d305da75f52d66605ff9c4bb93ffc6dc9fb8ca4734af8c46adcb2c8e7c0ee824

General

Target
d305da75f52d66605ff9c4bb93ffc6dc9fb8ca4734af8c46adcb2c8e7c0ee824.apk
Size 4.6MB
Sample241108-2qvpps1gla
SHA256 d305da75f52d66605ff9c4bb93ffc6dc9fb8ca4734af8c46adcb2c8e7c0ee824
MD5 9f9573abad69578d25f71835f8be5bd6
SHA1 74a19eebf83bb813eb246d19a8822d5ba05b3ec0
SHA512 8bc7df1ec56467519c37dd3bc64efbc1dd82abe46fa33eda578c0ff2ab18cfa8824f61f8d967a09f0ab7068617aa4084249bdd34da31d363d61d9bd09fb94165
SSDEEP 98304:wFYvWVi5sAgK3pUvbsRFexMgD2dClC121I6ajUGzfrtELrvHUA2pF5wvgkH6:w2vB3GbsRFexXyV1wCUHLrXMwvda
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	ru.btkuvhuv.auwbbbrjo
/system/xbin/su	ru.btkuvhuv.auwbbbrjo

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ru.btkuvhuv.auwbbbrjo

ru.btkuvhuv.auwbbbrjo
1⤵
- Checks if the Android device is rooted.
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4247
- su
  2⤵
  PID:4318
- su
  2⤵
  PID:4463
- logcat -d -v time
  2⤵
  PID:4485

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Exception.9.7.1.txt

Path /data/data/ru.btkuvhuv.auwbbbrjo/app_error_log/Log/Exception.9.7.1.txt
Size 628B
SHA256 68263f734b9617aa223648669887d19b5ba4fde7197f210a813f376c2e673e2f
MD5 633b8050820556feaedd1c520f2418f5
SHA1 3d17fd0d399e6d77632ee2539a829d031dca923a
SHA512 29f9d865a2027d009236d8f8503831d8bc1ddff27f1e5d974f8ab2b572c4dd0d2e0c7e895061ee9e449a79fb0f7b728ee2ad2400821c8c62d3f99ca02c362de4
MD5 SHA1 SHA512

Submit Download

PackagesDB

Path /data/data/ru.btkuvhuv.auwbbbrjo/databases/PackagesDB
Size 192KB
SHA256 54a98553f7cfc1b0e6a963e451b5f8749adf5b7394de9395cce3538e16e7a432
MD5 7ba563b23b4eab813efd82f5f3ea03b6
SHA1 293b8a3e82722fa43d781083ad53ca393b45a261
SHA512 12d03e8a521984f490875d64a4fa382072d9b18ecd3d2030f8e376f1b09e87f89b95f4efbc78ee12e13d3d6854e10b40d9baa030ccf25a3e3e71621326b3fb6e
SSDEEP 3072:hy2Ir9zGWXHVyVPJ/s/PYd4VTEoZmp6GqMcHXjWY3P+lj3I3CjOjkkPKqzSSzb7u:hgd9eZquNqf4zuMdn
MD5 SHA1 SHA512 SSDEEP

Submit Download

PackagesDB-journal

Path /data/data/ru.btkuvhuv.auwbbbrjo/databases/PackagesDB-journal
Size 512B
SHA256 5a2c698087ddbd6e9e902492af695901e486f6bac1b9aa317c673dd5d4ee9e02
MD5 1d2905cd0c554b6db86c894678160837
SHA1 9233e6f96e72e48974c662fd454b5eac6dd8d97d
SHA512 d7dad75c3eebc828014ecff4987c7d8ac722892a2668e7a5dfe80eda7194f5dfbeb35a85de82b030db322e6ec6ef5c95189b78a025cb3e65e9c8d4ed70176f88
MD5 SHA1 SHA512

Submit Download

PackagesDB-shm

Path /data/data/ru.btkuvhuv.auwbbbrjo/databases/PackagesDB-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

PackagesDB-wal

Path /data/data/ru.btkuvhuv.auwbbbrjo/databases/PackagesDB-wal
Size 410KB
SHA256 4dc458873f06492385dd2fccdbc688d0e239b1055a63e0abd689958c48c1a4d3
MD5 ccaee547b811b3b86714dda4f0a09e81
SHA1 e71bff40adb016858dd2a08de8c530a858d35dfd
SHA512 5ab5319c6aa19ff372f7013ec4467077bf12c59ff502292f58840ac5ea4decc46e9696c57965d6986801c85543610345633190791132b4c0245a1cdce518a0d7
SSDEEP 6144:TVHPHXejgsj36s5jHgil3XmmzBLpbRdlhNkdZ:TVHPHub2s5jHgil3XmmzJpbXlhNkdZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdsBlockList.txt

Path /storage/emulated/0/Android/data/ru.btkuvhuv.auwbbbrjo/files/LuckyPatcher/AdsBlockList.txt
Size 1KB
SHA256 eb89dcf955fca4d11d336236724ad91d6cd4803e1c3706a265191ffe58499462
MD5 a39d3e83724992bacc8e8618952cd4ba
SHA1 7bea1709ae2ae49bd4178fddedaeb04414e447bb
SHA512 e31f7dc2bbdfbbe90646f87f7c21156729955f91b6a4ac300464e048e28f9eb87c05b6bb8f171c8bb1a85c2ac49110d7fc3efe943443baca46d7d83dd2501e96
MD5 SHA1 SHA512

Submit Download

AdsBlockList_user_edit.txt

Path /storage/emulated/0/Android/data/ru.btkuvhuv.auwbbbrjo/files/LuckyPatcher/AdsBlockList_user_edit.txt
Size 29B
SHA256 5b36134b695f0a9a32f570b08cc3ef74e0687a0d2aa228853bc0346f77bffebe
MD5 302f7b6d9a4ffeccdda9ef94184c8326
SHA1 d4038ca0629f57b7e5c4056e74a395e5598aa16a
SHA512 299fda4936acf6479e22f9166d545976d5d99ba6fe7a5b7298cb336cf730eb7790524e4569fe64bc03c598c7e4117f163ddffc2e2889439f709c4d80ff665039
MD5 SHA1 SHA512

Submit Download

error_log.txt

Path /storage/emulated/0/Android/data/ru.btkuvhuv.auwbbbrjo/files/LuckyPatcher/Log/error_log.txt
Size 549KB
SHA256 084e0c0077b05f7d8a06a052d649c1e72cbfa10059951d17b4795df5ae271b27
MD5 eaec784436ed641219758185a6ff2817
SHA1 49570b3c1435f0cbb0671739a7d4bf52aa596ede
SHA512 6b3be428c74de1e27eabe54895878afe7e9643187085edfe83213e22642ae5087875ca881bcbf7780dbe1764b8edea1d2bea06e3b8edc4cbd9922fb33a106093
SSDEEP 6144:7sj6DXzled14SdiPvTe8PSg+ojOCr1raplmvS0mXw55EHFq+stEZgNk7mFkkt2yW:7s85xe8PSg+ojb1raq0o+sSUgP9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads