60b55876648845b67e3313ead3e3fe2cf9c4609a2c4a67cdb9df7dc210427055

Resubmissions

20/11/2024, 13:58

241120-q9xgvsxdlb 7

20/11/2024, 13:57

20/11/2024, 13:44

20/11/2024, 13:42

20/11/2024, 13:41

Analysis

max time kernel
47s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
20/11/2024, 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46c1dac6ab259c443ffb430d78f53227.apk
Size

21.7MB
MD5

46c1dac6ab259c443ffb430d78f53227
SHA1

a082164d3db681c426aceb32b1cf15cb7fdd805f
SHA256

60b55876648845b67e3313ead3e3fe2cf9c4609a2c4a67cdb9df7dc210427055
SHA512

e12bfeb3b18b4594b2d36f573e532514d5bd1b4dd036e3b990d2e17fb7d45d88042c5c9954f5c0cc9092b68aa6dd019f0996fe540b045b625777597da70fc05a
SSDEEP

393216:pW+zGWQytGXRiE8le7b7AgSBefOLUtLao500k6WH6ilM7UY2fw:pWuTQggIVleH7IYfBtn50RlM7UYow

Score

7^/10

evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4494	clmwq.ur8gc.r74yr
/system_ext/framework/androidx.window.sidecar.jar	4494	clmwq.ur8gc.r74yr
/data/user/0/clmwq.ur8gc.r74yr/cache/1	4494	clmwq.ur8gc.r74yr
/data/user/0/clmwq.ur8gc.r74yr/cache/1	4494	clmwq.ur8gc.r74yr
/data/user/0/clmwq.ur8gc.r74yr/cache/2	4494	clmwq.ur8gc.r74yr
/data/user/0/clmwq.ur8gc.r74yr/cache/2	4494	clmwq.ur8gc.r74yr

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	clmwq.ur8gc.r74yr

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	clmwq.ur8gc.r74yr

clmwq.ur8gc.r74yr
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4494

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact