Analysis

  • max time kernel
    2s
  • max time network
    36s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    23-11-2024 06:45

General

  • Target

    swing-vpn-1-8-4-b.apk

  • Size

    32.5MB

  • MD5

    6260162e5545322ba450788944f7b1fd

  • SHA1

    9a238ee00c5d1cbdf2901695ea81851def867379

  • SHA256

    36051110eb4445ce46aa12f66b958c18a34b4897584210c398d7aa89f7c33fa4

  • SHA512

    5de3b223ba4e612874be013c7fef20af59d3811837ef51de9b7868eec9833d429c3434d9d02a587057066c8454319c90a11db5111f776723cc892b7211778f7c

  • SSDEEP

    786432:rqE4yl9X0pf5+8JDyEZFdVsao4ZxVUeM9ur+HsOQX7lsU5I3XA:rqrI6fM8JDyEndeafzUKr+HiLld58XA

Malware Config

Signatures

  • Queries information about active data network 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.switchvpn.app
    1⤵
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4263

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.switchvpn.app/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.switchvpn.app/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    67d2d97005c5972580d996e9984d4cc1

    SHA1

    42b6644b57987123090c932904cdc7db01f11e69

    SHA256

    47849374380f3ab5732f4ca565281bcd6aab9fd021cadc092fe86d99a128ab88

    SHA512

    f86fde2460172cbdd9f7fae33c4e5ff9835f93e91e69b55fe86fb35829652ff4ab664e92a0be66e6d1557336aa66817376165a560ebbd79978ef862fddf9cb75

  • /data/data/com.switchvpn.app/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    a2784d2275eb009f170ef5146a574ccd

    SHA1

    a3138f88faf05e9dd37e7aed6d2ead10bc2c9d48

    SHA256

    268ece0754f74865702ad8979223993ce0c564fa6b28c741edcc35401afdce67

    SHA512

    8faaffefcbbcc8f44bc89f6544a6aad27c2ac06969a32977be96d3dff7013dba92d6f38cd4bdcbdf58aa5d89add2653448c658fa93bafa7db18d8664988c88f0