1bff1823805d95a517863854dd26bbeaa7f7f83c423454e9abd74612899c4484

Analysis

max time kernel
32s
max time network
35s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
01-11-2024 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bff1823805d95a517863854dd26bbeaa7f7f83c423454e9abd74612899c4484.apk
Size

1.0MB
MD5

e105666f4a81aa9f6e6276e6a0247d71
SHA1

f66927e129c1211568b1dda76c46a6f876313fdc
SHA256

1bff1823805d95a517863854dd26bbeaa7f7f83c423454e9abd74612899c4484
SHA512

6d1f48b233df01c38892c59c5c0d95559665c48fa824a72b8eafb85946608cda7888bc8230875572626a9df2063832c567592d61b2fda6251287677a060c734a
SSDEEP

24576:zq2XzyPSgR+aml9TSOFu0JlVXJZCC+khfYdMlIAtR4Fc0b:G2DyPSgR+aml7s0bDp+efY8BtR4/

Score

7^/10

collection discovery evasion impact

Malware Config

Signatures

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads the contacts stored on the device. 1 TTPs 1 IoCs
collection

Contact List
T1636.003

Processes:

com.example.kepost

description ioc process

URI accessed for read content://com.android.contacts/contacts com.example.kepost
Reads the content of the SMS messages. 1 TTPs 1 IoCs
collection

SMS Messages
T1636.004

Processes:

com.example.kepost

description ioc process

URI accessed for read content://sms/ com.example.kepost
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.example.kepost

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.example.kepost
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.example.kepost

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.example.kepost

description	ioc	process
URI accessed for read	content://com.android.contacts/contacts	com.example.kepost

description	ioc	process
URI accessed for read	content://sms/	com.example.kepost

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.example.kepost

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.example.kepost

com.example.kepost
1⤵
- Reads the contacts stored on the device.
- Reads the content of the SMS messages.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4806

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads