General

  • Target

    CRICFy.apk

  • Size

    9.6MB

  • Sample

    241110-tn7mgs1akd

  • MD5

    c353608628001a4ae8a904b427f46276

  • SHA1

    778eb76111b22b37a451263adca12dfe2c8b8bb9

  • SHA256

    4a11f32d8e8898825d78ba337728e44fa9e6efba350388580aaf98bd6c4d80a6

  • SHA512

    4f8cdcda3933701c4e83b21b960cb7e554aa128d0a25f193cdcefa9cae7a50d9ea23d625bd4c07cef116573da27572cd8b40958111618e40688054fc126f3c72

  • SSDEEP

    196608:OFA3oi0a/CyitTzdZ04+WpAn6WdZcPI7p34LXX:OFFYqzd1Sn64cg76T

Malware Config

Targets

    • Target

      CRICFy.apk

    • Size

      9.6MB

    • MD5

      c353608628001a4ae8a904b427f46276

    • SHA1

      778eb76111b22b37a451263adca12dfe2c8b8bb9

    • SHA256

      4a11f32d8e8898825d78ba337728e44fa9e6efba350388580aaf98bd6c4d80a6

    • SHA512

      4f8cdcda3933701c4e83b21b960cb7e554aa128d0a25f193cdcefa9cae7a50d9ea23d625bd4c07cef116573da27572cd8b40958111618e40688054fc126f3c72

    • SSDEEP

      196608:OFA3oi0a/CyitTzdZ04+WpAn6WdZcPI7p34LXX:OFFYqzd1Sn64cg76T

    • Checks if the Android device is rooted.

    • Checks known Qemu pipes.

      Checks for known pipes used by the Android emulator to communicate with the host.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Acquires the wake lock

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks