Analysis
-
max time kernel
149s -
max time network
153s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
18-10-2024 22:04
Behavioral task
behavioral1
Sample
94a5076bce7386929eb5a59f2e2c9a8ed6954a81a127b238d06f6bfbe62660f4.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
94a5076bce7386929eb5a59f2e2c9a8ed6954a81a127b238d06f6bfbe62660f4.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
94a5076bce7386929eb5a59f2e2c9a8ed6954a81a127b238d06f6bfbe62660f4.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
94a5076bce7386929eb5a59f2e2c9a8ed6954a81a127b238d06f6bfbe62660f4.apk
-
Size
4.2MB
-
MD5
04b3bd3141066913ad86adff56d78bff
-
SHA1
57ab9db092806e770b42d3a32b04538763ba858f
-
SHA256
94a5076bce7386929eb5a59f2e2c9a8ed6954a81a127b238d06f6bfbe62660f4
-
SHA512
f117e98d85b8c706479979140bd85a38863a3c13458019a33b5aed3cc2a09d1891b3165a1eb097a5d3d8cf76e0e47032692867092ec46514523f70d371c98606
-
SSDEEP
98304:JZSn/oTRPREuAZ4gCECoW5ovw8MpdbYdq+UjKgkbrMf:unS5SGEZWqNIk9U2dbrA
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 8 IoCs
Processes:
ru.crebkvcx.yfvyodqrmioc process /system/sd/xbin/su ru.crebkvcx.yfvyodqrm /system/xbin/su ru.crebkvcx.yfvyodqrm /system/bin/su ru.crebkvcx.yfvyodqrm /data/local/su ru.crebkvcx.yfvyodqrm /data/local/bin/su ru.crebkvcx.yfvyodqrm /data/local/xbin/su ru.crebkvcx.yfvyodqrm /sbin/su ru.crebkvcx.yfvyodqrm /system/bin/failsafe/su ru.crebkvcx.yfvyodqrm -
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
Processes:
ru.crebkvcx.yfvyodqrmioc process /dev/socket/qemud ru.crebkvcx.yfvyodqrm /dev/qemu_pipe ru.crebkvcx.yfvyodqrm -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
ru.crebkvcx.yfvyodqrmdescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener ru.crebkvcx.yfvyodqrm -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
ru.crebkvcx.yfvyodqrmdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses ru.crebkvcx.yfvyodqrm -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
Processes:
flow ioc 25 sites.google.com 27 sites.google.com 36 sites.google.com 35 sites.google.com 26 sites.google.com 28 sites.google.com 31 sites.google.com 32 sites.google.com 33 sites.google.com 34 sites.google.com -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
ru.crebkvcx.yfvyodqrmdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo ru.crebkvcx.yfvyodqrm -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
ru.crebkvcx.yfvyodqrmdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone ru.crebkvcx.yfvyodqrm -
Reads information about phone network operator. 1 TTPs
-
Requests cell location 1 TTPs 1 IoCs
Uses Android APIs to to get current cell information.
Processes:
ru.crebkvcx.yfvyodqrmdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo ru.crebkvcx.yfvyodqrm -
Checks CPU information 2 TTPs 1 IoCs
Processes:
ru.crebkvcx.yfvyodqrmdescription ioc process File opened for read /proc/cpuinfo ru.crebkvcx.yfvyodqrm -
Checks memory information 2 TTPs 1 IoCs
Processes:
ru.crebkvcx.yfvyodqrmdescription ioc process File opened for read /proc/meminfo ru.crebkvcx.yfvyodqrm
Processes
-
ru.crebkvcx.yfvyodqrm1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests cell location
- Checks CPU information
- Checks memory information
PID:4771
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD51a8c82137eed619c30828557b7fef887
SHA14e903ab586da55edf0b614865f5b5e61dfc2a2e1
SHA25631078ba901bbd1824c138d65e0bb28597521a47c8f4620d9281e6bf08be5f8ef
SHA512c578aed4a1d17e6d7983956e208d2d597422abf18f18295aa4dd642264464c712b77273067a927348d1bdd1024b0686370e8fd795a6d0b0552de13ab2d33f5e7
-
Filesize
512B
MD5f478d02cd2667dc4469df8157c65213e
SHA1d7cc61f96d8cc798f186972f6bbfac7334d00c94
SHA256030cbd89a7dbb3c80506f91a08c26731fd4448b7a6e6ca89eea32ccea025cc21
SHA5124090ecc23113ec82e26db3fd7cbe51d5fcd24be7cbba7ea52aa087ce141cd06f77a12cb96f61786071909d3a18286e424b14c3c5057d6baf9e56e0a524a9a065
-
Filesize
8KB
MD5f5e3a55da1c59cc905e1a3c23f61c5d7
SHA18d25802fd11443cb5dc5e51c4840538d5366aadf
SHA2568c1d82f1c6957c2979ea26be9bfc37116587c4f35918ada1790c75fd21885c84
SHA512b6f764e139282a6a1442171792c1e511bbc2f53ca92146a02040dbd53d53ff600b3359e93e996efc710c4a42f2ea5c8ac23cee1a64b522393f27c9bca415a09a
-
Filesize
8KB
MD5e57d388b145b8450c88c5d0f833c6296
SHA197aeb0459612b8743f4ac3e784f5b47b9608bae6
SHA256fa6604fd736c7df3f7841eaab7f5e19d4c220ce6be22ccebd679610f1b6d035f
SHA5129ed8a996a1341aff4347a99aa88e6acd798df94fa4dc6128c92693b27d8add07040a017f263183b5702cf000c836771935e32d577dfb2d8457ddeaefe95cafb8
-
Filesize
12KB
MD5377a5628957f3dd3e7da6230a45f6d99
SHA159bd38d5fbd5c8617f5073b8b894f67cda124468
SHA2565a42f62bf9df6a93e7b5fa9447ef66eae00a551ca7a13da2457f2cc676dd527e
SHA512fecbe0d2bfa0edaf11fd1a37f662bae745a26889cbf0e601c018bacc379fdb3b14bd486d0bf87f726580f7d922f92409c269858eaf2b0302a878c35b6a454cfa
-
Filesize
16KB
MD5ebc47e4e0af19e183482d5d7fe59612c
SHA1e1ada40e6cc655436c1a923d6a055a9416d2616a
SHA2568c1d42299192e91eab7558fc4510e5770af9bde7e1375b3695fe5c1e7461f886
SHA51294a5e5ba420bbf40c8ba1a367bf3b5992c5240e9dc32bd6a663996396994ad9740d6deda27556138ad1995842016e854b4a20aa5d63dea727619cfda78941efa
-
Filesize
28KB
MD541e1c04880bd549e9d39c6f98ba0c295
SHA14bb479248849d4df4d7ed10aa19316a9ce57478a
SHA2566715722d4858e75a628f38d00000bf3f884d3a58db6532f44b9bda6a4cb33955
SHA5129074f7b8cc345343728ff7108b366c3453c3e69e7f6e9e56ad09db51308c39f72bcc298d8c0210b8734bb7987e0bab80a058e5a4729c4b45d399c957ac41fc4b
-
Filesize
1KB
MD5dbcfc95124c4f8eca50e6e2628bced60
SHA1ba323c1f4c2158f4e5acacaa992f43c43381079a
SHA25668bb8ae984d9a09ee12b9bc4909c0a2c2f96242d7fa48f777e876a9c58624be3
SHA512abf01aefdb8b9e1753e21bd32f1267c6e725ae973189034c6bb0415171bd38ee19fa234d6259a46a14aad4bb2bbe4ff82cb1ff6b15d55604108a348ca3670444
-
Filesize
2KB
MD5128503719bfdef6b09d4c8feb1a096d4
SHA18ca4eba243150f61a8660ed41c42510e16f36cb1
SHA256db1874b1c410bf8b36c2715ddd5b274e67146a1b75c6393be20abb9dafd6c20b
SHA512038e1cc07930281bbc2e6395baf41f9d463530496933a0f26bc1a37de4f3a1d75536ee1425a6f1580f8f32cda1e2e2fa4db754288d09351d81af5aafaa4aed61
-
Filesize
719B
MD564837ec60a5def703db0471648bdabff
SHA1f1eb4a00833351d6dd8040d9658faca109c0859f
SHA25604e4c66980a46478b18296ce2620239907d7406143d003fd7ba7bb6382440ae3
SHA512e856f892b0a8b4c645fb87d841e4faba64e2398589dbf25ee36f20e7df7a63e2e9464276232a625be4063659c924a005d8598fe03aa967c9d2a8d97b4ab68f34
-
Filesize
785B
MD5e9a968e4938a9bb9632799e2f10bbbbb
SHA18c9e1e04c6784d0f9d182081e6329897c957d166
SHA2568afd711f027fad53c5c96bc0d79574983b6d661af90aebaddf0f1dd858d03f2d
SHA512cf76a0a9051cade548200101d5e0837b1d1eacc441fed901641e7e9fa87ffa3304a98ba674c8d20ea30ff682076f45b60cdbf260e3dd2770b8f19ff2d393f133
-
Filesize
7KB
MD5b703f039530aa5a5b86016821ccfbdac
SHA1ecf404984c35c0d349bdc12b493839fa98ebb222
SHA2565a769c6940b57f64de8686f8e557c00b74ff25ee5c926360e4c603d17dde60e8
SHA512e5df2d5914abe6ff2b7b70460e6a1e97912fb68fc4145c4fb28a7407828048579b759e0bca9906e64a6426235add0610fc74410ecba5c1087db1ce0f52f7f565
-
Filesize
1KB
MD56be8bdef00b42d842430b8e95028ccd4
SHA1698b1decb7f64062a161bed19154b4e51e3398cc
SHA25672d2b763c829e417a3832b82992a242b8895a9910b7a42fa9d7d4fdbfad8e3a3
SHA512cf203ae57095e90e355fa7ca7303b35812cc398f66f0b0bd219b385f883140d4cdb400763e0cfd7f204362a764738e647c53fd05872cf8a40090209b219d9986
-
Filesize
41B
MD516d3e6eac0e79222a9b368edac765b34
SHA148d5e621fcdd84108f5750d6905180b622715b11
SHA2563a518b70256a689906d6740062462e3124aad6e55c5aa47339a87a56e4933ee7
SHA512d0aaacf86100135241426e2a0e9ba44414aa456cd708124e2f9c3a8037e008870cbcb506d316e4fe7cfe1d6dc3073393989a6f3c29f7cfabd6b0f65057afe747
-
Filesize
619B
MD5fff9b472feae83c674d0a680486020e2
SHA1b3f0dd277a1ccbc0104f0c0f6a5e66860cef19e6
SHA2566e31f4ed4a9ffe163b74794b970d1fda28c0d0866ce33dd17f5522d1cf994f2d
SHA5124876aede1e9ff9698f6fc03d551257911525d6caa73dffa58c659d144f3b43e1fbc85acec86760f16e6da00b901615a0020c2749e23d5b2112f7c9d1e9d2909c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
41B
MD5e3ac2decd5fbc5cdff1eb554a4d4dace
SHA181bad870f5b683e23fa8109e08304e09dcaf0fca
SHA2569951bf939a2a798d1ef0ca83c87025f8e9622d32f9e63dd048f9b7191ee22226
SHA512775b65e69f2611dea2362bdc4570855e7857f2b975875dfc828de20263a6c5e058faad43851b2d29aeccf428d50cc2d9e483d63c59c0d9421ef323a2eb9dbe0a
-
Filesize
68B
MD5429059fdba597db89e491d6bc8d92b45
SHA12500f7f118b7d4c29521eab5030ef652d21c3630
SHA256a9ecdd5568d8ab46101cec0af5a5e2d14a0d44859e442ff55e241383e293f557
SHA512f9ffc61326c7acf79ca5c6e3405126ed2035cd422841392c8f4e485313095e13ef0220c275a756481dfb8542e75ad14e66311d6d039dc2aa51d799cd63de97c1
-
Filesize
26B
MD5cc00588c789840a5328561c6829c2395
SHA1c4631457e5216d87a635f5989d68aed1ef74d6c7
SHA256be7a543b77c5d42d7e1249d2c6e8dff0d41b5ff51f2cb191e12e726f4a7dab44
SHA512b32f2a33f25b8a6dede2801024329a52ecc75528e32bf805d83b68b8cc928bb1c897f9a7e0761d43748f410bbff06d022f41eb1dd3dce390be20d3238129d792
-
Filesize
1KB
MD5ebc06fd3d86c27a426932a83325eeffb
SHA1461c990e677114de3baba2a33f0a60c0a10bb9d2
SHA256ada010f03b82133ccddb4ac69a7c81a1d507121ef1d276c7c191bb55401c2230
SHA5123b3c682dc3876f7c813bff1a38e53e0c20f6c776eeb8362a8a750b81d0a3132a207b01740a493c61a03261748399e020aec5fcb7354c723e4f5703efe5418b2b
-
Filesize
1KB
MD5355eb0af21063fefca005d93d6afa9c9
SHA1f854e3d2f0c0470a54e55f31017f9c499bd3671d
SHA256b50339f939827a8e5a918ee4ed1d8213e27f6d546a98313f90449b27a1ebc00d
SHA512ffff59e303636383dccc1282dea4c13b8c46d9aea1d646d745f7d26607cfabc25aea8001af873942749129291abef5dc5a858e7360cbfc145f870b80689b34e9
-
Filesize
1KB
MD5cac9a26c27728066be7a285defc0df6c
SHA19931d42eea7663aaec4eb901bcf279b246c19e34
SHA2569347cbd8e6e2af4d09759e55b7595474648619da07992d6485b9756ab4d8170d
SHA51211a3abfc4558e6c887f1f809a3837ffe6f4c1702407db945319acacaa5e677f6b117c07ca676cda6438639a1ebc447a2993e0ff31be8ef797bd219700f508ba5
-
Filesize
2KB
MD52d858e8af5d9426fe061df5c82ffa6ff
SHA1bc1b2eab876aa221b6449d11e482de24b777d58f
SHA25673d875bdb982c50c666e30ba2b8ae2dceecc63cd0d5f8a35158edfe5f3303835
SHA512aabaa75856cfc07bf65f3f2dae118e357cba83a45f0a900aa625f576de47c2753b0a00fb1913e45c1d743acc0f6e0100a4a6a326f402b0f4664ba181ad670c0c
-
Filesize
895B
MD576ce13c6312eb334fd351e3b5cff4bf4
SHA1203bd863b812c071ab3ae25bf4ab2f9c4d42942b
SHA256f0a8e8d6b8bcb84e466f921dfb20a91fdd4e4b1777d9b0be6ad4d03d4a253af8
SHA512d06ba34786090e3b027670a17910d2e35f48eb7bc639e6da1d08214534215797dadd1a56be44422b176801e5d1a1345cd2bf29e73acb6a49bc9a2f7670710783
-
Filesize
753B
MD5317f802aacfab6282b8f74f280e841c1
SHA13b746a76f6322e97fd6c09a43d03ac14631d93e1
SHA256f37f9a17c20ca3068f4f9db08c262c62b7b86544532f612a78421bdee92f4196
SHA512a714f902ede615507cef840dcc03a5eca183c21c82cc419a924587f38b6974f5aa45fcfcc2bac4d6cf82b81d1b6ad452540e0581751bfcad72e524c83757a301
-
Filesize
1KB
MD59ee047a6801bec9459a9dd5ec7068078
SHA11aaaffc208e2d86e53fc031e8413169850e65746
SHA2569f63f6c9ed9d33f235c30508df34c3358b55cac8bfb4967fc3e15afc61a6fd12
SHA5128245818df5ffe06c8f369c8d77479f9f2163d10dac36b0e37c834018b713dc8b063ec1de1862fe16a8c1a769b496652be880ddd48d6fcd24ad766a395bc3ff24
-
Filesize
1KB
MD512bfe20382337a84c0fc004a52b9ba9b
SHA1ead15f7ef372c16f78060b8f8c5fc6e0ca6a96f9
SHA256621fbcd864a7dceacffddb00a682148042732aeb675e22cd42b1a0937c6717a5
SHA5127a346febc49154dd348be77f88c6e7ed5c7a531c2fed981f12c40e22a19e4e1a5c51fa766b3122898d97f05e1546a6f2a29b598b0ff441cc7de5e3c505aa33c4
-
Filesize
895B
MD5a40e6a567b7aef329bda0ac200f7a23d
SHA12fa463649c7ba586b28670675a15e0d7a630c7e0
SHA256ee0933e12dd4e302b1e18572d22f48861e8125e5d0201603e024d18ef5e38556
SHA5125e77ca21445a09aa903ca08c10c1bcaf769d8273368b7981aacf1bbab08cefb7a521687e78d280828f46b625c99fde02050f5c914dd4d07fd742723f7713ee4f
-
Filesize
2KB
MD545c24a8686a0978086c99f7039accc17
SHA1c63ae2601322045390c7a4f230602b74ae18d2d8
SHA256bc9c4aa36a0dd7efe16a8b3bca9172d970fd13d70d3e718aad17a78269079912
SHA512d5861c64b9dc9139904c3bfc7da26fa6f3d9676a5b4203ad617c661d54d3716508fb02f282f5c204bf9d6a0c7162bbb565a44f2ceb96d825177065818b797727
-
Filesize
93KB
MD5ba57f9fe62bbcf10348091b7d08ce123
SHA10fba82354a775094f68fb49bd8530f97f6db97cf
SHA2561df6c43a03bf45cb91c83eb81d123877eb4f663b0693daf4ba590df900a01160
SHA512d030cb078a399eb104e5780426e14efeaeeaff93c4710186d1622b64a5ec547e20e318f72ac3c6adc3baa4680a955a3e43fa5964dd87a0684b21902672854e69
-
Filesize
153B
MD565026ee778e1372d9f4aed742772e893
SHA15a5f1c821d7639424f3c75a44468ab5f7dd4e8cc
SHA25615070f52136d5a8332f8d70f790bd7bb04cd6a99b386d40e0abedc40c42caa3c
SHA512589c4a12c6b6ec1a1cca957da758aaa900e68a23b4bc2f42524b0e8dd34f6c5378541d9293eae1ae8d478bf5b5229ce4218c058fc3b399eb5756afeb05c68616
-
Filesize
676B
MD51b759349f0bf3e55c51e2a2c2802b3cf
SHA15a608a093fa5f513d1ba52e8a9e01f693c47da98
SHA25659d83bb6ebc5394c048273ea9e1516a2bc7a6f80212d53f81ee44cb1f9b65443
SHA5123b39d22d0f8368dac2e36884b0316c5aba24180f51cb3a993fdefcdcfd5a36823d6c02c75863cd5a3bc0808223dcadf9934d548c433332bb9528f0eb8cecc0a6
-
/storage/emulated/0/Android/data/ru.crebkvcx.yfvyodqrm/cache/UnityAdsCache/UnityAdsTest.txt (deleted)
Filesize4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
-
/storage/emulated/0/Android/data/ru.crebkvcx.yfvyodqrm/cache/UnityAdsCache/UnityAdsWebApp.html (deleted)
Filesize2.1MB
MD57c9a73ebfa6e81254d94def1d28c26a3
SHA1d030c65a06e337aee3a8aa9b4aebc02ddd9e5eca
SHA2565df9de178b932138c508639acf76d01c7fe39b41e44566854e772f5cca5e6552
SHA512050a9babb8fedd890c197434836d7ae1372c96c03002946ca96622e747ff54e28b01ba726a6a2623b49ea01f84421d2bc89d87a5422df1e3a3dc21fbe617da06
-
/storage/emulated/0/Android/data/ru.crebkvcx.yfvyodqrm/files/LuckyPatcher/AdsBlockList.txt (deleted)
Filesize1KB
MD5634ab5e3e49b830079f88825c88d7f80
SHA1cabe4068d07d52c60f5b9f840fd887051748a3aa
SHA2562824000ad496be920c29d0a78589c72935288b40ce44b44c5fae672fbfe87fe4
SHA512ffc893fcad8d81f6ca272cf03737ab466eafd135599e6f6f20285d7f4c3454bedde4de5929dbb1be5010192747f5f11d86166509f24bfbf778f949762e47ef72
-
/storage/emulated/0/Android/data/ru.crebkvcx.yfvyodqrm/files/LuckyPatcher/AdsBlockList_user_edit.txt (deleted)
Filesize29B
MD5302f7b6d9a4ffeccdda9ef94184c8326
SHA1d4038ca0629f57b7e5c4056e74a395e5598aa16a
SHA2565b36134b695f0a9a32f570b08cc3ef74e0687a0d2aa228853bc0346f77bffebe
SHA512299fda4936acf6479e22f9166d545976d5d99ba6fe7a5b7298cb336cf730eb7790524e4569fe64bc03c598c7e4117f163ddffc2e2889439f709c4d80ff665039
-
Filesize
41KB
MD538cfb1687ef6387e62dd742c639e33be
SHA14a65b5d7e61fa00acc5d6489a9eae50b332c1ce4
SHA25645ee2ef86be5ddbd4c6c409929f43778cee28fa209879376a7b84f7f283629d9
SHA5120006880c98668c1d5e2dc1e2cfa3ecc078f209db0e4fbc658f0e05cbc0c45f9298644014cb70aed7342ace9d1caa4c88d543f48f01d3e63dd62bec573534c64f