012074928e648f6c483a450d1365c19bf353d8a15ff5968320a2363ce552cc65

Analysis

max time kernel
67s
max time network
82s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
23-11-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

com.melonloader.installer_signed.apk
Size

97.2MB
MD5

f5042248585a7627d2aee4cdbe3cceb7
SHA1

cc112baa4e68132cf945cbd43a3e7f04dd1183f9
SHA256

012074928e648f6c483a450d1365c19bf353d8a15ff5968320a2363ce552cc65
SHA512

ed4700c71ece60f338cde7ad5c874f5dd7d6ce6f5ddc1a69668a4418532b4e5e0f406e3757707d5fab78b3ad0f2fbed22cc81afb010ac92e0667f7101108c4fa
SSDEEP

786432:f6HJbuUWws9JG6y4zdNX163IF6wCqfO/jFQ4ewas29Mm8:aJjWNdyMQ3IHpfO/jleg29C

Score

7^/10

banker discovery evasion persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

evasion

Code Signing Policy Modification

T1632.001

Processes:

com.melonloader.installer

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.melonloader.installer

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.melonloader.installer

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.melonloader.installer

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.melonloader.installer

description	ioc	Process
File opened for read	/proc/cpuinfo	com.melonloader.installer

com.melonloader.installer
1⤵
- Requests allowing to install additional applications from unknown sources.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4223

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.melonloader.installer/files/profileInstalled

Filesize
24B

MD5
a3a04cc4077c5056ad2f945609be8099

SHA1
1bffa4d9cc7c5d5a7f7e8c2e280d9b07bba86c05

SHA256
0809ef369624b82983f4a2ee148ba991f4ccbea4da3a49ce188155854f4f74e8

SHA512
f3c8767c7d17c9947d63bd3e638bf9e9be1ed7494f2d2777745f0e8c3625315dd97dcdd89fb012423dddb480d93370745f29ed3a01f3d4bda0066c715ce58426

Download Submit