7a02c5eb86106247a3e744caced3b621918e7033dcae40c8d4015d12e246abb7

Resubmissions

27-11-2024 19:28

241127-x639kasrgp 10

27-11-2024 19:28

241127-x6nh4swrcx 10

Analysis

max time kernel
11s
max time network
15s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
27-11-2024 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a02c5eb86106247a3e744caced3b621918e7033dcae40c8d4015d12e246abb7.apk
Size

3.8MB
MD5

0d5b966d999d4801bc81b225a29a2f31
SHA1

b338c125cfcb68e8aeb053d718488a7bf7de9e55
SHA256

7a02c5eb86106247a3e744caced3b621918e7033dcae40c8d4015d12e246abb7
SHA512

9f50d7c5858a1559102e2b764dd95cced75fecea8b5481d5eee9091aee773216d7c75e6286e2216b61b18cc9c24a4ce84b13f80081442ca425b68a9508026dc6
SSDEEP

98304:7oTwrHKDwj/yK2DM+F742qs7QOCbwQb0fES:aDwjo7NNCbPxS

Score

7^/10

banker discovery impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

Processes:

com.errorforcode.netix

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.errorforcode.netix

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

com.errorforcode.netix

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.errorforcode.netix

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

com.errorforcode.netix

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.errorforcode.netix

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.errorforcode.netix

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.errorforcode.netix

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

Processes:

com.errorforcode.netix

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.errorforcode.netix

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.errorforcode.netix

description	ioc	Process
File opened for read	/proc/meminfo	com.errorforcode.netix

com.errorforcode.netix
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4252

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
891e15483aee622ffa7d4000a3ffbefd

SHA1
8a8c4a5ea6a6b6be436022271b13ef1ea9c340e9

SHA256
127f00601b17330fea1702b80e35a11773febe0e9b00b5aba0934b28442a6626

SHA512
9ca23522f8fd9ec81ca28e4901ff45f708f251c30280d0a792c676908ef6fc8f3cfa40aebc506c47d5b435dc52f7fbedfd5e3c9101ca097925b8192f501c05b5

Download Submit
/data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
6f58157ecc700dda1d2db35cdc39f52c

SHA1
e8b7b927acf08464cb09cac7f06cdc5d899f3d7e

SHA256
16bc8a4dd65f05ddc9e50ef5efafe3b9e0bdfe5d11c412cce7da51f67499d946

SHA512
2696619217a6ebe9ba0b3a1b6bd7620656ee7cbef7d23182cd69c4be9141b21e2b5b0d43e60123a0e0947cc0528b540d2a74e011381b22ad4cd8a84875af4050

Download Submit
/data/data/com.errorforcode.netix/files/PersistedInstallation7183234945374604817tmp

Filesize
90B

MD5
7101dede0a231a967d1fbf635055d823

SHA1
a8a2ffdf54a832208d85249060c647a07bd2f7d2

SHA256
40457f2166f3b75321f9ecff8253434ff831844d49c647c659f393d681657975

SHA512
b0061df1e061005f7721916b381a2248f66f4c5dbf892a4932862833ccd25779dadc92e6969fa52788379245991f0baa3aebe5c77229430bf5bc47998b826f4b

Download Submit
/data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
8c416532c19886852fe457a383201e4a

SHA1
3dfd8969406e2285d4716ab90456d2394e068ce5

SHA256
3b29ee1eabac9bf994961d31d40ce9346c20572efd08e4d4d48d16c251a849a4

SHA512
28e2dcd53217382a662836b647b9440e189efd9f1c43b934ac960da55a7bd773a1da0ff48d5f5bf2af617fcdee9bdf09d4b70be0b9993bf45220caa69c85fb0f

Download Submit
/data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
3990842e2637b61ccc5d56e3020b48fe

SHA1
bcf648d237fb742debc0d8cc1d3f1b614965832c

SHA256
08057a2339252151383cc551ce897ff4bd97c63a0a687c2debc798240e8d4a2a

SHA512
92d9945dd0ddc863c07de3dbd84c88dd3d9c70e31495cbd8855072a9d42f72cffffeafbd00c210ef840bc62120801360ab750331efad233c90955f715fa7a16d

Download Submit
/data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
82c5715b2d91048a2b792a9d98ffcf41

SHA1
127d67b75cc2da8e71827110c7c5dfa06c1e3d2f

SHA256
2dbc7f7e63f8dfe567d74b0b347234e7f19a452e2d0ffecd1af205684e4cdaed

SHA512
336d1a5e9bd2bb284ba66586813c4e0d1e07181dc496f6f5faf0db33edec507333527a1a758f08c1a0e24ad03e2755c189cec642e62bac7c4f4a795a253b8eaa

Download Submit
/data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-wal

Filesize
124KB

MD5
2fc3586ae6e4dc2217ae2e03e42a7018

SHA1
0df28664d609956cc06a20e4b27cca3995e03c02

SHA256
675e70727b67a8b5fb97f917604d3e968e3ef0156a459e53e62c20b1adb115f0

SHA512
10ba1a105cc896d1691dcce8a5926c9968189afab30a648cd88d04aa4d58a15d6fd3d53f8f4927ff9bbf006d7da69b8a5590f58130d26c59a6e95473807c2083

Download Submit