Analysis

  • max time kernel
    20s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    22/10/2024, 07:36

General

  • Target

    Tasker.ver.6.3.13.build.5395.apk

  • Size

    36.8MB

  • MD5

    e44093c41d157e1e2c761d4a63b3515c

  • SHA1

    3a38c12467834fc155c755090573bf67d205dbf5

  • SHA256

    851f3f8ea378a611f5a7b1171717f3ea5660f7a27ad0d5c34ab2a0414fafbcf1

  • SHA512

    4bc640be5addebb4ad1189f2efedb322328b4094c9d0565597b20a9f4642891014305d354cb385c5bf6acd1ba36eac0c997354ad25b51d4155e1e8164b69a1c7

  • SSDEEP

    786432:Ie8y4HOQKcAm6qRrHPwCQ7X+j7P3AAUs7i2IRSPzOd8R8USMnU:IeCHJN1Po07PQALe2I4Pzs8RxSh

Malware Config

Signatures

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • net.dinglisch.android.taskerm
    1⤵
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4268

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/net.dinglisch.android.taskerm/files/profileInstalled

    Filesize

    24B

    MD5

    155328acbbf510ff645422a44e858aaa

    SHA1

    df3b27b914f7804066436036989d3c47b364a282

    SHA256

    c6beb22566b18678ccec38e5beb920ab365d2b4b7899741c9f629d66d9e7e41e

    SHA512

    7adc52d86df6c1d7dc2251cb4520ebce620e625d30d5e2f2da421ac59523d3989e33a2e27efeb800a68f7f2bc1b270fb4cbeed2f36354d62c87d25c1b32763da

  • /data/data/net.dinglisch.android.taskerm/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

    Filesize

    8B

    MD5

    c9098519a995bb3048b1fe6913db81b9

    SHA1

    8d2d31634de3bb0c692044eb1463a7060a2d5429

    SHA256

    959dfa484baee953cff1b4cd9114d05fbb3b4f0b2c45e548eaada15195296782

    SHA512

    a271158bf3b2096f801d1f30da89e3e079374e103f8dccaa4da40d0a05b6ffe1e1bfa0756643cca79bece1544e64eb6750b5d15cc2d08f1d23b3485ddb55b243

  • /data/misc/profiles/cur/0/net.dinglisch.android.taskerm/primary.prof

    Filesize

    10KB

    MD5

    61f378e195b367df78cbeabef7409a83

    SHA1

    5b9663e6a0e974b9c2e55067600b8ab663309a83

    SHA256

    d1c47a7fa1113ece873c3efdf7c5a0b4be97bc3014631ff2b4f3f0f04a055f66

    SHA512

    30f26666fdc8edf085f24f899607c453ebd0d88e81e80df4d1b3732f615a7b81e989657c5541063e1fb015e94558d5b00f0ba12271349d9e8d1836e082a23ce6