fb8eac6f4a5eb59088898f27f19c35862eec0770e0eb7565b295fc8cfc4e7bb3

Analysis

max time kernel
5s
max time network
150s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
17/11/2024, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.apk
Size 3.1MB
Sample241117-gcvsbssfmd
SHA256 fb8eac6f4a5eb59088898f27f19c35862eec0770e0eb7565b295fc8cfc4e7bb3
MD5 7ebfbe0605c081f7dc96c4edec09cf05
SHA1 7e60dc7ba39f7fd0718a4cba8e3a6ebf27891c56
SHA512 3a899d1bcc69ada47414144f8338995f9688c6d92c41f2ef159ea1781d312fc908405c246782eeba5f1df2482935ce06acf741b6c05955f81b077bb0164867ae
SSDEEP 49152:4bmP98UKolddcjZrNEwglZpakG76aJBLgKt2IeHrm1tqs3QDOCd/Tv7CX:NP9DKoFqZrNEwQ1Guo8i4SDq/p1T6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	abee.app

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	abee.app

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	abee.app

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	abee.app

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	abee.app

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	abee.app

abee.app
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4971

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

~test.test

Path /data/data/abee.app/cache/~test.test
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/abee.app/databases/google_app_measurement_local.db
Size 16KB
SHA256 a7c94860e5d2907929d0729f723c99fef5479e90c758e1d3f93b7bd3f6510506
MD5 e5318d9ae4638f82cadd69b108ced5f7
SHA1 8367c771ad61d79589735fbc40c7cd5fa23bbc7a
SHA512 715d9f490003424e145e86862a7251dcb387ed4d25820912344a90c09aa405351bfc6ef7a7758b72b0bc567adb303d2d273cd0d1cb109b19313bb1568c465e6d
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl61BA:TLiEy9zmzrfRmBEyPbP/P+/0Fl65i7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/abee.app/databases/google_app_measurement_local.db
Size 16KB
SHA256 92d980e983daf78c95dedc6a0724eabb6110e67567ea846439857b4f30ba793b
MD5 659a69744a860290946b10c2d09b1318
SHA1 1a0b0827265fbdb03884f9deb766132ee41dc627
SHA512 59726ab9e2d0871521c188076a70366375f3e0316ed83ba851ad189f3020680996b9ec1dd87e73083edb5bac41c8222a82730fdf5823ec57f66a8787cfbd4614
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlfK/+/0Fl65i7:TLQpmzr0GSP/h1499FqlFoK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/abee.app/databases/google_app_measurement_local.db
Size 16KB
SHA256 d1f2eed125f6920fc323cf9f9f5fae3552ec3cc7b79f90a790c4efdc623a6d43
MD5 fcce6422c588c04d55c1c425993bfde4
SHA1 3e6f407a4c297f9b23af8ae59c96e5e46fb5329e
SHA512 b64bc1198be9375419d1ed2b7f04523fdd6b70ca96a2c3d00c167c5c3b9d3a2bb77d2084de1da9539bd2fd5d6a8a7e57ffafbce2569275f801dc90c0271343de
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/9FAiOLauK/6AUvkWlBWI549blqYFlfK/+/0Fl65i7:TLEvpmzr0GSP/9PKary5tnf499FqlFoK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/abee.app/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download