92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
31s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
11/12/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample241211-c75tkaxjaq
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.systemservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.systemservice

com.systemservice
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4992

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 053447a87868f1cdf0e5aa556a2aa651c1fbc905b8e9dba7c416cb24e7031fa0
MD5 6b1209f1b9761f8621beeb1a882c91a4
SHA1 6c10558ca5c918d75b637e8b5aeb29e1326e59ed
SHA512 c58880babc82bfa8fd3bbe7ad544f115fabb9342d6216c31ad75b063e541382f948c7e7c837195a85f89b3c53beffe543d88e2fe50d8fb17a358c107b430e466
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSb4:8MEX0wIyNjac
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 f696654de00bec260c6ccbd9543be964a7d62cb5f51a4bdcd8567f5d86871dfa
MD5 9ed5bd0af621b680031b9bec172905a5
SHA1 023abb7fccb02053917cf125220ed14bb1554303
SHA512 75000e7f14f54fa2c7f5f8c3f455441e602bbe50709a92c3daee48e01b8d4b89914fd81cbf9130c275377e6286f2198d9f66ecfaae22e559329e134a11a1c2a0
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 c397ad67cbe925f01efc2d754e79bb01cd123a39f561588d87f9df557d31b09f
MD5 5e97e4aa98ebe6ea28a39e62986c160f
SHA1 7393a1b06295fb2ad51d34f09c79a23d67795269
SHA512 ba594497d62c5a1e6edc97acb9e1a3036e0458f6a63e48c8e0e2790a72ed59347836d9f14dc54d882271178b6b181db3f9185318cddcab4f93738557aa6a08d9
SSDEEP 6:7+/l9dn1evg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKv:7+tUqLiuWdwRmBEyPbI
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 25ab34ffbe6b451be51bf47a2666ec32531a8ede2b2bc6158e93e991e2b9591a
MD5 cd4687a83529e3f9167098422ecf18e4
SHA1 7eeffbff256fdc8d23c3bb1e94a64341ad8aef99
SHA512 0ea8844d57f2a1495198d4218f1981d357363568958b2c0747e3e953344bc242f244ab0a0e9055d897edf712aad5e8d3c3a73971c8afb841ec2d61070cea8000
SSDEEP 6:7+/l9+N/gPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK2ks//2:7+t0N/4qLJdTRmBEyPbHksX2
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download