92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
17s
max time network
157s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
27/11/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample241127-c3c8rasmhv
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.systemservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.systemservice

com.systemservice
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5051

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 8bb784108884de25eec01d99097067ef004a10d3e0f7e119b54c70e55926d1b3
MD5 0a33b8af0d7e9d406b56f9e3cd4e495a
SHA1 3c72f1b3c066e455124d14d4f9f722fabe9df1a2
SHA512 0087a23e5a70839fdd328cc498808268a32bd2c63b581a71b9b5ff93e47a84c41f30624d2814cf33fe242a41b32aefd4dc4768d02047800a515302571eafaf20
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSc:8MEX0wIyNjac
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 5602b57614d344e1a173a334bf2597f8aaa0cded6d63424833315c3bf07d4ad1
MD5 2cd331a8c630e07732bc7b779f0e635a
SHA1 ec79ecdbd9c05f9501fbde4e42413114307c49db
SHA512 14a682be1de433fe89842b6826f9e31eaa6c1a9edfb1ced242a247f41626a9f5be5a910bb445a72a3b925c8b3d49904a6ab4a87e5380911e4a8617b466472534
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 fb3ff06af15e6ba06a206f2eda6c29411ebc45a3d55c822c5e257b530286b506
MD5 31cb09983ead3e6c1499924f624c3938
SHA1 f7a2fbb90daf7c79298ef2f36d48404f55608946
SHA512 b879397504dcc890b1e107fa014720d3895861a07eb0a59bf9dcdd28b5f01c9586314a82b1f5290c1f4d9aad4b546daccd50baaa277baa7a3ba1efeeec4481b1
SSDEEP 6:7+/l9hQGn1Cpg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK6Q:7+t0DpqLiuWdwRmBEyPbLQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 0c7c26b150227f6117d82fba9eb765a31ee114d33591f723c060d60044971bb9
MD5 4d802eec422b3a12b93a1c16c0ab6b82
SHA1 e96f3539c8dc7c5f68d0a14369f8a6310f7597db
SHA512 2bb819a2f3d225bd7f2bec831468d876fa43bf6538fd83135cf83fcec1827665491c4cb9459710b7547773a066a7953a6ba67c7018c7e3460865c2a0d925ac8b
SSDEEP 6:7+/l9JAtgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKntM/m:7+t84qLJdTRmBEyPbksm
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download