Analysis
- max time kernel
7s - max time network
150s - platform
android_x64 - resource
android-x64-20240624-en - resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system - submitted
15/11/2024, 22:59
Behavioral task
behavioral1
Sample
e3a75d5f207eedf68bdb88c0d2182d9db8916ca6ae44d7a33963d4812ee0b71f.apk
Resource
android-x86-arm-20240624-en
android-9-x86
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
e3a75d5f207eedf68bdb88c0d2182d9db8916ca6ae44d7a33963d4812ee0b71f.apk
Resource
android-x64-20240624-en
android-10-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
e3a75d5f207eedf68bdb88c0d2182d9db8916ca6ae44d7a33963d4812ee0b71f.apk
Resource
android-x64-arm64-20240624-en
android-11-x64
5 signatures
150 seconds
General
- Target e3a75d5f207eedf68bdb88c0d2182d9db8916ca6ae44d7a33963d4812ee0b71f.apk
- Size 1.6MB
- Sample241115-2yv1fathqa
- SHA256 e3a75d5f207eedf68bdb88c0d2182d9db8916ca6ae44d7a33963d4812ee0b71f
- MD5 14ed5a890f92da4254f3a172df3b6865
- SHA1 fa53ac01dd25d738630aa7263f0e198293b5165b
- SHA512 75e305bb5328099702fbb5f0e4475d47c6b75b2261a22f9b42179e4a42a7f2e4ff4eed0000bd6bbfa9dd145685c74fb450098d9f9944d97b51d8ec27645f2457
- SSDEEP 24576:8g2dj7TUQ7rRNLiu0Ck9j5X90PLOhlYN6qaBxEJ0jRilCbILQQ8WLaK:8g2pTN/To8L0YRJg0tLQrWLl
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis
- Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Declares services with permission to bind to the system 1 IoCs
description ioc Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE - Requests dangerous framework permissions 38 IoCs
description ioc Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS Allows an application to write the user's calendar data. android.permission.WRITE_CALENDAR Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows financial apps to read filtered sms messages. android.permission.SMS_FINANCIAL_TRANSACTIONS Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an application to read image files from external storage. android.permission.READ_MEDIA_IMAGES Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES Allows an application to write and read the user's call log data. android.permission.WRITE_CALL_LOG Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application a broad access to external storage in scoped storage. android.permission.MANAGE_EXTERNAL_STORAGE Allows an application to use SIP service. android.permission.USE_SIP Allows an app to post notifications. android.permission.POST_NOTIFICATIONS Allows an application to read video files from external storage. android.permission.READ_MEDIA_VIDEO Allows an application to recognize physical activity. android.permission.ACTIVITY_RECOGNITION Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Required to be able to access the camera device. android.permission.CAMERA Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows an application to access data from sensors that the user uses to measure what is happening inside their body, such as heart rate. android.permission.BODY_SENSORS Allows an application to read the user's calendar data. android.permission.READ_CALENDAR Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS Allows an application to read audio files from external storage. android.permission.READ_MEDIA_AUDIO Required to be able to discover and pair nearby Bluetooth devices. android.permission.BLUETOOTH_SCAN Allows an application to read the user's call log. android.permission.READ_CALL_LOG Allows an application to receive WAP push messages. android.permission.RECEIVE_WAP_PUSH Allows an application to read SMS messages. android.permission.READ_SMS Required to be able to connect to paired Bluetooth devices. android.permission.BLUETOOTH_CONNECT Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS Allows an application to record audio. android.permission.RECORD_AUDIO - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal cosmos.scrubber.pupil
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/cosmos.scrubber.pupil/cache/final-signed.apk
- Size 398KB
- SHA256 66c2572883a59fee7544fd9d20ebc077512097a0e04474938a2d6479ed110b8d
- MD5 a741c9c5c0f66eebd005dd12fb6b771a
- SHA1 52a7bbf1f2be1da2e04f08adf3004f6cfda721a1
- SHA512 f551286fed2b30c8b88e5f0f6c12571831ae80f48ef73af099f2b2fe9b4e7a4d542294893679d9017ea3a11260be6cd5233c6dfbf11ca6b788733d81750f375f
- SSDEEP 6144:+EB57UMFH9kJm9wTbugo6xXTp5JtMMSrK2gs2RBdUuRcwK:zjPqw9wTdo6xjp5jMMKgPxK
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/cosmos.scrubber.pupil/files/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫
- Size 911KB
- SHA256 3ccf2ae7bebba10f6aeceb546fbfec4698ae572257b702355fa0115a72c62422
- MD5 2d08df038d1918b22ab433c04f0321dd
- SHA1 69f26349473d98d29c28b9ed14a801e53fc7a1ff
- SHA512 5cbc784fba4bc37ec90834cc8a17ad2bee636c6215088d5aac341f891d29f10f789e434a376e73831cf2016408925c95bfd5b48f92bb33f7fdf14a3506de6267
- SSDEEP 24576:ZGg2uMqRw90jWIp5bTOBxEJ0jlP959NOwvzS0:0g2/0CG5bTVJg19nNOwvV
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/cosmos.scrubber.pupil/files/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫.
- Size 1B
- SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
- MD5 cfcd208495d565ef66e7dff9f98764da
- SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
- SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
- MD5 SHA1 SHA512