7a02c5eb86106247a3e744caced3b621918e7033dcae40c8d4015d12e246abb7

Resubmissions

27-11-2024 19:28

241127-x639kasrgp 10

27-11-2024 19:28

241127-x6nh4swrcx 10

Analysis

max time kernel
14s
max time network
23s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
27-11-2024 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a02c5eb86106247a3e744caced3b621918e7033dcae40c8d4015d12e246abb7.apk
Size

3.8MB
MD5

0d5b966d999d4801bc81b225a29a2f31
SHA1

b338c125cfcb68e8aeb053d718488a7bf7de9e55
SHA256

7a02c5eb86106247a3e744caced3b621918e7033dcae40c8d4015d12e246abb7
SHA512

9f50d7c5858a1559102e2b764dd95cced75fecea8b5481d5eee9091aee773216d7c75e6286e2216b61b18cc9c24a4ce84b13f80081442ca425b68a9508026dc6
SSDEEP

98304:7oTwrHKDwj/yK2DM+F742qs7QOCbwQb0fES:aDwjo7NNCbPxS

Score

7^/10

banker collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

Processes:

com.errorforcode.netix

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.errorforcode.netix

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

Processes:

com.errorforcode.netix

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.errorforcode.netix

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

com.errorforcode.netix

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.errorforcode.netix

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

com.errorforcode.netix

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.errorforcode.netix

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.errorforcode.netix

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.errorforcode.netix

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

Processes:

com.errorforcode.netix

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.errorforcode.netix

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.errorforcode.netix

description	ioc	Process
File opened for read	/proc/meminfo	com.errorforcode.netix

com.errorforcode.netix
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5060

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events

Filesize
56KB

MD5
3f1f249788f84119f8332bd714e2d9ff

SHA1
09a1a1aedef5df9c233dfb877f6595f85ff96471

SHA256
89327ea54ca86926205063e6d42b668dde413cc0fcda281eef91cfa1a04d2ec8

SHA512
cca4cf8d3541bca2df773364ecf59058a7872492160b97b83b950ca91cb43f4b8b40b1583c04f0c10e0f95be897e2b05ce2542575994a9f783778dc0bdb3976b

Download Submit
/data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
0c217001a9d696ec12d5ea5c07c19573

SHA1
ecc946bd9dcd209ec0ca4fe3216a09b67d8f26ff

SHA256
52c99dd8b675518e7e19e13eeb1c0deb48beceb61bdde7927c2693b9c06f1a08

SHA512
dc435ef42f781ae35001b204364f5649935998e9a09c9bebd66b48e5dfd47d3a9ff63f9b6764fd292a983104c321f6b5b02b0981b168b49827a4e6278611267f

Download Submit
/data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
0b1e8407bd3572a216ef52bd195fc047

SHA1
c8311579bd481391eb448c75089fa836e479d75c

SHA256
5077734edc5d92fa3a35994beba9a6b55723409668d7303186fc0d3adbbea551

SHA512
b12691cdf33040248bf7a18b417c4a0c0ad4002a84040fba5826e5382fbf1f7646e16a39a5bfa7a1e2e55bdb90f515b037f561490b709dec0b47dd4937183837

Download Submit
/data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
9a06057db9bbdcc2d12c7bbdb7f2fc77

SHA1
c7dac0dd7f415e70a64602852d4e7b99aa43577b

SHA256
1200946fe00d1be33130c7088b0eb2c835a129c99d9662cdd3f78c7980a8d27c

SHA512
6a8977ffed9f2c9aee596241b46db4cd2059b2419f7a72b8f4a5175393b869e23e8fcbdbfcabe184909c53b605319124ba6e75f5375a126cc48b09f2f1351dc1

Download Submit
/data/data/com.errorforcode.netix/files/PersistedInstallation6890745291467462570tmp

Filesize
90B

MD5
4731f0565c3a863b9465cb91338053d2

SHA1
876676e0ee0dff88a8b74de9d9417a5cb1a69332

SHA256
3b96b46b892112c91223c640720ea67190b05f151e0e4024d53822fd4a004852

SHA512
207c9561fbb3a2b211b7885afa50d07d6fe741e3afc9e639e0142a69a76aeb945d43943cf6e513b64695bffafbe62e047e9643306ae681ce88ca1542c19172b3

Download Submit
/data/data/com.errorforcode.netix/files/profileInstalled

Filesize
24B

MD5
85b5fba05267c76e1807dbde9826c5a5

SHA1
c2384e39879fe1110858a3fb01e46a8f6a16c77b

SHA256
1f142c6d1d666726e8e3447fefa2827ab332fc4ebd630269451f49790c859af7

SHA512
36d1d2ec6367052bc27155755a0f6093882edb4df37566d72b50d04e742125bfbe702dfb2a926a72884e3106886e16907db4e0afae8d138d32a6845abe6557a5

Download Submit
/data/data/com.errorforcode.netix/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
639102b5c151df86a2915a129b12ca51

SHA1
e5f6f3b495157465bfd27fbf5128d98809764de3

SHA256
db6092f572fbb40cfdb95b23a80302d010d439288c2345d7cb9adf60ac300aef

SHA512
54f4b205c68bb0b4558facdfc993b5c2603d2b05041617946a55ee0e2fca6b72fcf7007530adce368da4c4c51f76c0402a8ff17e0b63b48c4d6f057f7e2a85be

Download Submit
/data/data/com.errorforcode.netix/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
54ce67e356e4a716806584388defb923

SHA1
55b3343c770a400e13d7eecf2dd9976e057ce81d

SHA256
05e107613c0e84bb290c1a9e94ae80c465f013ca255e897c9b6cd763c0bd0d5e

SHA512
1f8904b5cda5f95bdfdf0da80024b6475256087bfba5c119ed33c31fb21141830b040ec05ae8cbf8bc4133438381d580afa070aa7cf71edb569e9b59a36fab37

Download Submit
/data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
388debc0322b650e7065f4e893e90359

SHA1
f8bb050ec0cc168de9daa40e90a3e26b96bb8291

SHA256
ec5a04f51e2c4db946010d1494266a1f78bdcee8085294b3db8053feb965c006

SHA512
f8816bbd87693045b294ebc19247ee954a3fe15dd96d2b5b8babf15597780ee2361a30b181f22fd141ad51c28ef64aa8c0bc8345d4f121a45eadf11b36c60261

Download Submit
/data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-wal

Filesize
124KB

MD5
51b2880f28f76bfadd2ba8ebb1d42535

SHA1
d57d9eca5a7dd1eb072d36bf747dfefc65e6c682

SHA256
e5649834f8d204822d5ec436d6e7a19c2b7c8d397427ce04d2a29f1648a8a172

SHA512
3f7576fa2a75ff713109cadeb79c1c969e8a1d91b3d38ef5297f661e783308da1141bd22ceb84554561acb3ea0962dd8c213506ddb8ffeafff5ca2829e7024b6

Download Submit
/data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
61c4309ac4deba20d914a40045a19e35

SHA1
c78e97be9ca04bc58d8eaec0ec9ef532b231541c

SHA256
b8f411f5882099303dd212ee9d821a0b3a2c66c6453017a3b948caa63d75e589

SHA512
6ee081cf6579743bfe86bf52412a23a2e833444cd2e28cbbdf34a04a59d78b6e1a50c933262fc857fb54781de9ac37ec9c43e0a9eda9c583303db7c3b5d16269

Download Submit
/data/misc/profiles/cur/0/com.errorforcode.netix/primary.prof

Filesize
1KB

MD5
aaa163108a7e79ae66fa54fd6020ef07

SHA1
591d01a1bcf3f82617a682561b0ceceff7a444a3

SHA256
5d379e396d8f70b05e8df2c54b8520a466d5687f3b2272fca18bfcf4a2faad42

SHA512
27d176b516b4070f289645e351b4e9fbe66cc1e47199492ea3c1f1c17b70621b93b1c164d940851417e7eb5763ec5d8f4f1389f330d397712758bbff80746ab1

Download Submit