78961a477f1ab9591f45406be9223678bcec69e350720cf61a3938f6239bd86a

Analysis

max time kernel
47s
max time network
134s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
13/11/2024, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BCApp_release_13Aug_v5.5.0.apk
Size 16.7MB
Sample241113-p44tbasenj
SHA256 78961a477f1ab9591f45406be9223678bcec69e350720cf61a3938f6239bd86a
MD5 0969d551ab08a22e343ec92849e35300
SHA1 6ec2e336130979dcf0a1730077c871533f9dce57
SHA512 2f44f51be873b676b8f62e833159cba5c742c2a6524faf04c03254490344ab3f1c65ea708ec966af25579d0db9fd5d453c1acb3c15b0397720c4769d8bf48272
SSDEEP 393216:kilu71M6rTxTFqQiuH7xxZUdBRgZhucT5wSb89:kilnUt7L7xx6dXAG
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	net.ppbl.bcapp
/system/xbin/su	net.ppbl.bcapp

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	net.ppbl.bcapp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.ppbl.bcapp

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	net.ppbl.bcapp

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	net.ppbl.bcapp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	net.ppbl.bcapp

net.ppbl.bcapp
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4342

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/net.ppbl.bcapp/databases/com.google.android.datatransport.events
Size 56KB
SHA256 825e45a95be039d13c030528ee0aab1087b5eb247da02a8d1452185f1a31b4d2
MD5 10a7822563bf741bc39387f027140536
SHA1 a2ea9a66be55422912aeb8fb7909f129b197e57e
SHA512 bd13ebb1aba827bfeb11d9f56ab82818eb5a40fda24ce5968e5d893d0f69ae564b2623eb21769ef903c50dcf8d69b1d1dc410b4f292f5fed20fe6da7d956d9f9
SSDEEP 48:TYg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSzWFXfb9tFXfbQ:BMEX0wIyNjazsb9jbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/net.ppbl.bcapp/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 27b893e3ecae939bb61b2bfb8865fa2254b77bbd61dab4c21aa43fbee9a16a08
MD5 47f0a15367e9ac47c5d51c0e3d55deb5
SHA1 acf3b31b93f86c8425925df33fb00257b667dc5d
SHA512 080bbd6d635fad9fdf036a88160a0562fa0ef50f6752b794ad5983d2358e3e3e32c9e4b5e67ae9f6edcde4ceefd3c18040f095cb23f65bf01883aacf67d89629
SSDEEP 6:7+/l950Pg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK7//+ux:7+tLcqLJdKBRmBEyPbEXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/net.ppbl.bcapp/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 7d1fe8b86c2bbbae6ec74beb7014b61133d0f91a430ac929f2669d45f135c0d0
MD5 957e936203217f967b696c4e41bd86de
SHA1 559083230acde5bebac7af8e64402cf2a560f8c7
SHA512 bb48376c9905ecb456d340e99cfbbf44cb40a03314baedbe7a5a159c755e3335dcc92f7a6ef97ff3894264e0d9d026764f22149f3bd2f3d3e4a7a885d664ceeb
SSDEEP 48:7MJIqIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSU:7gI8MEX0wIyNjaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/net.ppbl.bcapp/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 3bc838b73e26edb0c57bfcecfb36cbaa5b4f7c00b83a5fc66a19d1acf2c289ce
MD5 9b6a2817157ba5d2a2843c5f5bd86478
SHA1 8f35ee01d14a6c14673f9ee889b270f6fdf597b1
SHA512 283f30597cf711b9f92b3484c1f081b6ecde9aa077887f68c5821f8163fa1a826433a178a7a4c5061ac8c54526143bec408d6b0cd66476dbf0820648b2e51301
SSDEEP 48:7MPNOWSqKqJwcoBw0zNhSWugbHqYg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSD:7RWS+CcoBfDv9rMMEX0wIyNjaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/net.ppbl.bcapp/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 75772271b6d15fe729b3c9e257fe513550c733ef81c13706701245e1ff1b9ee4
MD5 8ae800daffa5a8fd27354de10e90f01c
SHA1 77976ae18120f3ce22cc1ab2a2b25562c08b158e
SHA512 0555fdabf4bf51e1bdd290595f7fcc6a9e58cba2ffafc647001e6eb3bb5489280cb18d9f0bd202d2c9625b6321fc61bd8bc464f4638a88126e9c837dfa1aa7d3
SSDEEP 48:7MTVFXfbpqIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP8QoVeq4g59MENZBd3:7wbp8MEX0wIyNjaP8QzsMEX0wIyNjaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/net.ppbl.bcapp/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 d9edd854623254e8aa7a0c4c5371640d0246be9527b11a7f09515a3c25d8399f
MD5 78b3d7bba54a7579445ded7ea4919174
SHA1 c6d384a65e44adc97578dce2d180dbbd3affa78b
SHA512 539b5414d8d4120376878e8675f1b5bebc84091b75118c62d5db37dcac82212696eb9b6535fa2e2a9efe213dc8718bb606f2d5c50b82bd136b369d63a33e22c9
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/net.ppbl.bcapp/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 5d267e85bd7cdffdb2e2326cdae99a7d15be2adf2e73c38804ad617721007eef
MD5 19cde3d887439511345b605775d3bbc8
SHA1 332960454c017023862f0b7a952acb0eb082e497
SHA512 773d735fa2250241e4aef3d037f7ec633e169c359b3b24f2d8b82478d5e4a79ba6cbe550c25a315f8837d4ff0e4f9fbbe1720be4084832c23087559c1d9fb789
SSDEEP 6:7+/l9xy0n1Mrg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKqo:7+tGrqLiuWd7RmBEyPbbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 b7c54efdff21e57a53fbaf3263a3de8eb060ff23be618c30f93817d925851efa
MD5 78540dffb91a57741519118aa65de651
SHA1 b75b6c88ab444372c882f6050b268d641cf684c1
SHA512 5f59af10dce517685b761e6a2d987b21c32f2dcee8af891543c2dc1145cdab6a309fa733256c0821843e6fd6469e399321e375397ac4036d0a843e967cc8c4f0
SSDEEP 6:l9bNFl4/Sls1BElO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOus3:TLWuEBE9zmzrfRmBEyPbBvOf3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 8b8e1ce0f292ed78766d4e5e56fc295f87fa9ad81d7ad1063775e87a11ccdca2
MD5 0b50cade80ba5aa7716ac8a67bfc11a2
SHA1 f0969256c6dac2fe8bf91bc64784abfa34ac4fea
SHA512 94eb21e1977de5ba5e11d0533bdee2e18eb4e54ca579874bb512f1fbfdd2d2159a5f7a97c71196daf605d7132adc791bebf38d790bd02e4aeeb13203fdca6a37
SSDEEP 6:l9bNFlsls1XhlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6wG:TLiEx9zmzrfRmBEyPbP/P+/0Fl6wDi7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 f432bca011e93c2e8f0d3de43eba9d8dd34899800f47af13f17e0f201fd994f5
MD5 b258eabbf3cb8c0da55a056ba67bd4ed
SHA1 cacfe86285ec9682750083179363b903a832901a
SHA512 ac778cc14db759ec25359e64937c81697967fabf7ad35d8b466f020d5b601bb7cd2b659fd06ccf221f385339a138241487fa94533cf9386deff42e8e0d3b8cdf
SSDEEP 12:TL1Es9zmzrfRmBEyPbP/hr/gW49blqYFlzx+/0Fl6wDi7:TLvpmzr0GSP/h1499F/lFTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 2c3463e2040e2b391e7c31d020f26129e62b11a70248c474e1e245738b0cf944
MD5 3afc1b798e6fe8ab990c5b8b78bfba14
SHA1 25e0e2eb0217528d3bde3ff217df7cdfc44d2a5c
SHA512 c3c2ee11883e9f7d8d47c043db16887901e63a429f2682958313dbf5f644d0273092772aef3af482afeeb0000e251c3be626ffbb685714426f2890c7e2064ff3
SSDEEP 12:TLIEsE9zmzrfRmBEyPbP/ZRhOLavnOAUIIbhWlolik449blqYFlzx+/0Fl6wDi7:TL/pmzr0GSP/nhKamZkI4499F/lFTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 c499af6d77ebf8e5a264b58caa829044130efa97483496eb6290bd8dfc370756
MD5 155a24fadfb2a1ff82eda7cf5ff67cbb
SHA1 2012c8659b704e39a0d38e093508cda630a788f1
SHA512 92a601c1bef495fa7a4e310da987c6d52713531f98e564292cd717c007e50d03b792dc2c7e2b22702eb324758b9cc835b6fbf6a9ae9aaf9c3ddc62789edb8cd0
SSDEEP 24:TL6kpmzr0GSP/oLt6OFckYnohKamZkI4499F/lFTK:T2kArSP/oTF9Qocam6a5vTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 dde0b37be7b5cba77e3a71f1149382a43238d8cb3b45948a96ec732b26136474
MD5 5de89058316add7398c659c11f8d0f0a
SHA1 a4327a66f4c9ec6df72bb251cc3d42b7dc4d327a
SHA512 b1c58c552c4f72d3931b1e998fd6215418e1a62fc65dec9a81403ee3db9046eb714004dd972106109e9f9a9b119418f6364b59c434692becc0df100602a3ce61
SSDEEP 6:l9bNFlGals10lO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WFE/LllllG:TLNE09zmzrfRmBEyPbP/WFkLllllG
MD5 SHA1 SHA512 SSDEEP

Submit Download