63bad53659039536c1d85f16e0f8ce085416f0dc8d7144ef3114cb9412d63663

Analysis

max time kernel
125s
max time network
135s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
02-12-2024 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NMail2.apk
Size

18.7MB
MD5

13e0f639963d3e10913c0180a4362ffd
SHA1

560e1a2f49bf7536512e78471540f1fcda0f5886
SHA256

63bad53659039536c1d85f16e0f8ce085416f0dc8d7144ef3114cb9412d63663
SHA512

dac76ec3629dd1f01a79d1416defac227bd4a5ca20d87d73026d742e6565ba78a78180234bcbceb092485497fd08df0f29f2e0faf11a2bdea5fd46755935216f
SSDEEP

393216:sWrLalIIclUJotDckP4Z4LbSYpJCmp6zJp7SPA9qdsmOn:94pUOBKLc7zX1qCb

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.nhn.android.mail

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nhn.android.mail

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nhn.android.mail

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nhn.android.mail

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nhn.android.mail

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.nhn.android.mail

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nhn.android.mail

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.nhn.android.mail

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.nhn.android.mail

com.nhn.android.mail
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4261

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
891973545746a69f331fa5be26305a4d

SHA1
b78bfaeb4a44cd380fb54ae2d850c749df2a7472

SHA256
fe4beb8cdcee219cf622af9d16a1cd7e3d6380559fc174bdec5c61c109588a98

SHA512
ca52c8e223539d7d8bdd55ad93cd325a6a6d5ffd3bb01aed5cae242f37e2bd171bc7707de62e613f44ed4033430d1a38819ab7e43d8a1e44494576995ff337f5

Download Submit
/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-wal

Filesize
213KB

MD5
126a02b4586202c3f8092f817e9dd5fe

SHA1
e87247fd804a87b5055fa57e7aeba0b6621b4e5e

SHA256
54a7b1ff24d603adeae7b9e4ac15f453cad18ce425d08b2991c269b3a1592f25

SHA512
6fbfad55943b2c54d82ede9825e72f9781fb8701ac94e46faf2ab670d945fd847fcd0b875e76735c37efe7499bf608baf6cbc9237a8eb576bbe16a58cfe2cf59

Download Submit
/data/data/com.nhn.android.mail/databases/nelologdata-journal

Filesize
512B

MD5
5bdec3a53f2cb7548860c556b9799dfd

SHA1
2e5770bbf22debe2f5f45872e9903df871bdf7cb

SHA256
d957d6cd2137b30be952d29cfb1722e12355d8e1aa57cc216b523ad6839e7661

SHA512
6fe7672c94ae8fee0998729912d074e80e4973367f4d936e8351f0d68e2c530e7ada823cf0dacdfa564c576814a1f4875052fb37c0402dc802c5543d14fe4225

Download Submit
/data/data/com.nhn.android.mail/databases/nelologdata-wal

Filesize
56KB

MD5
0979bc0b8e91272593a1c3c885a7f8d9

SHA1
1d504273a95887520b542059b568de86599fa08e

SHA256
09c6ab392551b20f88dd9c597586fc6f8cd9eedb07836b679466a1c733d2460e

SHA512
a9e90509713d7c08725a0079efb8de16efd0f1ecb31124ac6cc7a64243fa426c5fa2de0e28e4e7482457f6202db8881846f1a9ad80190eef3739e2063b2cd41c

Download Submit
/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

Filesize
512B

MD5
a3d0b93c19f80b8df8cf280eb7ba441f

SHA1
0fcab7dae11200448d5d9c62c328baaa12f0bcac

SHA256
8f21988e953e9c3b613cd654ef105509b48f0dac119deac72696745fe5c73501

SHA512
f8e0552ebf505d20d4f2bd8881cde66c11f1a5aca653634ac43823c6d0370d1c2be4d9ac216fadc6629bb427f1074d9f42196d8948ac4983decc4fb81912b222

Download Submit
/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-wal

Filesize
52KB

MD5
eae12d2e4d6424fb0654243310ce40f2

SHA1
89d77707d67e70508e58db4771a7af44ce258ae0

SHA256
fa3f54f30fffd41cc8de6550e85831681bdeaf5ea5c60997dbb48e1743ecdd64

SHA512
bc8e20f483a3bdbd94bb98d9f64b5ee3adeae753dfc106a3311761bea692ac97d350bde87a49d9aa2b06a436daf1ef9b7e1f4ddb837f9d8e090842795f1d6cdf

Download Submit
/data/data/com.nhn.android.mail/files/PersistedInstallation2165083206412007299tmp

Filesize
559B

MD5
d5037bd1b41159537c508e390e41d6d2

SHA1
7da008f42a9618600d6b20af5fe87793743c3b5e

SHA256
c3364cec22521520b0dc8395f70c8cfb131f73ae0941c0cb105a9b42f9ecec11

SHA512
962756e97d36de73018ba753e74f091e48dde6c9265dd6e01f3f68f9ad54b1d22976d5abf17f37cc0166de728dcce33c1e9737980b15c78ee2539586dfb52fbe

Download Submit
/data/data/com.nhn.android.mail/files/PersistedInstallation3731533823370437476tmp

Filesize
90B

MD5
493fd98029d36ff75ce822b6019f3eda

SHA1
d2651e22ba8e604ca903c01690362e42930fab5a

SHA256
d0ac19408e18860b20d735ab40a6ed6b5f97fd7d1ef4fef85f859947d08ee219

SHA512
4b7629b148b12c05535726fe09f842401a7e26f636b33a5af6019b98d734c29926776f57d3e2a2097499eecb786a362316b750934e15347906b356c72b3198b9

Download Submit
/data/data/com.nhn.android.mail/files/frc_1:129436326568:android:3fb259f21ca1e06e_fireperf_fetch.json

Filesize
1KB

MD5
159daa1bacad77283b2d1217352ae70c

SHA1
4336a7e9647007e925ea49bf8fa4790aba2b001c

SHA256
1ef44c07b5f93c2f3691f859a45cafe588088c88f01a11f8a1089593ded14009

SHA512
959c9984796016516c2cbbd64974968c36d49b364c9b0db054c466c54b9c0880ca183d3b4fde65b8424583ba4c9d50478007f4a9230870586be16b0d0cc5a47c

Download Submit
/data/data/com.nhn.android.mail/files/nelo2_app_version_N2JmY2QxNTc3ZDE4NGViMmExZThjOTdhODE3ZGE5OTA=.id_v2

Filesize
78B

MD5
7c3e5d48b3b9a267165b196a1c3398da

SHA1
3684897cf3286f19885b96c5ad6a1440b790282e

SHA256
363c31b308d29270ad393d0e12fb523725722059e215a66e55b43c86bbe2c3db

SHA512
8891f068890ea900401b1b01dcd61424a9c3667007b69b7804dd1bf6bf6d0f67d9a7086db3b67b6840fdef8d1623630ab18d4c697ef78e63242f59ab5d39a96e

Download Submit
/data/data/com.nhn.android.mail/files/nelo2_install.id_v2

Filesize
108B

MD5
fe906f154e1c62500763d438c343bba9

SHA1
1bd6814adf36224ea5b75618f0a34d5572231138

SHA256
03676bcc2dbae8cbbfca4d5a22881606c34ce2a33d1d0391d1978bb5d7212bc6

SHA512
269434ada286221bc6392f833f44435e37b6c221f62b35dc694e280edd78304f796a696e2e10d78dfedb992cf8de772410fc9f6cc9a0922a23000e621e162569

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads