Resubmissions

27-11-2024 19:28

241127-x639kasrgp 10

27-11-2024 19:28

241127-x6nh4swrcx 10

Analysis

  • max time kernel
    5s
  • max time network
    27s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    27-11-2024 19:28

General

  • Target

    7a02c5eb86106247a3e744caced3b621918e7033dcae40c8d4015d12e246abb7.apk

  • Size

    3.8MB

  • MD5

    0d5b966d999d4801bc81b225a29a2f31

  • SHA1

    b338c125cfcb68e8aeb053d718488a7bf7de9e55

  • SHA256

    7a02c5eb86106247a3e744caced3b621918e7033dcae40c8d4015d12e246abb7

  • SHA512

    9f50d7c5858a1559102e2b764dd95cced75fecea8b5481d5eee9091aee773216d7c75e6286e2216b61b18cc9c24a4ce84b13f80081442ca425b68a9508026dc6

  • SSDEEP

    98304:7oTwrHKDwj/yK2DM+F742qs7QOCbwQb0fES:aDwjo7NNCbPxS

Malware Config

Signatures

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.errorforcode.netix
    1⤵
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4925

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events

    Filesize

    56KB

    MD5

    f7f120e0885aaf8f8162d5aad64fc401

    SHA1

    f20bb12dd99ec0547c036ffb7afb5e5cfa5c225c

    SHA256

    465a783455182e02070d2eb9b1a8de7a97696d3ee7a8fa9348e1148e8810450d

    SHA512

    dc3c499662a08303f30e0084939e36f90fa3ea0aca12ce0c2104fb4e68fc88a143e012cf051b62468e616dd85c354f7e412303bceeabcac833251aca58d2e4c4

  • /data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    df72a8bd4ea2296b4c85d6553ccf0fb8

    SHA1

    2dc7c581371fe7176227b0eac78bbc5c2c06c024

    SHA256

    89571fbec418fd14cf76a8886b3c6055fcbc9df100b5cfbc567890ee958afb50

    SHA512

    bef308b13358d38ddc991b3f70c6fc66030933dc6f8d05cb6131b884111c0f7377df0b55763596eddc9912b34c9312312948a187f42b3b8647bebdda3d4596bd

  • /data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    3d7e7e163cef8c5e45a2a86f944ee5a5

    SHA1

    a6ff7d2972cbcca609402733805bde740360ce9c

    SHA256

    978232583f105e3a3281af769922d1f302e0504d2811c759a507b8aba1b4c15a

    SHA512

    5eafc1c1036b3b3286ca7b6af5d1f627ae9a2e72acc8876341dba214f9682226a0f64b77ff5c53d3c4a971a2d75e9d1d13aab479685d108f29202d39e763fda4

  • /data/data/com.errorforcode.netix/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    352f0bff2e0950b65a3aafbd51527ba3

    SHA1

    a1cf4468441bdc5659f3eac85094f77dbb4ef7e6

    SHA256

    ca5bde6d01e0c0bd3f7a1f1f24c5efbeb7a27732b18ca6f653fbef03f479883d

    SHA512

    3d1a4ae3730aa253d3883e5d022d1ea79faf94c536fc85dd791cea4ee9da8463a91ad002c0b80646a7686b91f4075296c80a48a8d3f7e5a9babd4225b4f2ba3e

  • /data/data/com.errorforcode.netix/files/PersistedInstallation403619862343327642tmp

    Filesize

    90B

    MD5

    8deeb13ecb009a73207f2b9977704558

    SHA1

    9379064468611f564577518963fd6af89931f585

    SHA256

    364eb1523a31a817933a40542ad109364a6f78441eee61a7032fd35bf89703de

    SHA512

    91901c74febfb3ab87909ef437da90463617d44aaed4b59f8d347c2d3b32e3731708c5877768b9c9cf10ebc99b6d6d068fcc343ec8009afee1e1b65ab53d0e8d

  • /data/data/com.errorforcode.netix/files/PersistedInstallation5047021169486638484tmp

    Filesize

    569B

    MD5

    88b679bddc413c3880823c8332c3152f

    SHA1

    07ea7bc2442e776e19652ebbe0305a5a167a0a35

    SHA256

    ca67448a2267c88907771bfdfe3e9c3e2d4376697432568bd847b2565e85819f

    SHA512

    1ce01263157491660b5ef0fc971e2087d00a03968ea68052e37cdcf0bfb196723585f4acb711b9843186dbe96fc24fc35c6afcfbc56fb59f0721206a6b2e4acd

  • /data/data/com.errorforcode.netix/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    96486e709ce694820d256fa8e2118a41

    SHA1

    c5ad6add50d44f789528e5fc93fb12ab195c5c9c

    SHA256

    613713bf1312f5920763ef1c22ec42d413a94675a67407ae185a70c37884d4e1

    SHA512

    631d192bcaa17e06b67ac9a33711ccfe402d6f9fb81a5cc23049ba8f9427eb95b3633498b908c7e31333b841464cbf710fb9e284a0d21513ae2787b460aff4bc

  • /data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-wal

    Filesize

    116KB

    MD5

    7b1d64c77c48a692ac4303f14ff47c04

    SHA1

    cb76aa3e70d2014ff9fd8cda0ed80aa5e2a939c3

    SHA256

    2d40c2cfe7d7fcef36b2d636e824d57e610f0c489c2515316ef967f08c95c3a2

    SHA512

    cc79d69c63ac2293a047a8f7503ca6cf31eb9b65c7ea22a1e3c4896291aa10cdb3362217cdaaccf3f54ceebeade9b9cf12e7c3ed11d748673df16e7c95eb4568

  • /data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-wal

    Filesize

    124KB

    MD5

    04e82ae517755d8b10df8f50be4e7a66

    SHA1

    32c831e4ab087fbb0dc3babcb0b7293d17a486c9

    SHA256

    34742a979ec2293465f26bbb903c0223d1b0711feead5a1d450ded7b2fc2862e

    SHA512

    e4a680783c567dbff224961372ca45dd3ca3d1d43a6438c84370828d61e7458c94e120222ca23906ee751b5767fab896d4a1872ccdf358ddb6282c747b5a9def

  • /data/data/com.errorforcode.netix/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    a9c7781696e6ca8a1786114d66a0ca9b

    SHA1

    9cb955781c75abcad30d599b5b34f1c07e4cd429

    SHA256

    56b455e97bcd24e9c691ec2f0b55d3a0453f57223ac2e2e5b00254969f192abf

    SHA512

    1ad436520ad5fb1201fac3232293fac8eecf96e21ce0bb47f4f62514cb0ae884410a152033b5946a042a77a2b328892d9a93aaa4e0d9ad0d8edcc447cfd06c7b