33b59cb04a227fc9ff532be9558ee53dd4cd298084c86d47ef002cab09012518

Analysis

max time kernel
143s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
17/10/2024, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MyBro.apk
Size 1.7MB
Sample241017-pvsdxsxfla
SHA256 2e0618ed2f50e9b467fd0fe14a9bdcbfe2195f3cf5608cf875f76f268112fc27
MD5 9996e4353c3b653663f05e0d63777cb2
SHA1 8529bceb701bdee6c75ae4cdfb41326f7db77731
SHA512 aa13b31484732da296af8d49d3f180d2a94e49e14fdecfd9186965c6e1e516d10e769bc8a9677ac41a6b2956b243ebc867d8ca7f9be47f80f6f73a3e94265d95
SSDEEP 24576:XAQ9zbmd9oi38AYz54rPOaW0D7LG0ewFan0GEn8oI4QPcplFrrsPQm9R:N9fmd9oi38LzMPOm/LXFAoqPcplVsbb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.fire.browser

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.fire.browser/app_ttmp/t.jar	4217	com.fire.browser

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.fire.browser

Reads the content of the browser bookmarks. 1 TTPs 2 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://browser/bookmarks	com.fire.browser
URI accessed for write	content://browser/bookmarks	com.fire.browser

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.fire.browser

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.fire.browser

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.fire.browser

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.fire.browser

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.fire.browser

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.fire.browser

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.fire.browser

com.fire.browser
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Reads the content of the browser bookmarks.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4217

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

t.jar.cur.prof

Path /data/data/com.fire.browser/app_ttmp/oat/t.jar.cur.prof
Size 486B
SHA256 a957f3d8c6b3fe78e51fe2c0af35a8878c6832a123116236c06865ec1a33629f
MD5 deb94d4aa2c406c7023982e528c9967a
SHA1 734d443b651a9fab432ef19d4c8cc8cac3abc01e
SHA512 b52fdb0f6e9c6cb273ac935c52e86163c62b7528361f737ad6c58f8e1cb500921addaf0ad534f78249d97a6412f93604ea344a76a9f40a985efb3576f5fc8d2a
MD5 SHA1 SHA512

Submit Download

t.jar

Path /data/data/com.fire.browser/app_ttmp/t.jar
Size 204KB
SHA256 f6d61651b9d98903a4f98527c8a9b29eeba0669b5863d318dfb1c136a251522a
MD5 ced97d7f67335f8cc79951ad24a7afb1
SHA1 f90489478ae0908c508fdcfd11c7a423fb52705f
SHA512 b15e5641abaafee45b3aa4b0d7967e6590167c920fa7104dee896ec66633b2bafcb378886af0df68536f4b7d2fd1d1387889d7f1ec779dbd00b19bdfe1c62848
SSDEEP 6144:s4TIsts5T85gUQstLzttU1h9M3w4jigs6B:6scoFNEPIwMs6B
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZIRCO

Path /data/data/com.fire.browser/databases/ZIRCO
Size 24KB
SHA256 864f26a270cff3731c272c07550a42bcba2358696667c9d6f578a2f252d51a23
MD5 59cf974c2fe889cd5cc75cb255d1a464
SHA1 29cbdc9090a04f1db1c27a425e70534d3a105d91
SHA512 d596e8c45759dc567ecc92442f929237c2f5c39a5a2f2ce62911b92c736bb7f2c3e64c6d230514b74beac0687774bccdef3ba09851a6e1fb97103c102d513101
SSDEEP 12:TZq4Xa1U9Q6LTSFbyYAyO9eFu/9Q6DfRmBEyPbD3Owzkaq:TOO7qAT91Fz0GSzz7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZIRCO-journal

Path /data/data/com.fire.browser/databases/ZIRCO-journal
Size 512B
SHA256 714f387295e3e63ee12bbd64a68796d7b12a31695309d90c5bff6c962f716d7b
MD5 a4fca5c5e0f5584f957b4b76c655b7e3
SHA1 021e358a6b76cb471d86b6cf7362e65d8f3f36b9
SHA512 47590a5b3dac539be69ff06687c45f5bdc3aa4ed9563eb31cfc16fd2ca3868a4fa82a2347c69d619909a402b29386f26664197784c556c6186057cb54dcdbab3
MD5 SHA1 SHA512

Submit Download

ZIRCO-wal

Path /data/data/com.fire.browser/databases/ZIRCO-wal
Size 44KB
SHA256 af5424dd5c1bd74d038717fded7e89f788d52f3c4fce8fff83e36392e4a94a37
MD5 e4912246ee0935e2b11f06f3e16902bd
SHA1 06df05eb531a6990927eb7a1fce3160e524e2fa9
SHA512 5fa65ddf1f8ef393712cce4020fc7b293815b13413b22a6b89b3cd94c34527d55d3b0a2d417e99e2330fec233240cffc9d046092bb365bb475b95155d761d881
SSDEEP 24:KMzyGSP/Lw7LOO7qAT91Fz0GSP/kclXE+lo+Qh:RzNSP/Lw3R7qAp/SP/vlw+s
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks.db

Path /data/data/com.fire.browser/databases/bookmarks.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

bookmarks.db-journal

Path /data/data/com.fire.browser/databases/bookmarks.db-journal
Size 512B
SHA256 dc8dd24a50d397e03f2d756939b306c6cb838cb419bb2fb41ee84fd3ec7ac66d
MD5 b296e528bfe18155c7cdbe1104b861b5
SHA1 44b9a384553d7a556866c4fe31e3ef9968f7064f
SHA512 be4cab06be06a8be6c3697aad3bd0e6a335a69943c57cc7482fac7f015c04db166954589e83dc71f4ab7901ba00025fa7bae3a2d89d21324b62f1a6e22129347
MD5 SHA1 SHA512

Submit Download

bookmarks.db-shm

Path /data/data/com.fire.browser/databases/bookmarks.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks.db-wal

Path /data/data/com.fire.browser/databases/bookmarks.db-wal
Size 32KB
SHA256 91cbfa69721b094f1453d2ebf5e8656bc4218c546b197c2ce3e075c9816fe759
MD5 ed44769ec3033c82b8882bf942b6fbef
SHA1 2b0607eacf3ad2d08abe972efc810ce8577a306d
SHA512 339f384274aa3e74bc2da1c5b6fadaf022f21cd937b7ebb4387cb4620cf52702e6c460d4d74210d6278155b29e672cb51c705e63d43389554985353ab463ebfa
SSDEEP 12:KEdMPzdTRmBEyPbP/d29WOwCl1D+OyNTSFbyAERo0K+S8oJVl9T5PbkHO+q3dfR7:KXzyGSP/di0e6T7EWozOHOvt0GSP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.fire.browserb-journal

Path /data/data/com.fire.browser/databases/com.fire.browserb-journal
Size 512B
SHA256 a65b50ef7577d3504f321b291107008bad91a6a549c8609e34bde6ed7dece88f
MD5 b528d0c42da710d13fe22af2650ad2a9
SHA1 dda3331f85e30a9eba6d9a6547c51e26d381114d
SHA512 56e905a9fb18ef2d90940e1746a2ae44960b0558b4e192e6f018f4383d0b96bc0c5e0b5bbcdf0238fc7a52c8743706f075a3d3aec2167868c0fdf51fc508a9d9
MD5 SHA1 SHA512

Submit Download

com.fire.browserb-wal

Path /data/data/com.fire.browser/databases/com.fire.browserb-wal
Size 92KB
SHA256 adc3dd62b59ac64263ad18be0af774e038992eadde2b2b50f01fdd7bd97248cb
MD5 f66959b859f04c527810ad92aa920ac9
SHA1 37694b9adfb1c4462e27cc513781fd2c7ba91e3d
SHA512 64de52eb22d81a2864fa9abdb79c5b175d10d3c76843eb99c4a9ed011d78ff8af21bbd0806c86b919d12cbcc2d82d1d4fcc33425059e64b16e2dba4f2e2ca384
SSDEEP 96:vw0PTti3H4mtqb9brqborIqb5cQsmtqbxPgR:vzTaokRe
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.db-journal

Path /data/data/com.fire.browser/databases/download.db-journal
Size 512B
SHA256 e2c0a859c651cd7e2081f3f1d0f90a6d0b0cc6f8da8792b77d4991193d5f232a
MD5 94ecbb23724b35f9b702078f53ed286b
SHA1 1a7a2dbaa0bb7691b73a0165f92d44cb51d2ff7c
SHA512 eae74078dd7c5e5cf662307ec3c481a6bcdfbf9fc2a56e811b8bc781f8526afd46bf7dc55806d56f1d848a34c744692f9d35d4bcfc47f6618d270db5e19f60de
MD5 SHA1 SHA512

Submit Download

download.db-wal

Path /data/data/com.fire.browser/databases/download.db-wal
Size 36KB
SHA256 7b0c16ab525c986d628ad29d9d5ca56cf76ceaac60d3424e94ae8d960ea8b2d1
MD5 76668aa84fdd9bc9038f11a5cfcd3c29
SHA1 324162c87d86de42d8be6ac0a88848685c7c9d39
SHA512 b7bdb5012c9b817093c11e5e80fbe133edb37fe09c07baf7740a7bc84f1d50369bd4d04d5e36a2bee89ae8582ce9753b97cbe0b132632f1e106edd0f4283f8d3
SSDEEP 24:KRpDlaO9zyGSP/7GwL3k3bMaWyFIfGSP/7e6zoKVF3bMaWyFIfGSV:KD39zNSP/XaNIOSP/hoKV5NIOSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

weave.db-journal

Path /data/data/com.fire.browser/databases/weave.db-journal
Size 512B
SHA256 dc91d392761dab5abd41b9ff455791b0460ef84a9a740c944bda4f520f515567
MD5 fb791deea84e87043b39873555ab152d
SHA1 a94418dbf98fdb1d2b5b52a9d051b6cc2423d67c
SHA512 65c72995c8c92b003ef3e3f5d0bbb2d4e0e8df476cad969e8763073f38e618374b05c947f99f01adb12945d8c87e74f0daa43e9bd9ab0418e9280a3511375ae6
MD5 SHA1 SHA512

Submit Download

weave.db-wal

Path /data/data/com.fire.browser/databases/weave.db-wal
Size 32KB
SHA256 4055056e6ff1a942eb231ef37b18df7394bae40d06dd3dba9f023d1afd92e77d
MD5 c07cf90f9de0cc1bcc2daeb7102ccf51
SHA1 2988ac84469a3d0720871a6afcb45ed11dd09024
SHA512 21cc727bdf8560d8b101b87b8aa5e7893decf85f9becf477aa9d26e58cad92a21304449783bbf78c75a979d88773ccdcf747d9d7838939cb87cd7bcefd02858b
SSDEEP 24:KYzyGSP/oucELEhYNs0qK7L30CMadGSP/oWm:dzNSP/oMoCNs87L30VvSP/oWm
MD5 SHA1 SHA512 SSDEEP

Submit Download

homepage.html

Path /data/data/com.fire.browser/files/homepage.html
Size 2KB
SHA256 193e20d0dcd3b2e3a02bbead8a6581e09e7b3f7c6b7613ad28e3e65909f36c70
MD5 aac7d9154602a9be5122d9ebbe066c9f
SHA1 900b8830bc6da60763327d49ef05792472f60f33
SHA512 ad6275b4a2ebf6cb0c6e3f1e62e489901cfa4c4e5adc1b2ba1beebb57357a81d871f63f7678d93904e1c8b6221da15ae6deb79dd3d48e3d78e62369feb2f951e
MD5 SHA1 SHA512

Submit Download

t.jar

Path /data/user/0/com.fire.browser/app_ttmp/t.jar
Size 430KB
SHA256 f2fc43ab889a884238f93766693fe57050457252b0b4aef63330b1b672a3ed69
MD5 a2008b3fdabd5bbe056b6b152d07d4df
SHA1 ba1c50523db4390d811653734cb8cf93a2afc008
SHA512 adb1f1ff2ad53df14b86ffa000ff744e52e2dedf39eb3f0cf2969fe56635a8dfb13fb7be7bbf265d7646baf104d1bbf902968682aef55ab971dd40fa180733e7
SSDEEP 12288:HBsV4ORw7I9Wz7rX58S+t16nkFP6SWaNElHRr:hst2Z
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads