428ff7f4bdf625e57358056ae2521f60b9ebe86ce73669bfc06d1d501f30846d

Analysis

max time kernel
149s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
13-11-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

428ff7f4bdf625e57358056ae2521f60b9ebe86ce73669bfc06d1d501f30846d.apk
Size

2.6MB
MD5

c7da92f29fdcc837c30ff8d13171bdb1
SHA1

d4422ddf9147885c2a2fe7e3bff48f4cae741dc4
SHA256

428ff7f4bdf625e57358056ae2521f60b9ebe86ce73669bfc06d1d501f30846d
SHA512

57c4bb22a03795703ee5aa71895f564d533ab6afa4bcedbfb2086b390e7b8dc78673f84b06303dfdd926b95131249824895457589a255094b7ad03600dd4e796
SSDEEP

49152:XZxWrcHiuOVHClumTpQ4IDjrBh0Ejb1RwP7UJiZd20P9kWoZ9d6pX5k/yZV:XZxWrI5OVi+DjrBaEjb1C7ZI0P9kWoIH

Score

6^/10

discovery evasion persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	plf.yss.vt

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	plf.yss.vt

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	plf.yss.vt

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	plf.yss.vt

plf.yss.vt
1⤵
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4264

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/plf.yss.vt/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/plf.yss.vt/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
f4141554d9adec16eb1b1f0c41a4ce48

SHA1
b17f88a15339d9e1453bde489fa43d6dad6f331c

SHA256
ca3b9f5b4db6b43a442af4e8a4cf6bd8e55f1a32c770b5da396b274f4bea9ed8

SHA512
1a63e8908bb538fd5d61ff9eab305f3f566fa21f4e5cdb55e02a8ab3eb451282a28c2bca274b20f6d6f2c5c11f92b6de3976f398e7933a6178eaa5d3416e80c3

Download Submit
/data/data/plf.yss.vt/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/plf.yss.vt/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
2c794f82f01e07fc15f03f7565dc8f01

SHA1
939522a8a1e0db8e13060bd422a35fe58b2332ed

SHA256
0a34da88d16c602846f4047587e6798354401f59e31fd0e799f69450c12fa107

SHA512
a199059a7dc201b94b5c418088b08263e9e441687052ff6b727f9e754c5fd9495429f2a3df5c7d85dd2ad57ddc4e37c2126fa666bd3503dbce50422c5ff97536

Download Submit
/data/data/plf.yss.vt/files/PersistedInstallation1854332921461728783tmp

Filesize
567B

MD5
a36e4154f08334f37e998ece6722e4e9

SHA1
493b4de03f6e7cbc9cd2fc2eb96eab5909101b22

SHA256
22fbd5e5717c87f70956699ac18763b17df2577f76b9aaa4d9ee615fdc6a98b6

SHA512
79fa2079f603a7bee9f496dd1fd6db7b80a0c5798e6820298e0095693eed8876253233abd5e3fb74255cd13582cb1bf2b58cc4e04ba6bc189ac6efdc4a6fdef9

Download Submit
/data/data/plf.yss.vt/files/PersistedInstallation271414955233401995tmp

Filesize
90B

MD5
a4d7ebf66f91d63e012ad5847bb2cb9a

SHA1
dc341d2a5deed0ac290db776377b0b95544da5b1

SHA256
77dceb673ba08a0fc7e556c71cc8605c468d2ad74c90020a912341894030408a

SHA512
68789d98885b44b192d573a9d199d7a2dca01dac94c3e61bff9e4cdb5baf67ecfb05ad536b2fc1fa88f17084a92906e9b93d0b92d01d87d2f068d55adf36eafd

Download Submit
/data/data/plf.yss.vt/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/plf.yss.vt/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
3a23d4246c0d0ec87075ed154a42db02

SHA1
46516473dc24c825760d1e5724a96c6ee7c1fe52

SHA256
feee2206dd68c05e3882a37140e41aa7c6e4e6e036d40dcbcf69dcbc48d940a6

SHA512
46583ab5e06d1108dbcd8e30aa5371b6544d0cbbf0caccafcb9b7e1fb4f6e8e80ad91f85caa74be068928b7dd38a1423c50a866b38a9cc64601b03bdba22d13a

Download Submit
/data/data/plf.yss.vt/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
74c73c021ec63f90981c58c0c36518a7

SHA1
89a70f014b9e47a47f548ecda664f7423b6abd23

SHA256
9295666c6db05dbc4eeb49831efeef3eff6f0cb3b425eb791e79f6b0f790ee2a

SHA512
3a878bbc355f5441afb95badff1c35cb5b990ffd2b5a1ec01f35cfc9051e552b4b0480b439bff80dbfc4b86554776666a729887f55c98de2421d244e471bfd64

Download Submit
/data/data/plf.yss.vt/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
0812f90a7b7e5780663f2e8e8f6800ca

SHA1
af2f9db9c3b40af3e0d077deb53ea558f193b42a

SHA256
e3c11ef987dae6f0b6130de5f124b92840b8bc3d2945539280aa64cd4f826e3e

SHA512
60940514197efcf0f671cb62aaddec592b41ce5920966e9452c2376926c779a6ec59993bbb9ee0e7ac78153207f683846d65bcd1e73865ab00e4972c29ae0cf5

Download Submit