03a9af067118dc7c5d9df9f0cf669f2f92f7722063afa7a51580e35702d86182

Analysis

max time kernel
17s
max time network
160s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
29-10-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03a9af067118dc7c5d9df9f0cf669f2f92f7722063afa7a51580e35702d86182.apk
Size

4.0MB
MD5

cf0083caba824a7d09686e4257ecedae
SHA1

aaba79566f991dac52008c46c2c4949acd71f781
SHA256

03a9af067118dc7c5d9df9f0cf669f2f92f7722063afa7a51580e35702d86182
SHA512

2154574a5679b9e9f23aa6efb3ffabd4060df14ade2ade42342d6cb63a8b3a425de72245dde4a497d6b5b9492ca7d9d984c8c21c59a4a7174375f9855bad1961
SSDEEP

98304:GFnW/CGiMLz5ECkw7gO7/0ymv1rgaJWiSDwhUq4+hfBi:+iLVEoz/Mv1ca4lwhA+hg

Score

7^/10

banker collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.krhizmubn.uunuofzil

ioc	pid	process
/data/user/0/com.krhizmubn.uunuofzil/app_dex/classes.dex	5053	com.krhizmubn.uunuofzil
/data/user/0/com.krhizmubn.uunuofzil/app_dex/classes.dex	5053	com.krhizmubn.uunuofzil

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.krhizmubn.uunuofzil

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.krhizmubn.uunuofzil
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.krhizmubn.uunuofzil

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.krhizmubn.uunuofzil
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.krhizmubn.uunuofzil

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.krhizmubn.uunuofzil
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.krhizmubn.uunuofzil

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.krhizmubn.uunuofzil
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.krhizmubn.uunuofzil

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.krhizmubn.uunuofzil
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.krhizmubn.uunuofzil

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.krhizmubn.uunuofzil
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.krhizmubn.uunuofzil

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.krhizmubn.uunuofzil
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

com.krhizmubn.uunuofzil

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.krhizmubn.uunuofzil
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.krhizmubn.uunuofzil

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.krhizmubn.uunuofzil
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.krhizmubn.uunuofzil

description ioc process

File opened for read /proc/cpuinfo com.krhizmubn.uunuofzil
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.krhizmubn.uunuofzil

description ioc process

File opened for read /proc/meminfo com.krhizmubn.uunuofzil

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.krhizmubn.uunuofzil

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.krhizmubn.uunuofzil

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.krhizmubn.uunuofzil

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.krhizmubn.uunuofzil

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.krhizmubn.uunuofzil

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.krhizmubn.uunuofzil

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.krhizmubn.uunuofzil

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.krhizmubn.uunuofzil

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.krhizmubn.uunuofzil

description	ioc	process
File opened for read	/proc/cpuinfo	com.krhizmubn.uunuofzil

description	ioc	process
File opened for read	/proc/meminfo	com.krhizmubn.uunuofzil

com.krhizmubn.uunuofzil
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5053

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.krhizmubn.uunuofzil/app_dex/classes.dex

Filesize
2.9MB

MD5
f1a48d7ecca85b7082923faebcb751dd

SHA1
32ae30387a0f21b0d2807352a3004b7466bfba7f

SHA256
6d1cd1b0ef318d9fca619ede30c2357e9225262c2707e8599c27239df2617af1

SHA512
8622ae5d65bd4dfc6be7ce2969cb17660b70e8ee64c470e467f945697f766caa7a1fa9ac173058dc24631389bce779d1b5d150b6c75b1bcc0fec0df56afcee2e

Download Submit
/data/data/com.krhizmubn.uunuofzil/cache/classes.dex

Filesize
1.0MB

MD5
f256da0b63ad75ce9f41a64239dac69d

SHA1
17658fb19c05552bba53fae94261dcaac19b4dfb

SHA256
291350d7b29a9c2bf8777f131e48c68f8f14f8725112849990c554f0c6e8a776

SHA512
3627cf64ff122e292002cbc10abfd508ca435f37504aae9999cac905b8b72ada64739aee1fecd32dbf8c7bef9d82699ba6d64cc55d83f6e3cf87e933942e2f62

Download Submit
/data/data/com.krhizmubn.uunuofzil/cache/classes.zip

Filesize
1.0MB

MD5
541182d66aab841aac1445942870214d

SHA1
2d6c765ca777527a4c9b6c6c9e44317656c0c054

SHA256
19fd41d28d352bed10bbb997b5c2752d0f9def1036d5b12394fb189e0b6c22cd

SHA512
274719d79501d7e1a83f77ab1b85dd850be785db73435982897085f5f0e9864406dc9d24e014cd2379cc31a3df708d7b2acf243075ef4eb9696aa41b838277f4

Download Submit
/data/data/com.krhizmubn.uunuofzil/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.krhizmubn.uunuofzil/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
ed50d51e42f28917b49abdd0e563a9fe

SHA1
ddde779ca233ef25a30cd33829a317e8d8cadbea

SHA256
827672f610b004217284a3acf02e17d74039841de298e8605f7c7ef41bef2a26

SHA512
17253f8ddcb0e38a504e16129e91b6928956e1ff9bb224ee41c8a87adfe1be5ba857f2b61338fe701bc777891decc82e89fdbe4823fd1b6d17634e68a7c0a07e

Download Submit
/data/data/com.krhizmubn.uunuofzil/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.krhizmubn.uunuofzil/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
1ca0b4f5347c553b7fcd6a699ffce5f6

SHA1
8437a938f7b3022b50a164b4b715a3a547e82c0f

SHA256
fa69586b33186a9b206e1955ef375864f4118b4c3139b9bca5b3ac7226660782

SHA512
a0e16c4c3fb1edeb412a1ed8e20b3007f69f7186d5ccf9b71bda330ed36cff8ca1ec2d7cc3c132e697f662d16f68387b2c11bb4f7e5f876646776f98b67890b4

Download Submit
/data/data/com.krhizmubn.uunuofzil/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
7192acb81dd409cee1fe06621d4ebb16

SHA1
a9a52f922306286b6e8bf099fc340400acabf1b9

SHA256
bf87a4ec7a95a97391f3ef39f6e92111b3c2de752cdfb930e72450d8de319e2c

SHA512
81573b6b652419653dd8adc0f9d04fcb2f74d2346a6d09347717b039dca8b7aa2f79d2291526bad57e7b71e36c658dd85a4c11f0c013eaf198ce999a6d408829

Download Submit
/data/data/com.krhizmubn.uunuofzil/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
f7a2528779a310aeba8e1c4d122fbc3e

SHA1
748cf7493c4f9ee280939ce1e1583fe8de3162b3

SHA256
106b0c6384215b8ae15000d225d3ea9e92e604094ee22b877c5272958ac52234

SHA512
8f568ae26843f60d5e1942e8960279fb29f0cd3b8148296c563f09243c01824949dcdcf2b83c2201cf1e1e20c48fb811fe6608b499dc75c64a573da599ebbfc5

Download Submit