bfaf5a89c27e0a1b7eafc47fb9c408d98a5214275168d72e2e9749b4e7aeb3cd

Analysis

max time kernel
5s
max time network
149s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
18/11/2024, 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eblagh.apk
Size

2.4MB
MD5

d19af56235d6c03a465f2095a86a6da3
SHA1

3e4fed9caa3f3eef68148f2519c42c1916dacd12
SHA256

bfaf5a89c27e0a1b7eafc47fb9c408d98a5214275168d72e2e9749b4e7aeb3cd
SHA512

f648b8b5770bf77f1b0f6aed59e8068737cd52fc491be5b31ff94528f4550111675b06c80269a0e51d912637041b28eaa17b9e87af6e14dbd96d617088bec6cc
SSDEEP

49152:5/iYJslyMdUVjtKuLm3crRnJOu5Ef8TPxs1fY7WYKI:h/Iy+CtKoNlDxsGCYn

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	mad.net

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	mad.net

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	mad.net

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	mad.net

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	mad.net

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	mad.net

mad.net
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4987

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/mad.net/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
06b04dd52eb3c58a2913e4c57fe8f66e

SHA1
a79fb36a882fbe8062f2c44bdb47e2173f6bfe0f

SHA256
26a2b3453f8867962865bd557527bd2aac1f8a453bd5fbf6881503d2960cbda0

SHA512
8d4cb599dbffee78036e5fc03de297b5c8a5c2bd9d6edfd9eee6b46da880c475eb6172a5a33a1511d21afddfe3a8b9efe0364fe4ee74422bf40b28405089376f

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
4822e355aad4b538fb5e7a2a63de9e73

SHA1
fc0beea9fac0286a517232e8c64247efee15583c

SHA256
ae72f2f7ead65624b9f86d4e4d6a5e3d19718208492dba8b9bd5494f470c2cc0

SHA512
27ea5b156e701b3099333e21fc86be2407bff8c69784a4b648ba1d5e8a3be2d72dc86ec51df7116d7d05b38accc30501de394999c7ff32e8ee959581df4fd885

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
1277269065a0c66db6f1c0b4b091beac

SHA1
35d3c39b51f43a7abc2c690984f9b61d768c6488

SHA256
0428f80eaa8884ba040f6b63725ca4226d5a711f500eb168eea3bda626db8a41

SHA512
3b74bd862852e7a874c8b02c2c0fc7a4b47207b97f5a1874169848d103d15c86e30367a5443b77dcd7696889c9ad26d1b84bb77a25616f549cc3a0320a885b47

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
2fd16f7111cdcb08de27f28cbcaf6cf7

SHA1
4237ae258fb9158c6ac200cd4b555951279abf84

SHA256
8bfeff67fb77439eb677555010568de66e2a5d1e1effda9e6e3999e3f14dcfd2

SHA512
26ae2460fa6d55d5aa9c251045c34f2efb1c5777409d0aed88e7f7e27ce765a1998ee4aec1a7b22f62b97147693553784f977ac7549319e6681c970cf81d771d

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
f1300c18cae999f8e7ebb7af00431e06

SHA1
68a76a3a96587c9c2eff0fa01c1a1c75f594b0a5

SHA256
b409917975f97b14b3bb11550bd98b5db6802e08feacf929feacfe0e846c769a

SHA512
933045ce2fa7f7050c27ea95ee648e7c9479046530f4fb4a44ec8f44632cb2af8f477210f6f4966ba069cb0bd757a90c9254009a1c8865cebf7e570ed5be677d

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
bfc52af324f6b7a270aac6eadf5131eb

SHA1
8d0ab27b9e95d5748afe465cf984a3fa2f6cfa7e

SHA256
17322c59d4c418bc86fe3b2c40a72847cd2cfb54083c9bcd0d5e9b443036da81

SHA512
c40375b1648ae3bd7d32e172f324748d6a2516a1a385373845023dad1b6b375793b0757e25f5737d963e86bb762539ab4a34311364ffe017779471b6856373ed

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
7cf6a17f0a876faaa67172f69400fc04

SHA1
4856f6e117e6347cb51865796d19062c9b2200cd

SHA256
09e2a0c6659aaad2b1d1ff5ddf443fbaa7f5985715b40fcfb0d5dd3dcc041816

SHA512
2f79b6cea689474226483ea22cb1d194718d3f887bd5ace7bb9f520ea5dd80430d8165d40b5203d84c60de957fb79554012cfa86221b354beba6aa860173d9c5

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
9cad73fff5cdc2368295fa1a64bcacec

SHA1
7946e0d5b9dbe28a7141a30ce9bba5935533e992

SHA256
f6ffd15b1bc1b5714a1e6409804e99bf25cdaaddbbe36fa02f55202fdf9fac41

SHA512
cde2985dce31fe7432d1dad0fa4256901872cdfe058f9b2ec457d4d123284f25750a4e9d7a1b69c72b00b2e560f52d38d8f0ef0adf734a3a75c8fbd1604e3770

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
4f291d396b4be43d98d858e6d9beb657

SHA1
8c1eeb08728fb7466f38524b23e8746d3b2922df

SHA256
9164cf2667c232a448c0d65db3fcdd7c7858e50baba63e5ad5d0083deb67f601

SHA512
79bc23086bfa9fc89351d023025763f09357372025583f4e10e69216c491ec886018406aff7a34a54843091e2d0b25afc7aeb8d14eeab45cbabcfda7fac48786

Download Submit
/data/data/mad.net/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
13bb353e7a42e9e2858626158d37a0b3

SHA1
05b36b830d0008a04d06b71ef67bae532802fc5c

SHA256
2590f38f192209978c8b9294b1a255180fa2923aa03e5bc52ab9e0be28bf0468

SHA512
0b6ce010b4bc72ba114422b7dcf3fcb8064174c3e6bd849819530df4966350f0e332a3188f2d2c5bb4fee7f204260b16e950bb8307ac064f6f630c55c489c231

Download Submit
/data/data/mad.net/files/PersistedInstallation2036814656890843161tmp

Filesize
570B

MD5
a74741bfe1ec6e3326b9a0ce7b9a3102

SHA1
78c80b3b46b7b57da727cb259acb15676a0d1195

SHA256
c70b25e17eb1e3b6941505030a0cf7b5fa5fb6407118ff2e753ac5b91219e208

SHA512
4c1f815cc375a1f36ac41b4b5721095f1868931a6359f1119135d51f088eae41e8b10f34b17e985634eb00b882d5197b3a9a6a255107ac42f69b6d573492a66d

Download Submit
/data/data/mad.net/files/PersistedInstallation4254173767341553132tmp

Filesize
90B

MD5
0cd8f8e5d5a4df39dcfae8c5f3f519b5

SHA1
708766ea7feb49179c28f409794f7d31337bcebd

SHA256
ad32db487314eeb2f1803d9a584c734d7c0dca04900d57e0bc8976038ef3d314

SHA512
f18affffd4b8cec62961b6d685fc87c1d56faec2ea6345207fe291802b0958bd7ebe1ffd485cd6eb96507809d0024e17fad38e800b3bdd39e519bcf05a715a8d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads