63bad53659039536c1d85f16e0f8ce085416f0dc8d7144ef3114cb9412d63663

Analysis

max time kernel
125s
max time network
135s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
03-12-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63bad53659039536c1d85f16e0f8ce085416f0dc8d7144ef3114cb9412d63663.apk
Size

18.7MB
MD5

13e0f639963d3e10913c0180a4362ffd
SHA1

560e1a2f49bf7536512e78471540f1fcda0f5886
SHA256

63bad53659039536c1d85f16e0f8ce085416f0dc8d7144ef3114cb9412d63663
SHA512

dac76ec3629dd1f01a79d1416defac227bd4a5ca20d87d73026d742e6565ba78a78180234bcbceb092485497fd08df0f29f2e0faf11a2bdea5fd46755935216f
SSDEEP

393216:sWrLalIIclUJotDckP4Z4LbSYpJCmp6zJp7SPA9qdsmOn:94pUOBKLc7zX1qCb

Score

8^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.nhn.android.mail

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nhn.android.mail

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nhn.android.mail

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nhn.android.mail

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nhn.android.mail

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.nhn.android.mail

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nhn.android.mail

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.nhn.android.mail

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.nhn.android.mail

com.nhn.android.mail
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4271

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
814d63eeec5d4b62eb8fb6b9aee3847b

SHA1
8c556a47b7ab712db6f3ccaeac010e67b8a4b638

SHA256
5537edb8db18e3e2a7afa4c3009de0f1fe064dc7f33f8fbcbb526558f1d83eae

SHA512
df1b33d34ace3bb492c2f4a7a732e39c2c08fe7d4e0f9d098aabb854dd2ddd81882ac9b98de47e7f637b526eb573ce0d910e583d67b255fd4d3d3d4f35aa3638

Download Submit
/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.nhn.android.mail/databases/com.google.android.datatransport.events-wal

Filesize
213KB

MD5
6f17dd0c9035e5a3e29f45c91f3ebd1b

SHA1
5a3da997db6ea6107f33f3bec09deb48e7e0bd51

SHA256
3aa754fcda260134e98670fa8d8464d8c41fa08dbcc501ec196ff281883dbe22

SHA512
9139d16b17a5c01297138997eccbcd6ce978a4cd052384d77bd3f25c82db9f3deb878ee9e3541cfaba647510c5d0029923a951ce71070c59f58f0c3e20692cd0

Download Submit
/data/data/com.nhn.android.mail/databases/nelologdata-journal

Filesize
512B

MD5
9263342be227133ec1a08ca8a9d6f141

SHA1
46d3e8842457899e47bae1a8cb5b896328f016c7

SHA256
b64088a26fe462cbb92e263668e39145786a47f6b76ab799e78793864115c30a

SHA512
d3acb49341e31fbd893d61cd74015fe087f2f9d209b35d1d7cf71e2d49757e614420ad13d5adfcdf1e986fbbdaebdcfdc20256459508e5f0e9a18098575aae24

Download Submit
/data/data/com.nhn.android.mail/databases/nelologdata-wal

Filesize
56KB

MD5
9e6b003e3af5a1c66ac9836691970cb6

SHA1
3b6085d9e7e7f27b158e09dc985a20fd69ed2a58

SHA256
3195d10de32c043347b2c64eac33117b7509e5378b58b7c3b1a85af74c373870

SHA512
104edfcef069736d431849ecb35f5a75f329a961a7c6221205608da079b350b1a59ecace2fee543f469aa0841c24670dea619bbd9791dbaa7497ba73261c8e0a

Download Submit
/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-journal

Filesize
512B

MD5
b49c3446ab636df7ee43eafac2433fee

SHA1
b16c53036c07f72280f220acd3e7f267044419df

SHA256
b7869e0504a7ea690a25fb80b2c43a05249db37c7fec978cde4eed1548cc268c

SHA512
bbaa46555c0468780ec7c21a27549c9682d6e657597d5f76949443a6ba49323dc004a5222ee636f9671482e62c0d32a89c2eadf53906738a56d004a9d10f733b

Download Submit
/data/data/com.nhn.android.mail/databases/ntracker_log_v1.db-wal

Filesize
52KB

MD5
984de2f721475171f3cbbd2e8c74ce23

SHA1
bc837369bc2d97d5d9a812eaab43f656e91887b9

SHA256
b5076bc5f2c97d7b15d387fcfaa265109c76e987dc99f2ca1572f162031f97ee

SHA512
2c1bb8f29babfaafe32b2dff89e5f35f935e70d991bbe65a5b9094f3ec4b7a6afbdc102aad5d67b261f9836a27a89462412b835627dd85d9eb14df4bef24a728

Download Submit
/data/data/com.nhn.android.mail/files/PersistedInstallation6956563769898904779tmp

Filesize
560B

MD5
232b6bb5d5f1529df58cac72183e310c

SHA1
22246efe97dc2d71a8ccafc400582d61deb93816

SHA256
70a85d6391fcf931f549fd8cc27d927ac2e365550f6a8e02027f79e4692937a6

SHA512
24cef836191aa3d1c04ba83fa9709217fff492363f1654efea541ca527fa58344a11c8efec8358d383b7dfcb638656b6de2270b5c5f4e1a4bc8dc5158511811e

Download Submit
/data/data/com.nhn.android.mail/files/PersistedInstallation9065683565237305795tmp

Filesize
90B

MD5
270ce7e753a787f14aee50c969d63ecd

SHA1
fbd58a8b8d6fd4455c8b96aee45494a47751cdba

SHA256
7c5627c9f9f43fbb54d38cb710158254677723ad621d014cb6c1863713d2dc2b

SHA512
cb2802171348f25e4fa185b1eed38c310ffaa149852a1a0f3174e6b5e76492038e0db14b95cb925705653ba20b8d8f6f55065f251ed2cf1287dbf425f9afb3db

Download Submit
/data/data/com.nhn.android.mail/files/frc_1:129436326568:android:3fb259f21ca1e06e_fireperf_fetch.json

Filesize
1KB

MD5
aca9757655fb3e9fe48193eb4f9d694f

SHA1
7e51335adf95cf79271c3ac6961181144c1b8702

SHA256
cb39f843a1fe2dfce5f73f2212d35f6665d3d2af0cdde2cf99527740d05bdc16

SHA512
ec77fa35757778e59415cf56604de14d3e6cbaa36c1a6f762b093133c26820b9d124e2671530de169860160913e9b49b4ad66c92624458897c3c7e9361a4f0e5

Download Submit
/data/data/com.nhn.android.mail/files/nelo2_app_version_N2JmY2QxNTc3ZDE4NGViMmExZThjOTdhODE3ZGE5OTA=.id_v2

Filesize
78B

MD5
d876fb82928a2373100e843bbfaf8eac

SHA1
efb73a5a1a4295d33c014fb6084b22d390dfa5c2

SHA256
ba5204803d8337b3fd6d755c1c5316bd78457d174f50552a2fab5bb23446b19e

SHA512
a38c1afb48dee809527d41d418715354e25abe04816a9c5d93f34e57cc67aa648ef7d35d389d3ee6a9be3627bd3539f6d4a4d51f5b89e1016f4e7d3a13c33f31

Download Submit
/data/data/com.nhn.android.mail/files/nelo2_install.id_v2

Filesize
108B

MD5
7509f67c8ea2f0b1a8a51ec1e042eb4f

SHA1
f7ca38550ad8320f95039ed8108da524cdec8b2d

SHA256
cb7a67b663e68fef2e5a4963b73454dda2c3b4de6b95f2a31e42f23cd0b6daf6

SHA512
36e04b5898b73aa839071fb419e3185f3e8c65245b8ea6fd85fdc40c759f9471f1bde59191baf2ae6ad27b2196304e7a9c5de51a0ec74bde4fe9f62ef50f39c1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads