Analysis

  • max time kernel
    3s
  • max time network
    164s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    13/11/2024, 05:56

General

  • Target
    com.adobe.reader_1921819312_apps.evozi.com.apk
  • Size 227.9MB
  • Sample241113-gnf4baxcmp
  • SHA256 6aeda4239d3ab2c205fe8e3efaa6e3f06459bddf713d361313bc5cfbbec1cfb2
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Processes

  • com.adobe.reader
    1⤵
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5067

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.adobe.reader/databases/com.google.android.datatransport.events
        • Size 40KB
        • SHA256 e802fdc1ccd833b91d80bb1d8f54cab2b585393e6a07622c4d9feaab07633370
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.datatransport.events-journal

        • Path /data/data/com.adobe.reader/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 7c1ca4ad7dcae8ab1f02b269ededfe06f5b9260b029ea68fd9a6607fe42ae090
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.adobe.reader/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 263c0edd3430bbe4579bb15834adde5a2d4fbe47f676cb2fbee032a0b932b6da
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.datatransport.events-journal

        • Path /data/data/com.adobe.reader/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 15a012b26e282900ed5b26b532b7394f1b2c8a4f7babac11d286412382ed810d
        • MD5 SHA1 SHA512 SSDEEP

        PersistedInstallation1089672351045839177tmp

        • Path /data/data/com.adobe.reader/files/PersistedInstallation1089672351045839177tmp
        • Size 90B
        • SHA256 d61946b790679eae7e3f6b99bb35158163a9c592b0a063e12b488846351972df
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.adobe.reader/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512

        androidx.work.workdb-journal

        • Path /data/data/com.adobe.reader/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 19c0f1b7d9e86818f098b385d2c04c21a8bd38b213cb12c293396b033f203cd7
        • MD5 SHA1 SHA512

        androidx.work.workdb-wal

        • Path /data/data/com.adobe.reader/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 b6a75ca64a766cae084d7f93cfa27058a3bac4378cabd1cb660ae15097d9a76d
        • MD5 SHA1 SHA512 SSDEEP