1fdcdd2a042fc37b1755fcd3f4bac408d04f783cbde840a2d3c346561b32b49e

Resubmissions

07-11-2024 03:20

241107-dv3zwatlbv 10

27-09-2024 14:25

240927-rrnmnswgrm 10

Analysis

max time kernel
33s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
07-11-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Instagram_src.apk
Size

5.5MB
MD5

3c2332b53bdb1c8f766d3fb98902b10a
SHA1

7b21a68ac09a27e2d5ba6c4f7f9e9d4c59a29ecd
SHA256

1fdcdd2a042fc37b1755fcd3f4bac408d04f783cbde840a2d3c346561b32b49e
SHA512

822f784253d4b6b983877514a4f843159d83fc9ee2d715f00d6cad051c3e19786e75d31b66c35b718ec0718a572220c436f487af1f53e68c2dd585e56ffed82d
SSDEEP

98304:NwubXW62AALy6GqYZpcQb788aGg82Qr9pzbuV7zphCIJaL3188UofrFF3NPfw:NrXZJ6nicQHNaf8/IXrJaD1R3Vfw

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	sigma.male
/sbin/su	sigma.male
/system/xbin/su	sigma.male
/system/bin/failsafe/su	sigma.male
/data/local/su	sigma.male
/system/bin/su	sigma.male
/data/local/xbin/su	sigma.male
/data/local/bin/su	sigma.male
/system/sd/xbin/su	sigma.male

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	sigma.male

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	sigma.male

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	sigma.male

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	sigma.male

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	sigma.male

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	sigma.male

sigma.male
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4996

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Android/data/sigma.male/files/panel.txt

Filesize
19B

MD5
6e0075dcc0b7ac222bea767743b61a33

SHA1
44b3eaebc17568ca6e120747fef61521137068d9

SHA256
d0d1b610858419980e61586967769ed1bf001756aacbd5e00518b3b0eb83a402

SHA512
9950d09e464f74889ae85d70e72e57197b8a2713518bb7901b2c7b6e1ae51dc7e53547b2865f0226bfcc3bd5ea530453298512f8ecbc7b790da3339b5e05cf42

Download Submit
/storage/emulated/0/Android/data/sigma.male/files/uid.txt

Filesize
8B

MD5
d76032c938dd0b1a27e3ce6e024c2680

SHA1
b9cdc81faf65cf201c14069b3ba48f858ef146bf

SHA256
43506e78caf66f844f122e57070dff5de9742a0c9fc30ac55fdbcb8c02b59acf

SHA512
9944cbb95e8ad9d92c25f28f339a312130060448a3a04e5eda68cdfc72783a0beeab6cd08f91b30928d980a20d42872126873f593860dabf2a078b302080d68a

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads