e5a19af78939a695e77789c74e1e3a80091f3d2b66dcc5e7dabb74986bab0b91

Analysis

max time kernel
148s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
04/11/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
E5A19AF78939A695E77789C74E1E3A80091F3D2B66DCC5E7DABB74986BAB0B91.apk
Size 7.1MB
Sample241104-relmjsznhw
SHA256 e5a19af78939a695e77789c74e1e3a80091f3d2b66dcc5e7dabb74986bab0b91
MD5 9f3494d2cf58a26369c24eae34b73cd5
SHA1 d3a7c5bbdb70c2a5cbbd9f10b6d86a8d705b3062
SHA512 8677714db52144bc1de4cffb6c0156ac8949194587b92b0f49a35b11df89dc7b67d070bf851d7bff17d6135e4cda69ec26e7f70f87b7c1a08b27bb473fa1c25d
SSDEEP 196608:h20FkbbjfJJflL6hTYE6OFABchzSZ9ulF1YppLota:hNkbff39q60SweZ9y3Qota
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.poyfb.vkif/app_ded/ghkICtYLfZ2LMboi0eak5Ch5njtj81aL.dex	4746	com.poyfb.vkif
/data/user/0/com.poyfb.vkif/app_ded/ghkICtYLfZ2LMboi0eak5Ch5njtj81aL.dex	4746	com.poyfb.vkif
/data/user/0/com.poyfb.vkif/app_ded/ekDTX1Y2V45ysml35cNWz1MY84vkXdKi.dex	4746	com.poyfb.vkif
/data/user/0/com.poyfb.vkif/app_ded/ekDTX1Y2V45ysml35cNWz1MY84vkXdKi.dex	4746	com.poyfb.vkif
/data/user/0/com.poyfb.vkif/app_ded/9P3vQhvDS11P4TYBdunaxZJM7pgMwgkU.dex	4746	com.poyfb.vkif
/data/user/0/com.poyfb.vkif/app_ded/9P3vQhvDS11P4TYBdunaxZJM7pgMwgkU.dex	4746	com.poyfb.vkif
/data/user/0/com.poyfb.vkif/app_ded/AtaQip4KN6QEPSgLNTPt4eOGUViWc8Vn.dex	4746	com.poyfb.vkif
/data/user/0/com.poyfb.vkif/app_ded/AtaQip4KN6QEPSgLNTPt4eOGUViWc8Vn.dex	4746	com.poyfb.vkif

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.poyfb.vkif

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.poyfb.vkif

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.poyfb.vkif

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.poyfb.vkif

com.poyfb.vkif
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4746

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

9P3vQhvDS11P4TYBdunaxZJM7pgMwgkU.dex

Path /data/data/com.poyfb.vkif/app_ded/9P3vQhvDS11P4TYBdunaxZJM7pgMwgkU.dex
Size 7KB
SHA256 ca24819ea6ab3fe5c2868c8655b89e15cd630cce2e1c6348e740c084a51aac43
MD5 829eea35c1617bd7f83b0e87b3cc7699
SHA1 06cf1752153c5c982710fbeea0c227f82a32d4df
SHA512 5606baa61911d3dbc9c9b212accc988b65e42620a65578a0a5eab323ab153473981a9bf3e31fb2337bca673f9bd4bac56e50c5dfa771c79dfd21eaace329271d
SSDEEP 96:k0xvmxh3A/tu6WT4nonbGHNazH2wi1ubdsE5P7o8IWHMHK9ur/H0ZXHv0XMqbm8q:k0V2A1u6Wq+Hv6ubdRCKEc/0XMemShPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AtaQip4KN6QEPSgLNTPt4eOGUViWc8Vn.dex

Path /data/data/com.poyfb.vkif/app_ded/AtaQip4KN6QEPSgLNTPt4eOGUViWc8Vn.dex
Size 8.5MB
SHA256 05944b6e3adb8910683f614fa189a401b127b26621af6e2fc8a4e415a3f0eef0
MD5 fef6b995fdbfead0f5fc41b528cc786d
SHA1 d88a778a8cbfe8a351bd2cfce2355979368c2e5e
SHA512 ef51bf03628cd8b27e6842a5603c4e1548ccff8b5cb314fffd4baaf3818eff02403a2908e98910bad0903bdf4bf0728aa86302207a964f4015d7be4feea8847a
SSDEEP 49152:GwFxf1lXQCC39mTsOCKl0aKBK62pbMjIzWRz88peCSGMjI4/6BxiJyvb5wd7bScA:GiWYsh3BK62DIRRbGB3lLxpcqPq0B4tX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ekDTX1Y2V45ysml35cNWz1MY84vkXdKi.dex

Path /data/data/com.poyfb.vkif/app_ded/ekDTX1Y2V45ysml35cNWz1MY84vkXdKi.dex
Size 455KB
SHA256 b5bf3071219fe2a96df2147d762ed74487434325f22c37937100ada807cea507
MD5 7476efe4197208d5f9843b31ad6b364a
SHA1 8fc8b270b03b213022a6f18ffd6f9f11536886b3
SHA512 cf4d2c1bb772815b201bd45dcdf655b5ef6addac1a794a73c6405ec10fcda7784a60b1d589210cc0db40b83617f99d11fcf4f2d2683d5a1ea1d2a48ec1f6c034
SSDEEP 6144:NE/VBRphcddLuPyAXs3zEHdziba9T6Jm596OAU5Wv7uVwH238t/1ljPpuq/QqLsH:ChA8BgH2I1nuq/QqYX83+08JnIZ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghkICtYLfZ2LMboi0eak5Ch5njtj81aL.dex

Path /data/data/com.poyfb.vkif/app_ded/ghkICtYLfZ2LMboi0eak5Ch5njtj81aL.dex
Size 659KB
SHA256 6c7eb778f781abb8782cc52d8bc94977a12c950a20437eb67f9f015f3e69217c
MD5 e2157b310a3f3faec63c312b0e248af6
SHA1 d599b812f6876ceff6af94e3bade43f5d6028e44
SHA512 22c7f804ae13461fb24f060091d9ccf8b80736595ff4f713d82952eb04353304ba05624a4b3aec840dcf26bbbe66527b773081baae0e69dbc746cdfe13dba9a0
SSDEEP 6144:DHvmQnMlDCZtkyhYf64Rir1n9Vs5/Xt7raHoOLBJShsHzEpkgOsdneheYyBhKRvz:CacCZtkyhYf9RuHu0jDgCn4ODuSqA8gP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads