f69533838fdd075dfe98d3c36b7edf4df84176dc73203f5e0a0f03227b29c566

Analysis

max time kernel
25s
max time network
156s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
20-11-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f69533838fdd075dfe98d3c36b7edf4df84176dc73203f5e0a0f03227b29c566.apk
Size

2.2MB
MD5

cec599ff3cd1776cafc708843dae321f
SHA1

ee1abd108e160f8f2b358679a189a438a49904fb
SHA256

f69533838fdd075dfe98d3c36b7edf4df84176dc73203f5e0a0f03227b29c566
SHA512

cbb431e1f77b53abbe4197dc06ee5c2cff9f4b1860e421d6b17ed0a81b24919a50f722c9ea19df5dac144bfc970c8d156ccd73c64a4a8e7bc7b8977e1f75b59b
SSDEEP

49152:eRKKry6UNSjhGfnVdgbv1geiIIbSb5qdxIa99nygSjRcK8L:egKrFUsjhGvVcgpub5kIa8Rc/L

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.htkorsupport.android

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.htkorsupport.android
Checks the presence of a debugger
evasion
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.htkorsupport.android

description ioc process

File opened for read /proc/cpuinfo com.htkorsupport.android
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.htkorsupport.android

description ioc process

File opened for read /proc/meminfo com.htkorsupport.android

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.htkorsupport.android

description	ioc	process
File opened for read	/proc/cpuinfo	com.htkorsupport.android

description	ioc	process
File opened for read	/proc/meminfo	com.htkorsupport.android

com.htkorsupport.android
1⤵
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4827

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.htkorsupport.android/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
39e9093ab661cdf82cec0d97bfa03f41

SHA1
a373a4245190aeabe4a9fdaeb393b71872a0ae78

SHA256
889f6d1ae3e6e4e96c94a7afdefd6a8531bc268faf3315464be3b509946e35d5

SHA512
8768c5c8ba1d2ddf34c1a1957d0b327289047fff616c80b85f4c6a17f53831deb89c8fbd813bd4854691891e0968b10f8678c4503d9d6aca467aa2282e23437e

Download Submit
/data/misc/profiles/cur/0/com.htkorsupport.android/primary.prof

Filesize
1KB

MD5
7140b7e842ee52b25d6055b689e0bee7

SHA1
df2d38e2d0e1e494eb371475309806171a302709

SHA256
3f817e24e344db23539ec33dee3f7cc0987479e6aec909bfa86ab3c6e5af12a3

SHA512
eb084ab85a5fb2efd98f6b654527ebd2e68d409426f28d34e4a71e8705e70c18821ddee757e19c9228a7b5ba4eddb7908d8003faae1d093d5216fac20ae93240

Download Submit