03ead8a86c4bfc846c7472972dceb853bd06bbb4c65f967a7b712e022dbad6a6

Analysis

max time kernel
48s
max time network
155s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
08/11/2024, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac7458e2fa4fde4a6c8c3adc06a5f4b5.apk
Size 2.5MB
Sample241108-qht8esskhv
SHA256 03ead8a86c4bfc846c7472972dceb853bd06bbb4c65f967a7b712e022dbad6a6
MD5 ac7458e2fa4fde4a6c8c3adc06a5f4b5
SHA1 bd30371b52fbc067bc29017c9effe30bfbd5aa89
SHA512 dcfb2141ea62d75b02cd3060ce39c5190d22fda717e7c0740376655b7ad41861e3131167d83d7ad817e9f1419e653cdf140af0cc9d3c55f21c189f818e20cf25
SSDEEP 49152:FxOZOK5Q+q+XQvqqztSxliDImn66oiGDXpNpd2ZrB8HEj2Qo:oP5bbq4mn6hPBd2ZrBcEj1o
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	COM.TUUURAHIDDENS

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	COM.TUUURAHIDDENS

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	COM.TUUURAHIDDENS

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	COM.TUUURAHIDDENS

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	COM.TUUURAHIDDENS

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	COM.TUUURAHIDDENS

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	COM.TUUURAHIDDENS

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	COM.TUUURAHIDDENS

COM.TUUURAHIDDENS
1⤵
- Obtains sensitive information copied to the device clipboard
- Reads the content of SMS inbox messages.
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4962

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/COM.TUUURAHIDDENS/databases/com.google.android.datatransport.events
Size 56KB
SHA256 a5f028844b72282bc6c29dd2484e9a481c921264b8df5dbb8e325b8ca962cf87
MD5 fd641d8bda3f4a2a707aefb00634f120
SHA1 ac64630647223fdc83bc0bc6a70fd0b632879e52
SHA512 34db06981a5ea4e7aaf02316ce7a6a9fcfc51bde1813cced1db6f57837db3388cea4b4366ff8e71db9fb67eeb63bd0677829331ff69e01a003eeba890042d9a4
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSg:8MEX0wIyNjag
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/COM.TUUURAHIDDENS/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 99250df5035c6fef136042811955c6515e6dae9b98ba7751e486f4e2ca2b2985
MD5 d8a055e3494d7c6b9ea83f2a68fe5a38
SHA1 2324410db4cb73d05d5a5b114361179631563e17
SHA512 012784c89cbe9305d319bc8cc44f798352cf0a178035ffd633776afdabdde66f7d686ae9aaf827d4c1079fe9ae7def7a7eb3f11dd8e95cbe82c845c71222b400
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/COM.TUUURAHIDDENS/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 5a318652226fa88c1aae3edfe450ffc838c3b99196c3b43d12bc47302309e55d
MD5 52ecebecebba9b8ac1e5c53b787078d7
SHA1 27fbcf4e8c0a8834b0ff96a033bff94c8f700c43
SHA512 bb21bf154a9a8d43c63f75f3a2361584fada47b006d26ae4b68521657119f055dde40d87e43520c7978fdd40b2a4702d8f02b5829724eb20cd87abd0dfa63341
SSDEEP 6:7+/l9NQuUHn1gWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKAn:7+tDUVqLiuWdwRmBEyPb7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/COM.TUUURAHIDDENS/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 cdd0811533ac49ec95d7be6b449c8306c52ca1ba09fc0d8ee40136b332a1d097
MD5 c7624a6998619c60ddf48dd040e7302a
SHA1 f0aa553c925be15c035b2f8a6a51d5b6748e7da2
SHA512 560376225280f49b9ce52ba5dfff09dd83a5ad158eae8654ee30fa7e9f8e7d142161a644aeee8119ac91be159b2bb03b9fe7f89801e3bb302d6268c5dc380184
SSDEEP 6:7+/l9U/SFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKSskt/U:7+tPBqLJdTRmBEyPbRZU
MD5 SHA1 SHA512 SSDEEP

Submit Download

PersistedInstallation1207250058759545812tmp

Path /data/data/COM.TUUURAHIDDENS/files/PersistedInstallation1207250058759545812tmp
Size 90B
SHA256 f6e1e22913dfe37aba1a85fda8d7b6792ba019a98e09cb8afac00eecb76a8c76
MD5 9810435614106e0ca168639e5b31372c
SHA1 340f6adc0bec94176edb66c504331a18028cf4b1
SHA512 3626f8ebe57bd5246a9d93717e2d26ace43029858c0d4ee1415c73e37df3878eb9533c1bc6c8e05db3f184d26a2207b53deec9631f31fed3bc6f989b0dc3bfdd
MD5 SHA1 SHA512

Submit Download

PersistedInstallation4576629619825368723tmp

Path /data/data/COM.TUUURAHIDDENS/files/PersistedInstallation4576629619825368723tmp
Size 569B
SHA256 a210cc671f6149878acf6c8e72470f9b8ea78221c3c89e226bd05b7d260253c2
MD5 b3de3686d86fc9eafdee7b6928cb7a5a
SHA1 5ee51761d760b882d5f1d80ecd8a53032a0800b7
SHA512 89384db987488dd9110599ca5cfb6b783b5ab3d9ecf235fa34ae24a7b6a2fe35e719af03c0eb36ba4f28e7a39d636dd20a25f7264b4dd56879b60805996dd40d
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/COM.TUUURAHIDDENS/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/COM.TUUURAHIDDENS/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 91a367d9357807374cdf3810f272df9f54fd6e635da80c860911a02f8d595ed3
MD5 34c7611dcc4422d446f05c5654b68d1e
SHA1 7fe3a64c6f6b2e68d79482dc963451ff20399310
SHA512 39e0b2b32ef5c24dd8071c652c18647ae3d6cf1b0248afd9193040c4bd0b723dfbeb9dcb68eaf152263faa8b98a227303e533e7dffb3473e779d77b39a95854e
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/COM.TUUURAHIDDENS/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/COM.TUUURAHIDDENS/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 210713d7efb6b8d6afeb4812da5414fbb02b2708e73d573e12f637ab3e3d7534
MD5 2c365efb93f71a0a36ab5e1d62ddc46e
SHA1 81e9dc0b4c2d8765b9213552bd36c84bda3d5276
SHA512 b19ff9de5728011139852f55addc1645b3948c4b552b737a423202ff3475602f978432d47778ae0d69ae0cef10196c6938cdb9e2f168d74cf803c1cba439ffbb
SSDEEP 6:KhMB2jvKO9FZdrlOERX4PBX4ogLugMBX4suuK+/DVIsfzRpzeOw2:KsGzdTRmBEyPbP/IOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/COM.TUUURAHIDDENS/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 940bac0fe0ed10a2ea7d83a2591349187a1373b5af8436e1e77278c72059baf1
MD5 5c2c1adcdf9770f2ef862896ec4ef0e5
SHA1 6884b739c8a8e3d69eed0e8269fc68c57a6686e0
SHA512 8fa676428c35aad2248c900f11073dd2a6a0dda24c5b0a975917a6633c8b4e83e0c67854da4639d0469b5af477d2e90c748afd54d591e2773b3c9c3df7fab9db
SSDEEP 96:46+hdjnHtDRMpf8UzS6+BD8q0ExPqDtwo:cdjnHt9Mpf8UzS6+BD8q0E5M2o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads