78961a477f1ab9591f45406be9223678bcec69e350720cf61a3938f6239bd86a

Analysis

max time kernel
160s
max time network
307s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
13/11/2024, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BCApp_release_13Aug_v5.5.0.apk
Size 16.7MB
Sample241113-p57xcsvren
SHA256 78961a477f1ab9591f45406be9223678bcec69e350720cf61a3938f6239bd86a
MD5 0969d551ab08a22e343ec92849e35300
SHA1 6ec2e336130979dcf0a1730077c871533f9dce57
SHA512 2f44f51be873b676b8f62e833159cba5c742c2a6524faf04c03254490344ab3f1c65ea708ec966af25579d0db9fd5d453c1acb3c15b0397720c4769d8bf48272
SSDEEP 393216:kilu71M6rTxTFqQiuH7xxZUdBRgZhucT5wSb89:kilnUt7L7xx6dXAG
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	net.ppbl.bcapp
/system/xbin/su	net.ppbl.bcapp
/sbin/su	net.ppbl.bcapp

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	net.ppbl.bcapp

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.ppbl.bcapp

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	net.ppbl.bcapp

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	net.ppbl.bcapp

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	net.ppbl.bcapp

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	net.ppbl.bcapp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	net.ppbl.bcapp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	net.ppbl.bcapp

net.ppbl.bcapp
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4248

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/net.ppbl.bcapp/databases/com.google.android.datatransport.events
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/net.ppbl.bcapp/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 629eb7aa4defdbae35966a3b6c85ea9cb7d5f929fab599145bd93eb7fd84dd15
MD5 31c50622b6200b0490c9c5a276c50fd1
SHA1 c89b38a152313b42538931547936afc2e0b43fcb
SHA512 edb37ff872e2cc3be85ce98371ecf3567cbcc54d14b6ab2b40a4292094f20ae1757a5e4626c5e7430072ca52b20b650d83a8763b5440999aa96e01e30cdf3c86
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/net.ppbl.bcapp/databases/com.google.android.datatransport.events-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/net.ppbl.bcapp/databases/com.google.android.datatransport.events-wal
Size 177KB
SHA256 eb000cbc8d1b7858848dca1782fb6602803fad393bb52f1f3efdcdbbb5b314a2
MD5 7f48ab9d88f9da3ba31b784fead53a52
SHA1 d6d4748b93fb6e882da9d07e09a4ca10a8b009cb
SHA512 496f146984b6964512c90d66f0d5bdeb58247c7b0576e1bfd68c001dbeb610e8bcb3e2e827283c317049ccb8338a58ae8a645af05082723a039d55d70d3a3f2c
SSDEEP 96:x0PwoMEX0wIyNjaPwiw5XmPZAjObjjb/m7ViXmen6AjqCfbXvmRrOAjDIxbV:ijjcM6ZPbHb/aSn61Cfb/YORxbV
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 ec93aeed4ffffbf0b424be223173bf965c5d9c5fa776ae26c5864541dbe96d42
MD5 4d0b21bd413730efd61f56b45acf54cb
SHA1 04787950ed073bfc5399b84f119a5d9f5df9fecb
SHA512 53d6899e37ed477fa7ded2debd3bef9a6523e41f6fd500812b478346b43d5c0b239a47756584b69acb267375efa78453724b806c15625843ad64b692a408eca8
SSDEEP 6:l9FCls1ulO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOus3:TgEu9zmzrfRmBEyPbBvOf3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 8f3206d3523b6e769fcc5f08d8b61ec5b3bf449a4c2ab1f07d02cc228f0f2956
MD5 46dd92fb7cde90d8e940fcca64fc8ad0
SHA1 305f399257874c15ad048203ee08a8303b3a6b29
SHA512 6807ab21a76b8fa7a8151d90b6d5a82382db74dcfbc413fb7f2b00b6c119c1a67d37030f217b8180aab86426f3938fb209f9264d8562519e334e3f7f51402187
SSDEEP 3:qqb/NjghzY+/lzyliMlTXm0si2sbklwRzMlklKllgIn:LCM+/lulvl60sVsNRQlrf
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 4544a34f59b58d98fdf0ab0294c51ff39ad44f351588a6232c0508ad242e32a6
MD5 2ce077289185739fa18004df249728f7
SHA1 a8d9d553e20503cf08ee6f095ee14df16fc70366
SHA512 89679b5ed5f13b77be22d2d159aecde0849aa8fae4c25e95025450c751a8e75aa069ab3312af0ab71f83003ab7e3846de272290e368f8c4906d51d4db1613c90
SSDEEP 6:rLP/gEhV71m/9blDqlrElvlaQlr2RTslCM+/lulvl60sVsNRQlrf:rr/gW49blqYFlx6Tsb+/0Fl60sVsNi7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 07c12fc3f3563b860f5e4e1f3d222c3d8ad4672ca78236fe6ba451f8d69c3b8f
MD5 2b1ea9eb3f66c58b9caf6fe9213e2f5f
SHA1 c1f009c50c9ba7ea60391cca1a52049e3e35613b
SHA512 d4f9f94bfb0875fab23068793ca64cc8b1e8cd2b2ff5e38bb68b6b50ad9cc61287b706b4971a4f70e2865523178c0cd9de5854f17c7e4b8ef22caf796b36097f
SSDEEP 12:7RhOLavnOAUIIbhWl4a4R49blqYFlx6Tsb+/0Fl60sVsNi7:VhKamZksR499Fa8lFzsV4K
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 2289f2f5fa516627d2819b175eabc9f818056370773bc7e86360247bd1a75041
MD5 a85b3f3d9a9023d95ad4910c29dcdd1e
SHA1 65a4ee719e21c6d8045c818890902c4135477f66
SHA512 ea05287e6cabf030c3d7a1f67f2c13a0d32ca7f1405353751efa2d52db0da1795a4e8130fbb64672f7d1aecb9af5bd8a2cdaa39a7db60b06a0ebc82298309d69
SSDEEP 12:aLtgRv2FyXIIbhWl4avqRhOLavnOAUIIbhWl4a4R49blqYFlx6Tsb+/0Fl60sVs0:aLt6OFmkjohKamZksR499Fa8lFzsV4K
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 fae665ff0b99f954f64d23866ff040b5a2fa67657170ae9282d29c38e6b4a301
MD5 bd13486d55b785d5f87e819236520ba3
SHA1 21b82fbb8d736da737e6a66040419f81609dfdf1
SHA512 450d0702efd6ede82f5d6019d95b350269989534a1cb42a3eb4b10768fae12d679fd13345fd489cb9ac39c72b610413bdec3a1d0a5991b1f26e6f9285e239303
SSDEEP 3:o13Mytsl/ltll:o3MmE/
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/net.ppbl.bcapp/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 13075e996d83849d4338315f11724272eaad7ed93612c31d87ca8ded6deb118c
MD5 2d78a317f04d4857ce59d041539e4cca
SHA1 8940b6944d61fa45e94e5273d76e5e614c4ca079
SHA512 929405b9947bc8d3e56658fc9f8cf59e31cd20d2f4cc85d66bd966c0f0274a858c4f70387a4f65a9428e06fde1ebabca8bc2559809906ebb52c1cf1d06e5a675
MD5 SHA1 SHA512

Submit Download