60b55876648845b67e3313ead3e3fe2cf9c4609a2c4a67cdb9df7dc210427055

Resubmissions

20/11/2024, 13:58

241120-q9xgvsxdlb 7

20/11/2024, 13:57

20/11/2024, 13:44

20/11/2024, 13:42

20/11/2024, 13:41

Analysis

max time kernel
23s
max time network
31s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
20/11/2024, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46c1dac6ab259c443ffb430d78f53227.apk
Size

21.7MB
MD5

46c1dac6ab259c443ffb430d78f53227
SHA1

a082164d3db681c426aceb32b1cf15cb7fdd805f
SHA256

60b55876648845b67e3313ead3e3fe2cf9c4609a2c4a67cdb9df7dc210427055
SHA512

e12bfeb3b18b4594b2d36f573e532514d5bd1b4dd036e3b990d2e17fb7d45d88042c5c9954f5c0cc9092b68aa6dd019f0996fe540b045b625777597da70fc05a
SSDEEP

393216:pW+zGWQytGXRiE8le7b7AgSBefOLUtLao500k6WH6ilM7UY2fw:pWuTQggIVleH7IYfBtn50RlM7UYow

Score

7^/10

evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4351	clmwq.ur8gc.r74yr
/system_ext/framework/androidx.window.extensions.jar	4351	clmwq.ur8gc.r74yr
/system_ext/framework/androidx.window.sidecar.jar	4351	clmwq.ur8gc.r74yr
/system_ext/framework/androidx.window.sidecar.jar	4351	clmwq.ur8gc.r74yr
/data/user/0/clmwq.ur8gc.r74yr/cache/1	4351	clmwq.ur8gc.r74yr
/data/user/0/clmwq.ur8gc.r74yr/cache/2	4351	clmwq.ur8gc.r74yr

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	clmwq.ur8gc.r74yr

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	clmwq.ur8gc.r74yr

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	clmwq.ur8gc.r74yr

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	clmwq.ur8gc.r74yr

clmwq.ur8gc.r74yr
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4351

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/clmwq.ur8gc.r74yr/cache/1

Filesize
2.8MB

MD5
97d99fe21968f56a1f4153b8cdfb927e

SHA1
c825646f6d8e27356dbe674358b730a4a3b2e7f8

SHA256
4bbdb130d1a757de25bff107b7ef6cf71587d85f0b54257867ace449ba3ca37d

SHA512
02cadcfde1ac3538b432bddbee11b093c307808526aeddac79266106cd8bb578d7de5b8a205f8c28cda815a27a6385991d3e884a5a57cb8660f219f8556046c2

Download Submit
/data/data/clmwq.ur8gc.r74yr/cache/2

Filesize
1.0MB

MD5
53e0bf87a52283164069cb981b6caf59

SHA1
5e6dadaf661ce96ed5a5a1ac6681405d3daa55db

SHA256
f2ad59fcd13944ff603a4fe383b89a8d8702771faf716058fcce63b14ccb3e21

SHA512
fdec4ea15eed78203633392c7d42ccf560f60147f58be6a7f2bdaf4919c7f829234a56c0ccecf52ae8454ce5224fe23e3a17708b072fb391566354e90e018d1f

Download Submit
/data/data/clmwq.ur8gc.r74yr/files/profileInstalled

Filesize
24B

MD5
85995f70c5b8b00109276799e75d15de

SHA1
a69e1b3f34d50d44f7bbb8e54cc7c9300b01bab6

SHA256
3c5962fed7b68a4ee7f4725854e3879bed38b815390386c642f9a45413841260

SHA512
2c600f951314cc510947fc8e98c109c983738606af4294be1e43e216ccafd4920b9becca364895f15b202d3f383f98ae8987a88b7284c789c580c00116ea0492

Download Submit
/data/data/clmwq.ur8gc.r74yr/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
d9110a01ff63345f3efc16aec21ef28a

SHA1
1f842fe0e31bfc91dd25b7ed8983a072e2527a8c

SHA256
3cf815ef6c7055e57291ccc114291f13d79b8bd7e892bed0784d770c562fe73f

SHA512
6940fde777e04ea984423bdd88c813e6c63740007ecdb7e764cf95ef10d85a646c758caa409c76907e2dd3dc9b938cae1a18eca3e12c615a4b3f8a3a650de9c3

Download Submit
/data/misc/profiles/cur/0/clmwq.ur8gc.r74yr/primary.prof

Filesize
433B

MD5
1a6148802263b027b0a506816fe8c33a

SHA1
17743a6fe6751aa75541dcaa11a53330294e7879

SHA256
96b41c4377152289b9dbbcdabdde3c14f2e55efb7bf89c473053fb699c02c2d1

SHA512
48b2d4da400321dfac3b16449ba15b364f61a2178b7bc4cd5e82091d563ecfcba1eda685a4c1ab9e631218f945beb91fb626d19d15dae08cc9b57f0efe5b0359

Download Submit
/system_ext/framework/androidx.window.extensions.jar

Filesize
123KB

MD5
3056e1bdb7d4e19789d0319eff484bd0

SHA1
6791ae47aa9466fe0bca27ad6643f846853bbee4

SHA256
8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0

SHA512
c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658

Download Submit
/system_ext/framework/androidx.window.sidecar.jar

Filesize
25KB

MD5
29469324e59dfcc052f24b5af4e7b2c4

SHA1
10c1e17ac6f598037bb51baa07945663645de4eb

SHA256
9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a

SHA512
5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads