Overview

overview

7

Static

static

6

d3125c1c17...9a.apk

android-10-x64

d3125c1c17...9a.apk

android-11-x64

7

d3125c1c17...9a.apk

android-13-x64

7

d3125c1c17...9a.apk

android-9-x86

7

Analysis

  • max time kernel
    146s
  • max time network
    157s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    07/11/2024, 12:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d3125c1c17517bc2bc98772e61f3a89a.apk
  • Size 86.7MB
  • Sample241107-plagrasdkr
  • SHA256 54cf2905e2f5661c5f9fb89acb61ba26bc5b84dda972492a7bfeab4d6ff44597
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
collectiondiscoveryexecutionimpactpersistence

Malware Config

Signatures

  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • im.hqdhmdbvvo.messenger
    1⤵
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Reads the contacts stored on the device.
    • Reads the content of photos stored on the user's device.
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4435

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        5007da20d5a229da2e625722e49f369e.0.tmp
        • Path /data/user/0/im.hqdhmdbvvo.messenger/cache/http/5007da20d5a229da2e625722e49f369e.0.tmp
        • Size 3KB
        • SHA256 01223e74277193fae41cd6d94d8004d0f2fa93445a45347595aefb1eab764ba2
        • MD5 SHA1 SHA512
        Submit Download

        5007da20d5a229da2e625722e49f369e.1.tmp
        • Path /data/user/0/im.hqdhmdbvvo.messenger/cache/http/5007da20d5a229da2e625722e49f369e.1.tmp
        • Size 13B
        • SHA256 a7bf504871a46343c2feab9d923e01b9dca4e980b2e122ad55fd4dbb3f6c16d9
        • MD5 SHA1 SHA512
        Submit Download

        8c28b9000ef027822a2c6c4fc823db8e.0.tmp
        • Path /data/user/0/im.hqdhmdbvvo.messenger/cache/http/8c28b9000ef027822a2c6c4fc823db8e.0.tmp
        • Size 3KB
        • SHA256 48b485b08090c89ab130880015eb1299bb53628fba4aaef5950961bfa4990fa3
        • MD5 SHA1 SHA512
        Submit Download

        8c28b9000ef027822a2c6c4fc823db8e.1.tmp
        • Path /data/user/0/im.hqdhmdbvvo.messenger/cache/http/8c28b9000ef027822a2c6c4fc823db8e.1.tmp
        • Size 95B
        • SHA256 53dc4cec5d4d5d22fa2c651677d2f65a859b5f4149081302cfbf4a0373600963
        • MD5 SHA1 SHA512
        Submit Download

        cb048a7ae898b9047df368ebcfc424a9.0.tmp
        • Path /data/user/0/im.hqdhmdbvvo.messenger/cache/http/cb048a7ae898b9047df368ebcfc424a9.0.tmp
        • Size 3KB
        • SHA256 25662756bc5349aec07584de62c15f3d6456045040a5fb53d26d2e3f2b5eac1f
        • MD5 SHA1 SHA512
        Submit Download

        cb048a7ae898b9047df368ebcfc424a9.1.tmp
        • Path /data/user/0/im.hqdhmdbvvo.messenger/cache/http/cb048a7ae898b9047df368ebcfc424a9.1.tmp
        • Size 9KB
        • SHA256 191257e9a1a6f7db5abbe5f1336a40b315ad1000ae18de9eb7a172cf870fca38
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        d816f58f981c45f51b8409ed307b9af7.0.tmp
        • Path /data/user/0/im.hqdhmdbvvo.messenger/cache/http/d816f58f981c45f51b8409ed307b9af7.0.tmp
        • Size 4KB
        • SHA256 0893353fc40d2af48221c7570328e95cd95f61020594b8baad11892dfcfce724
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        d816f58f981c45f51b8409ed307b9af7.1.tmp
        • Path /data/user/0/im.hqdhmdbvvo.messenger/cache/http/d816f58f981c45f51b8409ed307b9af7.1.tmp
        • Size 85B
        • SHA256 cbcfa555898a81246bad76fff49be83df2e7701232360746cba623d30d31db35
        • MD5 SHA1 SHA512
        Submit Download

        journal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/cache/http/journal
        • Size 382B
        • SHA256 eeeefd0028ea32930944ed920c187803ec1e3030b526fe482406032740f93468
        • MD5 SHA1 SHA512
        Submit Download

        journal.tmp
        • Path /data/user/0/im.hqdhmdbvvo.messenger/cache/http/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 1ba3cb5bab020201e986759917c0404a048c460711016d5440417d1ff529cde6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 e2e47de4e73a338be128a45986868aaaf3da0113d288861e144a8cc479bcc08a
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 b36d0cce03b0654b53a1897065ec43d630b8e901064c9146f4abfef0ae0eae37
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 08d06acd5ef5ef2bf044e2d1cce2b448ca82f1f86a17343b6480bbc05d14f8d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 f6ed1ed2a29747f5c97597ef18e5202740c9a0807a45d313d02ba333c85f2d52
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 371051477074cfdd6c7382bae38c274d96e8bf76d1aa650db89031c0c0100f44
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/com.google.android.datatransport.events-journal
        • Size 20KB
        • SHA256 4ad19ae895cafe67e0cf306760c30620b77141e2d9cdb1669a255c49613b84db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        image_dao.db
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/image_dao.db
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512
        Submit Download

        image_dao.db-journal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/image_dao.db-journal
        • Size 512B
        • SHA256 d20dbe315725436381eba9b8c6e5e1bbafbeef700f77fbbf3d9c62de5e86c403
        • MD5 SHA1 SHA512
        Submit Download

        image_dao.db-shm
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/image_dao.db-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        image_dao.db-wal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/image_dao.db-wal
        • Size 16KB
        • SHA256 7192a341b354972d463791a262c563e618295a4f462258a727eb9988c118fa7f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        image_dao.db-wal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/image_dao.db-wal
        • Size 36KB
        • SHA256 d648c07724534c70d1b8625be774c42e4ff8b738dab45b29db2aea73198aa14d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        user1.db
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/user1.db
        • Size 12KB
        • SHA256 b78ed93c9a3f339ca2eeb511aa6d79e594931a0279815b239f7065dcb5f810fe
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        user1.db-journal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/user1.db-journal
        • Size 512B
        • SHA256 e6c2bb2482feef6cf948002589f4f3cd2d378073815eede1c5c89c08ad57dcd8
        • MD5 SHA1 SHA512
        Submit Download

        user1.db-journal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/user1.db-journal
        • Size 8KB
        • SHA256 350cc50518a607fc1cf43741f5334efca8ed235e3c614192929b9745d4d891d7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        user1.db-journal
        • Path /data/user/0/im.hqdhmdbvvo.messenger/databases/user1.db-journal
        • Size 4KB
        • SHA256 df98021fc0900723cb96df2b982c724aacf728229cb3cadbd6147b00965eb184
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        stats2.dat
        • Path /data/user/0/im.hqdhmdbvvo.messenger/files/account1/stats2.dat
        • Size 540B
        • SHA256 282873bbcdf45ed0a0d9b9fb4bd4866d5aa88f5e4b9ecbb6573d02180683697c
        • MD5 SHA1 SHA512
        Submit Download

        stats2.dat
        • Path /data/user/0/im.hqdhmdbvvo.messenger/files/account2/stats2.dat
        • Size 540B
        • SHA256 0ccbf8364b3ebd52b66162378540284c5e19babb033bf22428131ce85e38a42e
        • MD5 SHA1 SHA512
        Submit Download

        stats2.dat
        • Path /data/user/0/im.hqdhmdbvvo.messenger/files/stats2.dat
        • Size 540B
        • SHA256 2ae290a2eb9965b6b7d00ba0e34580ef40da2cba8b01998dc61f8a4594bb3a8a
        • MD5 SHA1 SHA512
        Submit Download

        com.google.InstanceId.properties
        • Path /data/user/0/im.hqdhmdbvvo.messenger/no_backup/com.google.InstanceId.properties
        • Size 63B
        • SHA256 7690c2d08c292a65a19b0583bbefa39dec1e59eba661540ee6aa13dee3faf9ee
        • MD5 SHA1 SHA512
        Submit Download

        000000000_999999_temp.jpg
        • Path /storage/emulated/0/Android/data/im.hqdhmdbvvo.messenger/cache/000000000_999999_temp.jpg
        • Size 1024B
        • SHA256 5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
        • MD5 SHA1 SHA512
        Submit Download

        ca4ef00afdd9750d7f603670fb67fdfe.txt
        • Path /storage/emulated/0/Android/data/im.hqdhmdbvvo.messenger/files/ca4ef00afdd9750d7f603670fb67fdfe.txt
        • Size 1KB
        • SHA256 7f1fb52f763f9d12757fcd60e05373ea3bbed1db94743dc8f0594611578fc2c3
        • MD5 SHA1 SHA512
        Submit Download

        ca4ef00afdd9750d7f603670fb67fdfe.txt (deleted)
        • Path /storage/emulated/0/Android/data/im.hqdhmdbvvo.messenger/files/ca4ef00afdd9750d7f603670fb67fdfe.txt (deleted)
        • Size 1KB
        • SHA256 c8a0f8d6290bd1e3daa05aa28395fc5fdba82a3c5c5043b847dce6d10df455b8
        • MD5 SHA1 SHA512
        Submit Download

        07_11_2024_12_28_41.txt
        • Path /storage/emulated/0/Android/data/im.hqdhmdbvvo.messenger/files/logs/07_11_2024_12_28_41.txt
        • Size 15KB
        • SHA256 b8cc31cfbb65f6d773053b83f230de489b754b86aa1c3f0ecc070d0669ec5aa2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download