e1a0e5b8f02424e046d674e721cc6ded514c4131b61464d9a6115184d41181ee

Analysis

max time kernel
8s
max time network
84s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
19/11/2024, 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1a0e5b8f02424e046d674e721cc6ded514c4131b61464d9a6115184d41181ee.apk
Size

69.0MB
MD5

694e52a59bd0552d404e8bcdf52ee7d4
SHA1

f1d0dc6205f82b9e4c723698a7e9dadfd0d9148a
SHA256

e1a0e5b8f02424e046d674e721cc6ded514c4131b61464d9a6115184d41181ee
SHA512

bd5dea14c9f9a7fd9b83fb30e542a1072449d9b4b356ef39512a386cf49e53d41aa9c10267e8ca8edcb13dcdda7015bdeb4a30272803f7709cb3054a201fa870
SSDEEP

1572864:TIbgU9BSqPO1vl1hrZWGh0pEAfvy4FYYdrkcJP0w:0SqPO193877vfFYYdrkcJH

Score

8^/10

discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.skt.nugu.apollo
/system/xbin/su	com.skt.nugu.apollo

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.skt.nugu.apollo

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.skt.nugu.apollo

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.skt.nugu.apollo

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.skt.nugu.apollo

Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.skt.nugu.apollo

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.skt.nugu.apollo

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.skt.nugu.apollo

com.skt.nugu.apollo
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks memory information
PID:4458

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.skt.nugu.apollo/databases/alarm_database-journal

Filesize
512B

MD5
39ca96c4d71b1db3e57cbc931505432c

SHA1
376a4925e066d33a0dc6f9c9b9f4b9106b37e668

SHA256
ecf94c0a1a4da49d8cd0cedc944e3911a556c25a6499a2237ff0ebdc0245edf7

SHA512
c36fd600b412097505d7b20b50dfd5ce5a710afe499ea46de785f70d0334121c40bcf02452b5dfb379902ea80808e8e6a02970e5ae9a97232f4321a28f2a09ac

Download Submit
/data/data/com.skt.nugu.apollo/databases/alarm_database-wal

Filesize
16KB

MD5
1cfd22cc4dbbf1438618582fec8599d4

SHA1
a5d4bd6e439e86a55a8be59a3353172365815d6e

SHA256
1d9a944814d95fd66590a73698fa45c9da5ad1220e87186a9ae2a1cb43f3f340

SHA512
a47dee2d8e6fcb6b02283853995676d84ac7296676acb9d0080b8b428ea28e77ae19741a8b3365204a11c9e0592596988c18e481025c475cfabf817bc3657b79

Download Submit
/data/data/com.skt.nugu.apollo/databases/alarm_database-wal

Filesize
84KB

MD5
08f2c39f05bc76658b81d3f15ec97c40

SHA1
bf7f07b2caee91ac0656b6f2fbd3b987284b449f

SHA256
4992bd86a59602eb84fbe0d112c169aa73b0c5a23585029547a9ac64533868c0

SHA512
16acf2db0a800c7ca3cd5b0697d7485f57e5b5a5c8d7b8d0147f4876463316c674ab2a86fe6fe70efba9549c482b3eb1c15fa09e685de11e0f281e1ccf8ca024

Download Submit
/data/data/com.skt.nugu.apollo/databases/alarm_database-wal

Filesize
104KB

MD5
ef7f6358f448f828348e5b43679c7bad

SHA1
69f9c417176ab9722f091b4b5d178f03bf199917

SHA256
9e18266ac3dc97e4eec14354729377f6d1e50c949f75b867ae5daf4d650ac82d

SHA512
b6ae47202fe50a8b533da141700dd6340c95a93c97d70e3c384c82a09122d6428c32549407b012bad9e4b3ca59829b6ef6f21903d4579d7555e378e999b39db1

Download Submit
/data/data/com.skt.nugu.apollo/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.skt.nugu.apollo/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
c7be7f2124280922b2049a6fad2f244e

SHA1
af2b5af3d92c13e36552821e656dfe65dd0ed9ef

SHA256
2835feaf2d14206e3e3a801925c2867a65ea358cd793ba75e5e6b70b3b0b20a6

SHA512
fcb042b4739924e067aa04d964668e6d06d851363b6db51d0c2724ae7bf203be74a81098b5baaf6a7ae64e0621fcc56622c4f89392041a071f5805ae66225cde

Download Submit
/data/data/com.skt.nugu.apollo/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.skt.nugu.apollo/databases/com.google.android.datatransport.events-wal

Filesize
144KB

MD5
68078f05af6a3394a99fcf53e4f39219

SHA1
ded9c3d7495deae09ad95c1bfd001b546c4dedcd

SHA256
f234ff996a5162e7cbfeb5a1d7d87e8d48d61751fe8648406bebf5ca8e6b214b

SHA512
b6c90a66a3f78de675d5b879ba6de05883d4f7cde6c1166834e63e9f0b4d104bd186ad096275adb6ed60e1bc392b0275edb4cd66cd474d83c7ca1e0d06a8d463

Download Submit
/data/data/com.skt.nugu.apollo/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7237409e0640cfab7bdbd429bf821a3b

SHA1
4c3da934842f8d4835dfe2a9c275a300e5123309

SHA256
5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

SHA512
c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

Download Submit
/data/data/com.skt.nugu.apollo/databases/google_app_measurement_local.db

Filesize
16KB

MD5
026e30225495365d196ab9409651a88a

SHA1
efee28857ad3a223a7656866db6e591ad7bfef95

SHA256
52b1601ab51135ee274f80a84b5c5a2f11bc396db740cbaec8795cc10e0c36fc

SHA512
6857e4ca2229d7ceff62a316c5870c8a56c357c39f0042685b2de9ab9a3d824aad5ad635e37f3938ac870ca505ac4877fda008a8ca17ca34f109981b5247131b

Download Submit
/data/data/com.skt.nugu.apollo/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
41ab0fce6cd008c834d0b837746ab382

SHA1
d052fa42ba1ffee84f27e32530d16e653ba4f827

SHA256
76b1b280d19b10b589d6a85d2614ea8835e6bfb758edcc6b50f43a8d9672c2ac

SHA512
f66f9394103ce14957a081ccd36d2ffae919e79781e1cfde07efb366b67c6463561eae2b2cf66911fe667d2e837a3378c4ef68464dfd1f9d50a979aca076dd08

Download Submit
/data/data/com.skt.nugu.apollo/databases/google_app_measurement_local.db-wal

Filesize
36KB

MD5
417a396720e336d26139a9538d0e3fc4

SHA1
27560dc29783d7a0cf3ada4039f9b7579dadce05

SHA256
afd15de3442fe82ac3a40d31615b115f6a190108f63d340a70a1c4a6c70fb206

SHA512
12cf62277451a6e16362a3e5377b0bf38aa804c86e9bcdeac64f0ace8c78b32e5354906b92cb415dc418f8938b79c3690fc4e32729959bc41667efcb4b0c5d1f

Download Submit
/data/data/com.skt.nugu.apollo/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
334407ceab89fd0cac366d0af189b561

SHA1
7b2a49e2e2eb701b64b9631b3c71b505ca3dfc81

SHA256
726be1f2a754b3b18669148257d71860c65e73d360b80b6d1163d33e093b46d7

SHA512
877ad299ad905668070d3760116bcdf8d771182cdb75aead1506ef6c4f20b5053a237457fe9e814b5467bbe4468c1e455077599ab8781526bbcf71a6f1bc56ce

Download Submit
/data/data/com.skt.nugu.apollo/files/.com.google.firebase.crashlytics.files.v2:com.skt.nugu.apollo/com.crashlytics.settings.json

Filesize
715B

MD5
fb7851d50870c5de35a73e5d291a4a13

SHA1
e753d74a9d4a259f631689e3f70a197655ef1529

SHA256
8540e7afd33120074a6e0139cc0056d04a9dbaaa5a8c7466566abd3ed6985578

SHA512
4c1ed39db6de9c01cd08b7a11ee5f8579292d2e753a52de55cf728fb63bb093f8272ddaf8da6335a469cea8fb9235676f3145462e37bd31fec4ebf35604b9a40

Download Submit
/data/data/com.skt.nugu.apollo/files/.com.google.firebase.crashlytics.files.v2:com.skt.nugu.apollo/open-sessions/673C8CCB005C0001116A017AB53C57CE/event0000000000_

Filesize
47KB

MD5
9b86fc077d1c7133b8aa73abbd87523c

SHA1
d26ed7d409abaeee81a9ce69ee277d09db6e4dab

SHA256
ab5253a57ef032f3bfbd49dfc3a5b33c6a21f9f762dfa7db83636629a7907525

SHA512
277aa1af30b62edab373125a7499d844d213912e63add0b4c9edb85533c091ac7745be44a4c8ddfd0e9523659bc8f624312bbcac15f1367f2f25305ef9404477

Download Submit
/data/data/com.skt.nugu.apollo/files/.com.google.firebase.crashlytics.files.v2:com.skt.nugu.apollo/open-sessions/673C8CCB005C0001116A017AB53C57CE/report

Filesize
752B

MD5
bc8ed93272328a63669e2abc59514765

SHA1
252861b7a151d650ba4b0becd66b9da2199d7292

SHA256
99899c8195c09a1082fd4306b375d9749a201b35819e15e6fe885fc2f93a4c91

SHA512
81c7d1d684af86687d57b97710c85711017928dc399947cdecbdff9576e8128b07f4b53f8296fbd98e218cf2db55795e3b44efa1245dc690cc859914afe04d97

Download Submit
/data/data/com.skt.nugu.apollo/files/.com.google.firebase.crashlytics.files.v2:com.skt.nugu.apollo/open-sessions/673C8CCE01930002116A017AB53C57CE/report

Filesize
752B

MD5
5dbc3b0636d75faaf366359546e8410e

SHA1
160e6a07808a7e43850045196317662ec712d51b

SHA256
74398efe4db16e0c9a8735d3eccc2865c9cc77eae8ad5882d59791b35f1edca7

SHA512
fc975a15e37c5e3efb4dcf292dee6a9cbef414ac1feefd40b0053eef1bc835ce7135dd7a3aa88fc6d6a586432da9244e21bacfd422e30cceedf1c93ceb313277

Download Submit
/data/data/com.skt.nugu.apollo/files/.com.google.firebase.crashlytics.files.v2:com.skt.nugu.apollo/priority-reports/673C8CCB005C0001116A017AB53C57CE

Filesize
48KB

MD5
9693c90b699c6b3442fc1332bae240e4

SHA1
d316faade95373d1fd321d1fbca3e79fdde3b502

SHA256
f2ff6fc33bb0dc2bb6eb0f0e29533de453f51a8570eb27134b5d8938294fedd2

SHA512
16b0be3d1d3a25aac0fb803d23cd1e735227efb6ece72715212cf6ecc2243c9ec42de7bbf181e8387ee82fb146f26f059ac28370db5eb8ee5953e2af0ccb4dbf

Download Submit
/data/data/com.skt.nugu.apollo/files/PersistedInstallation6419992964595407993tmp

Filesize
90B

MD5
aa2768fe9ca8b8c22f1e745b7d1dc285

SHA1
0ce2ed5537ebcc61b4a51cbaa3bc44b9f3235617

SHA256
558c6b61aa2e3b0121b52df53b9b7bea4d486770b573a8f35da38a8f6dec9195

SHA512
c0c5974842098cd8bb8cdb4fe30e26523ad6276cb5cb9507ef2b552e9a8560f7c764b0a738e125e49fde47bd23aa76141d9c003a1fa05e3ef5ecb3557f40c403

Download Submit
/data/data/com.skt.nugu.apollo/files/PersistedInstallation6890102413310611949tmp

Filesize
569B

MD5
94b24944fc00c5f720a4e6a687bdc1ba

SHA1
a7020113cd2b16046f1384238c093ed9a95ab335

SHA256
6c1caf54a6906270d13c09e01fc76e39f8ddee315945bfc45685dc166cab5fb3

SHA512
9cf1c0b55047a0ca214421c3fa9838f99b4795910f1eb0e912886f4618f94e9e88c027ba9d79d3028b6c18e1c6043136aee339321e893c2227c68e75db1442b5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads