44075a1b3fc6
SHA1 16d4da0938bee95198ade9e49ae948087740757c
SHA512 73fbda9f678ebd9720aaeaad76d52d33287fdcb4a76f4eb16d72cbe519be309f7eef510ba105bd19b53f2e676ae90a2dcf6002c1dec9b680ca3d690b0af10aac
MD5 SHA1 SHA512

Submit Download

ZIRCO-journal

Path /data/data/com.llq/databases/ZIRCO-journal
Size 8KB
SHA256 ce3442973dce313f571298704a43cb6404e5315673f91c2494ac7cf06e45cae1
MD5 b1883ee4e2f6d0978663aec20b88d970
SHA1 b629bb727cad3682bfe9d50fb2f80d7d96be98b4
SHA512 2a5428ae1eabdec51aeb09669dd9df8ea7778f140a7db68bb4f4f6b445578b4b80b35152726b723a9aead64cc80581c623bd7ff59cbb05af6a7eee9cad501479
SSDEEP 6:7+/l9naZ/mlFn1wkWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK8o:7+tFaZ/SskWqLiuWdwRmBEyPbC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZIRCO-journal

Path /data/data/com.llq/databases/ZIRCO-journal
Size 8KB
SHA256 894793407b2ebef5cf31841617d0629b5992dddecfb19c73e287b156e8408844
MD5 00546a1a2ba14174a4a10b188d8191d9
SHA1 0caeae6893d4de7e4d1e9449f17d62b205ebd163
SHA512 6ac1e7c8f2800bb46619748c5a94d90156e1ddc80ad89f9a9e3ef3a1a1b3c78b009288f69ffbe8b71b47c722f1f23e2449430fe3a4f1c351ed40aa0567b0e593
SSDEEP 6:7+/l9XgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKx//t:7+t14qLJdTRmBEyPb6Xt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZIRCO-journal

Path /data/data/com.llq/databases/ZIRCO-journal
Size 12KB
SHA256 4711a6a5b46a7f0f5b115969804ca91195dd55cc30d49799f6cb27887e9e8b7a
MD5 48add2b3a53a827ea3ad23286fc4888a
SHA1 cc5aaf24267eb22c5017fb8e92b72fe61dacd7cb
SHA512 41392471cbbd560f5eb499c45d85b939eb0f7853950c2973a4ac898207dc622d4b795a35883dd85632ea83c22a6b4f4d6cbec5d09a96e7b607e29eea9a5715e7
SSDEEP 12:7+tPqLbq4Xa1U9Q6LTSFbyYAyO9eFu/9Q6DfRmBEyPbPm:7+tPqLsO7qAT91Fz0GSPm
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks.db

Path /data/data/com.llq/databases/bookmarks.db
Size 20KB
SHA256 a9f18d67008072a68276ebedaf1b8d3d7eb1c52c1281c0a8703c7b2d5af186b5
MD5 dc64a7c47ec3e28b53aeea6b33e92312
SHA1 d8f7c3b72dd3c322ea4f9df447acca62b60f8889
SHA512 843432a59690d9f00f52d9e88099529cca9ac935211b03fdca45d6b25af70201548397d69af7f351014850ab65d3f52f447916fea7d775a8bf8e4e75fb0dfb9d
SSDEEP 12:TLmROyNTSFbyAERo0K+S8oJVl9T5PbkHO+q3dfRmBEyPbAVOwG:TLwT7EWozOHOvt0GSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks.db-journal

Path /data/data/com.llq/databases/bookmarks.db-journal
Size 512B
SHA256 afd38a48b4755a51c1058278db43ec2361a7d933873823ea479c848d19e63483
MD5 b9a1e8f82ebff7f65e23e9666e8e6675
SHA1 9e8a8191f1688bf3ee4a49482c38554ab8909e16
SHA512 2a859b09ac00cb714c624182878b1250f438af4e598049022e5f633844fce714761dbaac5826b2dfbac28c298d1d53f02ecc4643c5d720a6514473c9ea61b29a
MD5 SHA1 SHA512

Submit Download

bookmarks.db-journal

Path /data/data/com.llq/databases/bookmarks.db-journal
Size 8KB
SHA256 95e7f281a5d7627529b76b8a1fff00c2166b4324008782d148e59119654868dc
MD5 40c6e8d0bb8f0b2059a0025ca3be57be
SHA1 98d4afbb5e8c6ab03c75389255b1fc31607103b3
SHA512 8ed861e2146eec3bf350cce86414211c9c253667a03cf357d9b892eb917d26f14a1138cffa27989a74aab8946d6ff2381786f291c64299cbe1e118460a610616
SSDEEP 6:7+/l9rtn1Cg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKwJ4:7+tJmqLiuWdwRmBEyPbr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks.db-journal

Path /data/data/com.llq/databases/bookmarks.db-journal
Size 8KB
SHA256 cdf173264a5a1a9074a023fe27c3e926b15829821bfdec1d860934e0eef86e98
MD5 558bc889cf721bc0361c63c3a814a832
SHA1 1725fb528bc7eae6e42006f1bd7ef8648e9c3a24
SHA512 8bc377d0c7a77f33b1cd1077621dad731168371391d8aec6f2c072353ae9a93caaf600e3546deadb17e3f6ff6fbdc8601482b0b012f136fdfc6a2a7bf977b57a
SSDEEP 6:7+/l9fHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKla/oP:7+tVqLJdTRmBEyPbyqoP
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.db

Path /data/data/com.llq/databases/download.db
Size 20KB
SHA256 5748bb1aee360c42d14b58da022b9a7c017a663eb55eea7f666fef2194dd120c
MD5 333410bf61d7b734d7304c8eb9dc8208
SHA1 f8b1e679deba0badf0bd023ebd0e743bd779df25
SHA512 0e53769e63e06ee4f69c8815dcd8dd70126d67fbcd99a4ac0021f7a18357b3d823ed58bb4c2f3c1fb321fff6cf0aba725b9ae40fd3d859c90d871cc6d5a91d3e
SSDEEP 12:TLyKEu3iOa/JrxDhWfyjRSL7/NI39TGRmBEyPbAVOw:TLy9u3bMaWyFIfGSE
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.db-journal

Path /data/data/com.llq/databases/download.db-journal
Size 512B
SHA256 afe1d7ae2d8a6c164cd3581a778e8598267a6beb6253d9a0ff3c997f9f70ac6c
MD5 adc0f1d23716b71c5e5480fc803419cf
SHA1 42aa5feb141347216760ab6ebbd6cc687f5a3de8
SHA512 0f93c32d55689c46d1280968d7c966f70c5a9e13808362d8dbee12ae93ee3f40f63a393b361ed3bbe6f8a349e7ecc910077c5dfa92f0671f943122c6d74edb86
MD5 SHA1 SHA512

Submit Download

download.db-journal

Path /data/data/com.llq/databases/download.db-journal
Size 8KB
SHA256 8bc14a903cb9372a06341c974f484df9e52c178431cf5482de3f0e8490c0d389
MD5 3cf1647a43ec537c8f10b403bcb0948c
SHA1 c636fb6eb053ccce6ecf96f501224a589a935ac2
SHA512 b8d7a755aaabfb1f78736fdcf56f2e81c50c759fd75fbd1a7c294f28eb58843522929efdc15db3d8b31f6c39dc7536744deb8dee7af47ef5aea5a298ab7204c2
SSDEEP 6:7+/l9ZkROn1ag9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKvn:7+tEqLiuWdwRmBEyPbU
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.db-journal

Path /data/data/com.llq/databases/download.db-journal
Size 8KB
SHA256 e4a1d92a186977f3dd66a48e1318d08e597ecd75fdb9f820e5845dcdb8ca5767
MD5 77db947c112082e3f170d7cd324c953c
SHA1 63c21871f2a9284960723eb5ac865ec7b8eaed12
SHA512 9e565bbc991c1f3c3700f5ebd807e3e614d4508ba369ae3ff018f377476bd820e7e770da4432e83cd85aa4ea49d73ea30f447596772033473effb6f751c0689d
SSDEEP 6:7+/l9jHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKG9/I:7+tRqLJdTRmBEyPbBFI
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.db-journal

Path /data/data/com.llq/databases/download.db-journal
Size 4KB
SHA256 d7fb160948cb79f18eeac7703caa4613ab5554f7c0263ae7ad27b29d56cac6b2
MD5 0e44b096532810350ef5f78796f1a66d
SHA1 4e0c037e201798d3de3ce68b02dca6987c20e2e7
SHA512 26fd33cc8d9adf15759f4c4a6097088272981cfc692205bfde51fd7ce732414f848277f60b089535b2420d34618a2d10d09ee36ea19c0137af180468792ff488
SSDEEP 12:7+tvnqLZ43iOa/JrxDhWfyjRSL7/NI39TGRmBEyPbLen:7+tvqL63bMaWyFIfGSqn
MD5 SHA1 SHA512 SSDEEP

Submit Download

weave.db

Path /data/data/com.llq/databases/weave.db
Size 20KB
SHA256 3a95a8bb724881a523a2e2ac15f15593ccb8088904c96e655a6915bed5503023
MD5 13fa423a11adcbb4f1e83d4ba9a4dfc6
SHA1 45760b64924c0bee300fb15dd29520546453adcb
SHA512 883521a20ddfdf308e7a09b9e9fc6a0c751d53748d17cfe67e7d5ea3b7f1d45fea6dd1085ec505d0f903674ea07d7107258d409534c723778ec69cd09b8a8be2
SSDEEP 12:TLmnyNTSFby+0qznu7AurAuC59CB5PbcaGRmBEyPbAVOwG:TLfs0qK7L30CMadGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

weave.db-journal

Path /data/data/com.llq/databases/weave.db-journal
Size 512B
SHA256 b024db8457749e04cce37f6862ab732854052f3a215286ab04590dfdb52bb054
MD5 af8f94ba1d0fc8819f95d1219ffa3fb8
SHA1 4a1783f3414252c10fa1d98d4c3e7eae1f94f3e3
SHA512 ed79a2d0985c00f6a594423965b54dafd0045e921079b1adfdc174a80f463b5e0e938e52a626496789f1477155f45879c2c684ae43949cc510c3a8c7186aa536
MD5 SHA1 SHA512

Submit Download

weave.db-journal

Path /data/data/com.llq/databases/weave.db-journal
Size 8KB
SHA256 09a9d2b366324f8c3f423bfbcf8035c05042c51e664e86d196feb126ef12554a
MD5 c72d30ec286c731a91430608a9bc941d
SHA1 5cd0284cb670e11e7c6d6f17c944df9527c05ab1
SHA512 20b759148cf8c4091438edda71bc7a16c4a9b9590b67ae86e46858a2e7444b84dc822e69c68d7145507f09983e316a6fbc5c2850f0593540039e4c09c1fd1e17
SSDEEP 6:7+/l9lluHn18Wg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKkXn:7+trUNqLiuWdwRmBEyPbTn
MD5 SHA1 SHA512 SSDEEP

Submit Download

weave.db-journal

Path /data/data/com.llq/databases/weave.db-journal
Size 8KB
SHA256 abbca7808fece0258d4d87d2eaf6b747b7fc318fcf7a358103eb2520fae12e0a
MD5 63092eae65cf0c22e44038d0275d25dd
SHA1 a1d06696f6150cabb3ce60f2ec464444e58f9bb6
SHA512 b23ee95df22dbd6c186614d40d016cc825c75334f70e8b0f766e11e14c87531ee2cc6d5e2b17516fc3d83cde725f9c868f3d59930fa41c2a50f695c9e3e1cfc6
SSDEEP 6:7+/l97SOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKgppb/e:7+tZNqLJdTRmBEyPbPpTe
MD5 SHA1 SHA512 SSDEEP

Submit Download

homepage.html

Path /data/data/com.llq/files/homepage.html
Size 2KB
SHA256 193e20d0dcd3b2e3a02bbead8a6581e09e7b3f7c6b7613ad28e3e65909f36c70
MD5 aac7d9154602a9be5122d9ebbe066c9f
SHA1 900b8830bc6da60763327d49ef05792472f60f33
SHA512 ad6275b4a2ebf6cb0c6e3f1e62e489901cfa4c4e5adc1b2ba1beebb57357a81d871f63f7678d93904e1c8b6221da15ae6deb79dd3d48e3d78e62369feb2f951e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads