63bad53659039536c1d85f16e0f8ce085416f0dc8d7144ef3114cb9412d63663

Analysis

max time kernel
26s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
02-12-2024 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NMail2.apk
Size

18.7MB
MD5

13e0f639963d3e10913c0180a4362ffd
SHA1

560e1a2f49bf7536512e78471540f1fcda0f5886
SHA256

63bad53659039536c1d85f16e0f8ce085416f0dc8d7144ef3114cb9412d63663
SHA512

dac76ec3629dd1f01a79d1416defac227bd4a5ca20d87d73026d742e6565ba78a78180234bcbceb092485497fd08df0f29f2e0faf11a2bdea5fd46755935216f
SSDEEP

393216:sWrLalIIclUJotDckP4Z4LbSYpJCmp6zJp7SPA9qdsmOn:94pUOBKLc7zX1qCb

Score

8^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.nhn.android.mail

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nhn.android.mail

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nhn.android.mail

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nhn.android.mail

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nhn.android.mail

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nhn.android.mail

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.nhn.android.mail

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nhn.android.mail

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.nhn.android.mail

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.nhn.android.mail

com.nhn.android.mail
1⤵
- Checks if the Android device is rooted.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4259

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
c129ecd5a23cff4601fa106d0cc461ea

SHA1
ed39c52d064182bb4b1e229eb3cc996d0141389f

SHA256
948add622517dce20c586e7321e1f6ba4730b61e2c0c45b8766d8ab99710f5f2

SHA512
e29e1462bd54c343b6e0e9c37020d45bb8b4bdbdb599b66af343c6f88e164910035915788e558121d37f88e247f17fdbaacfadd175b9689e85cc138052d81951

Download Submit
/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-wal

Filesize
124KB

MD5
8f4bdc58934e732534077f0e8432241d

SHA1
0289b39566c0f5a9e967ba43aff3651853846c22

SHA256
a0fffb179fccf78341a5ea575afa9195f859c31011c14f40b15cf18b9520ddc7

SHA512
ddee4541336376c713455a4b83db44877bbd6d7f794d2c71764ff60f50b385ecd0de95d43f534ba5e8a3caaac908961db28cff74de667313e572a55d46cd8629

Download Submit
/data/data/com.nhn.android.mail/databases/nelologdata-journal

Filesize
512B

MD5
ffe40b4b04804242e9739d58fc6099b6

SHA1
defa47877162748221b75b6dc4513edc32e82b35

SHA256
e13c90814bc53a4809af59b077d459d266e277625b75980624c3a253fe07768f

SHA512
579c3bb955e9a01bc491e221521c0148bf21681bc280e8d8c0ca36511aa217fa00fad878660ea34c9d051f287cc8f83f8ec732e1010e4cd23e41b1170cdd9b45

Download Submit
/data/data/com.nhn.android.mail/databases/nelologdata-wal

Filesize
96KB

MD5
5f9cdbe8be277f543ee193c6c466b650

SHA1
3a6bd973fdd0fd2d0e5076865d3b2ffebb0697f1

SHA256
a5e8c013d92fa28fa63647d9dd16229dfd01dbd33687369f5b4d9cb80c542adf

SHA512
09949b68acd8e23ddf3c53debb2a10a79284fde2ea67b9e72ef346f36eef475e342d3281ed431e5ac01a18c0d783b5935fd8eb97e8bb52e0ab1179f53f71dff2

Download Submit
/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

Filesize
512B

MD5
a117e95983d6d4090fabb80e16cadc30

SHA1
473206af0ec1366ea396135d25c82e1b9dd1c5e4

SHA256
2ef982abd15a34915dd525052300c160a8399c81ae0398c2c3f5f3afe1fa94fb

SHA512
9ad1bdd4103378fec10d3f1bb8813f397d67fe254c297daea526711558a577f18a0d9382e332ce7f559fd72aa2f1168cd75512573dd49a0dfec0c19a36e10eb3

Download Submit
/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-wal

Filesize
52KB

MD5
cf09b23d556d5a4edb86bd5a8860e356

SHA1
6c81b33e6da869646d34cac4ad7b544b70bcc618

SHA256
c1c6748eb941354f5ce6f34d478c8c23b38f5283a9fc5f7effbf9990db018838

SHA512
d4b74e115cc789f395862561cf48e9d9c75d3dd9531be668106a0957dd0fd87b0eb0e9cd88f36abac397353081c49dd62616f5d3c4a984fb54fcb3c6652ee539

Download Submit
/data/data/com.nhn.android.mail/files/KeyLog.txt

Filesize
74B

MD5
97bc1e5a47d44e398bf9a3f1e38c1bb4

SHA1
2d90184bccc8781fb6e11264c4f3fb8ce4a2ab47

SHA256
f3a2228ea3eb9d99132635a29b27863dba3829440c87123ce27e9f445258d93b

SHA512
ff9fb91621ee06ab4121bf47be6138a19182da981b0ebe79f70c1bc5b354d9035ff4d4045e3695203b52ec6ae36490535e25474d7ec46fddd8db4c16e92a6df3

Download Submit
/data/data/com.nhn.android.mail/files/PersistedInstallation2905794492658697639tmp

Filesize
561B

MD5
658ca332bba48be799a248e642d37663

SHA1
364b9cb1d0558082b9d6f30453b1a3b330632d0a

SHA256
110c218a2ee30471b9ba6ba49a5a487adf3cecac657365981598e8541bc5bd27

SHA512
e19a4a566d3a6846aabb0c7da9342db6d74823f54bb64ce7f79fffa6eae87ddc40eb0e36b33fbb5e62703cf60e5a44e260b876e83594b19dd9180606c54e9a32

Download Submit
/data/data/com.nhn.android.mail/files/PersistedInstallation67889741637749492tmp

Filesize
90B

MD5
1a7d0c8bf3690d3362a7be1e44db85f8

SHA1
8a608864e20cb946d26f68f57cff287ef5cb2e7d

SHA256
047e6ec972358ab838a999933f76c8e160c05cb3a19dee357b0a9e9dc02c04dc

SHA512
59939acdf6161b6b951bff8fff7f88a9472ae76eb42b018a3cc19b083410ce7d1eb472ce281ce5cb2678694c07c9b5079111ffbf3ee9c515916ad742947c17d3

Download Submit
/data/data/com.nhn.android.mail/files/nelo2_app_version_N2JmY2QxNTc3ZDE4NGViMmExZThjOTdhODE3ZGE5OTA=.id_v2

Filesize
78B

MD5
1981f43a95da2edd63c37adec2eba4f9

SHA1
fcc74084dbc43d0236a40ea873bb395f6f22aa1a

SHA256
429b47a7d64d32ce8c93fd47cff30ae5044f9bf4e2c9cafdcb4cce95f62cd394

SHA512
bcf61bb81d2f273a3eadbc9801b3027ea28c202e16bf1f8f3f58e8ca1ee52e409e08ea843b734d2e44308528cf28644ccb5c24339e8bc332562faac54ca521eb

Download Submit
/data/data/com.nhn.android.mail/files/nelo2_install.id_v2

Filesize
108B

MD5
7512e3a14502ef37ee9d2e360407deea

SHA1
3f6bbe75561e99a09247cad10dfabe261a7bce85

SHA256
6add396b2e6c06d10493b07f731f0c78c0e05210878cc52befcd1e38bd9c1778

SHA512
cba2c453bea33a328dde406a1db20b770edae9b86fc6b55a7d336d92b26687012cbac955e1678e7a86500656ed4fb4cfdb8eac1fb7615646fd796d1642eba54c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads