Analysis
-
max time kernel
20s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
22/10/2024, 07:36
Behavioral task
behavioral1
Sample
Tasker.ver.6.3.13.build.5395.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
Tasker.ver.6.3.13.build.5395.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
Tasker.ver.6.3.13.build.5395.apk
-
Size
36.8MB
-
MD5
e44093c41d157e1e2c761d4a63b3515c
-
SHA1
3a38c12467834fc155c755090573bf67d205dbf5
-
SHA256
851f3f8ea378a611f5a7b1171717f3ea5660f7a27ad0d5c34ab2a0414fafbcf1
-
SHA512
4bc640be5addebb4ad1189f2efedb322328b4094c9d0565597b20a9f4642891014305d354cb385c5bf6acd1ba36eac0c997354ad25b51d4155e1e8164b69a1c7
-
SSDEEP
786432:Ie8y4HOQKcAm6qRrHPwCQ7X+j7P3AAUs7i2IRSPzOd8R8USMnU:IeCHJN1Po07PQALe2I4Pzs8RxSh
Malware Config
Signatures
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock net.dinglisch.android.taskerm -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground net.dinglisch.android.taskerm -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone net.dinglisch.android.taskerm -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver net.dinglisch.android.taskerm -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal net.dinglisch.android.taskerm -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo net.dinglisch.android.taskerm -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo net.dinglisch.android.taskerm
Processes
-
net.dinglisch.android.taskerm1⤵
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4268
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24B
MD5155328acbbf510ff645422a44e858aaa
SHA1df3b27b914f7804066436036989d3c47b364a282
SHA256c6beb22566b18678ccec38e5beb920ab365d2b4b7899741c9f629d66d9e7e41e
SHA5127adc52d86df6c1d7dc2251cb4520ebce620e625d30d5e2f2da421ac59523d3989e33a2e27efeb800a68f7f2bc1b270fb4cbeed2f36354d62c87d25c1b32763da
-
/data/data/net.dinglisch.android.taskerm/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Filesize8B
MD5c9098519a995bb3048b1fe6913db81b9
SHA18d2d31634de3bb0c692044eb1463a7060a2d5429
SHA256959dfa484baee953cff1b4cd9114d05fbb3b4f0b2c45e548eaada15195296782
SHA512a271158bf3b2096f801d1f30da89e3e079374e103f8dccaa4da40d0a05b6ffe1e1bfa0756643cca79bece1544e64eb6750b5d15cc2d08f1d23b3485ddb55b243
-
Filesize
10KB
MD561f378e195b367df78cbeabef7409a83
SHA15b9663e6a0e974b9c2e55067600b8ab663309a83
SHA256d1c47a7fa1113ece873c3efdf7c5a0b4be97bc3014631ff2b4f3f0f04a055f66
SHA51230f26666fdc8edf085f24f899607c453ebd0d88e81e80df4d1b3732f615a7b81e989657c5541063e1fb015e94558d5b00f0ba12271349d9e8d1836e082a23ce6