824dc53efcde85333462dc179cf530d646b5c8b57ca4ab8887510a068bf45660

Analysis

max time kernel
4s
max time network
154s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
18/11/2024, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

2.4MB
MD5

3fcbe71d7d0c7fe5f8be6d1638fc8ac5
SHA1

b895f8aebb887f5cf7bd149cf05b0729827adfe5
SHA256

824dc53efcde85333462dc179cf530d646b5c8b57ca4ab8887510a068bf45660
SHA512

f460a4f00ae650b735a040dbdaa8db00f1a6c790ab362947319509c9edc27a3fbdac7d8187dc90cc385f24de7aa99b9635a3d28b8adfe9c2a6193ed1aae31212
SSDEEP

49152:N/m7+MiFN7bFLBeRjNvrQriEwuCAuAQ7O0:FTX7RLBeRjt0GUCzHO0

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	mad.net

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	mad.net

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	mad.net

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	mad.net

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	mad.net

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	mad.net

mad.net
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4971

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/mad.net/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
a6752cb1d3703ae169d437df15d86750

SHA1
6e025e45d89e9fd7887c536a048df42cbaf16ca5

SHA256
7318bf91598dda4b037889de21d4298b2b30e226e16dfd4f71a57d8bdab811e5

SHA512
6f127c66920484f66c80ae21a87ea03396e3b44355786d827787f3d726e6ffc80fe736ee1cb2dd0c29647952a7b8357a68f80e1a77fb0cd3d20f321c7e9ed8be

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
cc665d28b6d09477b3dde27b92fdbf84

SHA1
3ef31490d594da21d1214f6a87eaea749a4fc7ca

SHA256
9d3c6a1f0185c2f1ad565ec38469d2244b59b7358fd14c09351249e7d8449dcf

SHA512
15da0ce2270f9a995fce38519295ce1bea236612eb38d200c6f2704eff785b1edaeb997b63461c7d2d6610d1528aaa61ef127968fb147fa2ed6eb4a61a4db4d2

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
fb02ecd3bb4bf81ea0625981dca7e9c1

SHA1
0a43979b9adb7b29ee56a41d602e215d93939f98

SHA256
bccc1d2df5102084c39b6a517c41a4ecf762e58376c2597cabc1a9a73f4937fa

SHA512
3ee7bb8deaf45f6f4ba44da8a35be48310dc9cdc5f2611a2e3ec5723c015ef7e530d49bf86accf697ebaffd145256733245406fa2aefe93fcab3305b74845b90

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
c6df6b9ade7c102c7aaf111c452a87ef

SHA1
e1916f00a50b6603fd09570ef7f197a606051aca

SHA256
c18af352ccdd86cb1f8955e8b5d7daa349c17a018bfeba1f315564fc721cd60f

SHA512
02fb3ebb102aedd54de98fc3bc0a1a6f363fb26a6814be9775ad5b195d2ce9c2711f1ce443ccab07c49870eff7a7f5f654e8b7d76845521b8c3bd22389155c4f

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
fb73565bc49c5b6003e44d977018734a

SHA1
4e53a01f83c8cf3d7a098f7c2ad55df1242caede

SHA256
0123df724e7e62e5ee4b8c64520934ab696120ee3775bf1aabb2f34bcab0625b

SHA512
60be7e9453e5195864e43af3637161870072a7ed1422c02df74710ea8d339796b85a01b2027715cec62a5afe4abe2c951fcca350813845b29bdda45a71346ba5

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
3ebfae21cb1050d05f2de8f3e7fe2385

SHA1
a9a494e2493143d2d26d1b9d6278a7228738edf3

SHA256
e045e0f4301f3c93273c8e87a1da3fb5c7e19cd305ad73cb7d966fb6c198eb8b

SHA512
ba4e16911e60474eb51149d8b95b97948bf1197c1b1b839c5bdd74b2990dadd8632928eb630556c5cc6f1c4c1c5d90d04f300e1019310f1fed784396eaca05e2

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
3f689828e31177fab6a318fee8b2f143

SHA1
f7de9b2577eeec6944ee76695c880b778bd92ffd

SHA256
faf9050a45e83c6056f56c292bf8b5e6ccd6816ca45167496d709fc2d8435054

SHA512
67d812ed6816573e041f83ec1b8ce60dca88345ccf0989f91c8f7e4373e6fb4bc6b6ab6440242b6111c22f43a0838e2fe4155f2d2ee37ed13fe8ead994217a4f

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
c8b0344e80474ccaa9ce728fa23d614e

SHA1
96a429c72db96e83cb21adef8db839a9032ccdff

SHA256
e21445f4ca77017bf98e5c5c90501d6f947646afde8a058fba26122096f77b81

SHA512
f6d778c20b8b9a0b53a2d27b2f9ab0ef30c49d453a056a76fafb63835938c8e307c41d19b00242e0673f57631bbee22adbe3655b357ddc2541fb885baf41378c

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
173e49a4305249fe80830468f5b3c54c

SHA1
6c37fc7d01f6b292f3a7de96b0f1899e93e455f0

SHA256
126b3f8e52a44f3bf119953c9787d425cd53b50a16ce4d56287f587b182ad27a

SHA512
b9425966b1b44f82c99f1430a928d97f5ff20a37082fb7e5959cee0e19c6b7e84085c59208a6391a2be22a6f55702d3fb96e55ae349835302a27e4e2bc780ea3

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
080ca66a3c02320b6e52905f010bd4ae

SHA1
46eba79705b0f1ee44708075c1c04df1901c8fc5

SHA256
982b8c88617c067665e6af71d585f3bbb5f97a168a10f0074d6e6013f1185773

SHA512
989698e28b4cb67b54c36e6873f7acd1a0d154e6950db8a4a80ce951a7213debf05f2e97beebf605398eb6e10d2572ae1730dafb0955599d08023cd9f46edb5a

Download Submit
/data/data/mad.net/files/PersistedInstallation2114367753730509512tmp

Filesize
90B

MD5
ff3ee80b5dc57f004a4d831ee29d4c4a

SHA1
641a98c2d642ed477d314cab798a1cb294b94467

SHA256
6fe457c4624d314fd96ce501dd01fabaa4e6e00415d5f79445ccfbb25deb29ab

SHA512
147770427507fd519667e0cf08a877b03080581474e014918bd3d9504e87b9f7fbf0ba6995f495e3caa8143722af67fac2b24337aacda98d0373ede5e1b8d1f1

Download Submit
/data/data/mad.net/files/PersistedInstallation3581899143225482041tmp

Filesize
569B

MD5
05c50c8711b59c5aa825b3a89b1af0f1

SHA1
c97f4fad3183ea0bc55a31a3aefdd5747499bb80

SHA256
31a343d507a0ee93c2ec50fa45bea2d289e6dc4505f290f26f63979eef40ca29

SHA512
f8a88eef7f249581a9f924e662acbbeeb4127c19b2966a30bb628409143e53e2d07d2133be612792bac1d40dace5f8d43ca4bf1713061a348df18586c1f69d5e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads