Analysis
-
max time kernel
5s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
19-10-2024 22:02
General
-
Target
21589c1098b9e7830c7e25570a70748e4a3c69baa71f132c5ba3383f31603a12.apk
-
Size
3.9MB
-
MD5
52b33f484470dde6ca7843144437cebb
-
SHA1
42a3f5c0e465308ef7271dddde1f4512da792265
-
SHA256
21589c1098b9e7830c7e25570a70748e4a3c69baa71f132c5ba3383f31603a12
-
SHA512
d631c7e7b0c1df2b56bdaaa9afae6a487e7f68115c179d0cd825ef5fc549bb10f4bea39a48f7aca05b3118fcba2fa3663ddd600bb8c17ee26f0a01dcaec5e055
-
SSDEEP
98304:XsioR+p1Cq1ATteqUu+ZlbM6GaUfTmoFhHaIa2owO:8ioRMivUu+HM6GlTBFJap2PO
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.gykuomxzf.dqglagqlc1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5c2a069611ea512b92a27dc9dbe378b44
SHA1d611c1b6b9aef2234124b854af43f5b98ad29ab9
SHA2561818db0cd286d08b3007a9ef7b3ca0f22c38961fd48d4fca21682c659ea1f3e4
SHA5122855124a62f7cea9d89e3b27ab65d3b9a86b2e8c1119b56dcdf7e705af1a130b6ac8d4c4c45e59c9b824af4dfd768d707449af510104b686de86074e12aa5348
-
Filesize
1.0MB
MD5c85c22ad8d604b96dd753c19ccecd8ab
SHA1ea771b87838f42ed50258f1660deb557260a959d
SHA2568327c3147b7507771d2f001fa061ac8e56a25c31a73a62680469b04ca05f06c9
SHA512cdc848b30a4f123bcfbc42c7660bfb22631ff211345b4968eb0a85179e65c5af66c4e2a6e8146fb040755244d5d084f817f27d6f7d3dffc2560027864b102c7b
-
Filesize
1.0MB
MD5083471fe3da301c3d16a599e7f215441
SHA1dbfddd7658b42cef0af41c51548ebcd953268489
SHA25602a616a34e1f01aedc2bbe466920e11b068c482dd5e86350a697a97c5c4e41b1
SHA5124d363d3725eea6c4947c7e280340ce835eb969b123df6a121d2290d166da7d367534b002d3329c0777833fe293381cae4033fa5be4294b44bd202f8b1bbb7852
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD573ae37304d4819b74d90b2243bcf5fb1
SHA120ffd159124a0992eb21ec13e0ad86e50ae9f7de
SHA256b7613d237dd567cb3f480426a3e01d3ee462c2e445de361cc115953ce58e3351
SHA512451d20b733d4c801fa35f197dcf6bde07bf6732a158e4d68ed2904dced7ef038efdd54315b39014264740495a946f44e523a51d9f455b9e1420e5fc8d06aa2d1
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD56ddc7cfb07077364dab395db6ccb1105
SHA11b563fa7e5897855a2bd29c73ff50aaba72e531c
SHA2563b566aafaf1c654079074dde6b60928057317408fe5fb2fa0084ec1766257adf
SHA512018c20ff7e8bc28a80a4413411910a03f286a30015d2578c098537eebf33a0aa536a8501d806dd4ef67e272a052f634f137324ea4b08518846c1febecc059afe
-
Filesize
108KB
MD517180a4b17b8649d472e6d3b430407dd
SHA17cdf6d1afa99ad6e200e4cb334f9bd9e71ca8bc8
SHA2562726e436d84d1bb1f0ab84905ab28fe34f815c54886044b54b567bcebdeafdaf
SHA51204c58215c98b0055ca7e793e91ee2134bcc63248020799828c79f3a645ffeab9c0ce814f5fae56abc96c71ddf7776e33d64956a85dfca51e9f3cccda05a772b8
-
Filesize
173KB
MD5549c78c0c2096d06a172d325ea678abe
SHA138a293d2577cfa6eae08f5851c1c75bd8e7ad795
SHA2566b386c74811808b485458ed7b16e301058f00e05678418489daa754dbdcd8fc2
SHA512b280e009ab5e02f0f988daf010c7db289841adef942d58cb65c17d0cf93b498ee28e8787005b3d4aa2f6889230847a367f181d57e15cd4c60ee5416437b62899