Analysis
-
max time kernel
88s -
max time network
95s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
01-11-2024 14:53
Static task
static1
Behavioral task
behavioral1
Sample
Fake Catch it.apk
Resource
android-x64-20240624-en
General
-
Target
Fake Catch it.apk
-
Size
11.5MB
-
MD5
a01bbbc32766d4ceb754dd5f8ff74e60
-
SHA1
af5ed8e578881b953f9b9d607773dcfd78acc528
-
SHA256
013560e97963de21913a59cfea79cedad719aa01306e871614e8d56caf239c47
-
SHA512
ab08ae1f65bf04d4e12bc8ff55067d0af331b47afd92857ae457c32ec1ae566d838adad3afe5c8597d951688b5a56e52397efe1428802cdf3d6a5ab15cd9105a
-
SSDEEP
98304:slvm930asfKvPo/KrEVrgvry/XcWVS/s5njbCtCEmMqDNVSZi:wasyErKbWc8juISZi
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
com.cyctf.catchitdescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.cyctf.catchit -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.cyctf.catchitdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.cyctf.catchit -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.cyctf.catchitdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.cyctf.catchit -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.cyctf.catchitdescription ioc process File opened for read /proc/cpuinfo com.cyctf.catchit -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.cyctf.catchitdescription ioc process File opened for read /proc/meminfo com.cyctf.catchit
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24B
MD53ab6d4db7e1534ef6404d2511bb17777
SHA16ebd253e08b3a3236021f016f03ba69c654ff6fb
SHA2564cc29ad52ffdc522c1422d8fc0a4f9aca658e641cfa36374fa8b63c4b9c6129c
SHA5129ba515518aa1084cde0ad403ae469fad5b64c36dd3a191b9864fb0e5acc27d9669dc30ffd2230116147522a4b685d26777458ae8e7e58cf287f56610b54ce680