aa1992af1b06dd5477e051ddc2fba41abf72dcd347a1ffe64ce2924e8350cf77

Analysis

max time kernel
21s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
05/11/2024, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa1992af1b06dd5477e051ddc2fba41abf72dcd347a1ffe64ce2924e8350cf77.apk
Size 4.5MB
Sample241105-2nwtzssqdk
SHA256 aa1992af1b06dd5477e051ddc2fba41abf72dcd347a1ffe64ce2924e8350cf77
MD5 59707ba965cd6bdc5795d8675fc61f86
SHA1 231f991ebc3b2f1625fa0c5ce0f394dd22517d12
SHA512 46316fd3eb7d046fe43827cbb69111d51983bf01866126438becf791437f481cb73e8d378b6fe03c1663956eacc6e304e79e5452b78533e12e9035da8014df57
SSDEEP 98304:2ut/WouaFBLLkW4xRl2G1hO6ngEzTYOmCTkbzSpce8uO:22mCQl5lTH/g/Spce8z
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.bbmokok.appnp

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.bbmokok.appnp

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.bbmokok.appnp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.bbmokok.appnp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.bbmokok.appnp

com.bbmokok.appnp
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4766

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

debug.conf

Path /data/user/0/com.bbmokok.appnp/app_tbs_64/core_private/debug.conf
Size 101B
SHA256 8d9cff2d4e64fb78e30fdf3cb706661b446044a04dc4fb24ef9e8b4ca75adb0d
MD5 de4d85b16b8395eb345d01f8e38c902f
SHA1 34264b7d574f3379b864862283c94b204e8a9f81
SHA512 02dc1bfa70d415184b9bacfc58cb4ae9cb660589e8b06dd5c261f13edbd0c2f39f2d60f8de643e6a635ce7d480f868c9efcc337c8f7a5033146c773ac5fccd90
MD5 SHA1 SHA512

Submit Download

download_upload

Path /data/user/0/com.bbmokok.appnp/app_tbs_64/core_private/download_upload
Size 84B
SHA256 a491d4aa7e828296189ebb8b0c3c3adfd0429174cf3fe084b399204768687322
MD5 700c17d61b9e086ab1eaed9b56f15155
SHA1 850143fc3faf9edb4917835e96b6e6e6c3ff15f7
SHA512 60709b474b24245ae6f4d8db8307a55baa89152abbac2cd165866905d58ec8ea9e4da9e97a4e33373cb81cf060502f1b231e46e534266a2f0d5e6d116e07dd60
MD5 SHA1 SHA512

Submit Download

download_upload

Path /data/user/0/com.bbmokok.appnp/app_tbs_64/core_private/download_upload
Size 84B
SHA256 6b73729def8fcdd13cd4659d15711b0a7676654c1304cc8301f842e5e2febc33
MD5 152dbb4a99e3eeb6f4b03d79e0f577e9
SHA1 36461048374da6b840e57d71f2f28ed9c019097d
SHA512 9ff75c5dd6d22c2f18c9ec98a17f989830129fab0bec141ffff43d025f1ec27e63a4b215a127bbd3b217bcc2f1e7af03d7ec8e2034d1a449434e1f46ab1dc541
MD5 SHA1 SHA512

Submit Download

download_upload

Path /data/user/0/com.bbmokok.appnp/app_tbs_64/core_private/download_upload
Size 56B
SHA256 5e4d0c3b9f1bc7666590a20c20f799431037f732e5e99c6122b4722d7e5cb29c
MD5 88892ebb25a5ef9f2560cfee7181c21b
SHA1 4379a472d495aeb6560149af3aaa20589c1999c2
SHA512 3cffa0a38ae72658d6e8b0835c1d416fed82d114840eac9cf167db407aac1ce03280ecbc46f8c9954c68956168de094d1f8d07a003a5b96a86401efefb6599c4
MD5 SHA1 SHA512

Submit Download

download_upload

Path /data/user/0/com.bbmokok.appnp/app_tbs_64/core_private/download_upload
Size 56B
SHA256 bee314fcfdb77ba8c45703439495925b9c89a8f0806a0b784c4ce29e16f94370
MD5 55ec4c8918a69c1971542f2422c546a1
SHA1 d5c53f26ae33ef6f0a16a546b4acfe89c2e96860
SHA512 8476f714b0b566bc71802f883050baae302fdae4625cc921f6ba26fc34933f676f99a4f9ec766a08f3ad02db19e3680dc0647395a1e5b5ed8146b3ffd967cf10
MD5 SHA1 SHA512

Submit Download

download_upload

Path /data/user/0/com.bbmokok.appnp/app_tbs_64/core_private/download_upload
Size 84B
SHA256 8335d9856763d1ab4f9b16ae1c676cf3f97f66df50d4aecebba729156c43b886
MD5 a60f7134fc8bfb1536f64c9e7bc32382
SHA1 7c8ef0e61fc1be32f5a08187230054e5886b49cd
SHA512 e839aaa79534960904734b38e40e6ad8ea5afe226a1270c73bfd21004365a9cea1bb9c4c7875989dcc2afbbbcf3208dcf7670741c72c5afe041448ba5b9d19e6
MD5 SHA1 SHA512

Submit Download

tbslog.txt (deleted)

Path /storage/emulated/0/Android/data/com.bbmokok.appnp/files/tbslog/tbslog.txt (deleted)
Size 19KB
SHA256 f82e752136587bb66eda9d87e9468704d1304f70f70a2ed167e75542af760401
MD5 e6dfbc5dcd3165a4eebebf0e0234b613
SHA1 b0807c89f0fe9abe49c2acd7e6e3cd51e1dbcc2d
SHA512 7bf2a3ed297f8b0d536a4098a686ee4c385f51d9d6a9eebdc7351f90a18c6510e041bdde2f630f9423493de27ced5232cef280a5eb76a43f46fd0a81eacb3e78
SSDEEP 192:sUFdDOZzolqfu9+JTUVcIOF+QKDexCMTUfZcM:sKdDOVDMMACM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads