7ac206b4898f1caa9a755b6eb6371666105691c68c71c0aabdf05f427854d2f8

Analysis

max time kernel
32s
max time network
43s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
16-12-2024 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hours Minutes Time Calculator_1.10_apkcombo.com.apk
Size

26.7MB
MD5

6813c4d772f70f2ea691b3486ef82440
SHA1

d2064786c29a02dea69ba0d4b9eb4822eb9f27a6
SHA256

7ac206b4898f1caa9a755b6eb6371666105691c68c71c0aabdf05f427854d2f8
SHA512

5a760e4a5ba087c808c686d31236bcb35a4b218ada8a856af6a3e3a0aa07489b90b66e37db0025b1f67d802bbd0dbfad1086490afd96982c8265d0b8b7422a44
SSDEEP

393216:QUj4fE99uXeysiDlW24NmvlAPduUFqiEtebcas2WMjayQMm0C4rlpvG6np7:VjYEOXHsgENmvlA8tewas2xwMmvmUK

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	org.quackstro.hoursandminuteslite

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4350	org.quackstro.hoursandminuteslite
/system_ext/framework/androidx.window.extensions.jar	4350	org.quackstro.hoursandminuteslite
/system_ext/framework/androidx.window.sidecar.jar	4350	org.quackstro.hoursandminuteslite
/system_ext/framework/androidx.window.sidecar.jar	4350	org.quackstro.hoursandminuteslite
/data/user/0/org.quackstro.hoursandminuteslite/cache/1664557424545.jar	4350	org.quackstro.hoursandminuteslite

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	org.quackstro.hoursandminuteslite

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	org.quackstro.hoursandminuteslite

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.quackstro.hoursandminuteslite

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	org.quackstro.hoursandminuteslite

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	org.quackstro.hoursandminuteslite

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	org.quackstro.hoursandminuteslite

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	org.quackstro.hoursandminuteslite

org.quackstro.hoursandminuteslite
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4350

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/org.quackstro.hoursandminuteslite/cache/1664557424545.jar

Filesize
10KB

MD5
dfb68e70e8eb84d844c9ce623ee069c1

SHA1
369e761858a904fe9fb89efcfc9bd3e6e56ee44f

SHA256
8ba015cb192f34326e6a46f765c6712d87c3797661541275c84b9a30ee449eec

SHA512
0d5f8ff91d3cd5c976cadf774b8d5cd6f276793b9eb9f3d8e7168eae122b0bfcffd833be9762de441d4b52f7bb3eb3850479aea37ac327be9b71910c6fdc566a

Download Submit
/data/data/org.quackstro.hoursandminuteslite/cache/FARegular.otf

Filesize
2.3MB

MD5
2b10bc6e3c422ff2ddcf9e1a04229395

SHA1
ee7a4ae775889934eab596e04da670efe3243c33

SHA256
5bdfca3a4e50482bbfb989916fde3b954fec8af1e4b526c5176e20eab9c9e4db

SHA512
20b32ca07712e7d31f82a6eacec3a06553be6fc1fa175994fc1b767fcd2f3dfb0a1792909a52cbb2ae318fd4a3936596dd711e587584606f9207cc4ce95a9529

Download Submit
/data/data/org.quackstro.hoursandminuteslite/cache/oat/x86_64/1664557424545.vdex

Filesize
948B

MD5
480d07e0214aeb0d51a0d29f6f0a6a22

SHA1
bb1a0580bf436ffe93d91756a9e2e646e449be9f

SHA256
e9e16898bfb89b40c3e9972f977730473d9b45ed0fdc5cbf868ff0e71f064290

SHA512
31c58c4bbeb49cc1ca7c705b829c55b50d980e9248277f9c96f1602fb1e6be8e7e3d3add5d3b002d28015822dc277e21905eec9dcc5685567c36e5ab97444171

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/com.microsoft.appcenter.persistence

Filesize
32KB

MD5
59dc2462d8cf774f4197845158626b94

SHA1
6299a71a5555e7240e30a9fc581a2f5d74ee43b0

SHA256
417fe843a644f7b8c617e81e593e84f1bde6cf74406fab2bc5fa5c2764f5819f

SHA512
c674759a60a293595d5f5fd58fbe1c4df415f3a9a0729a9187ec010662d43154dfe57da1dd85761865361f955d808d295819e7af4c1e2a5c2f3305bba35ec935

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/com.microsoft.appcenter.persistence-journal

Filesize
512B

MD5
59035cf45ffe3fa815fb56a431221a14

SHA1
5d0739d93be5841ca380a5b2d240c783583d2ab4

SHA256
3aeaa128250fd944619026201db81473f85396773d81238389de10ee6a5f7430

SHA512
268f9ca44320db3a4dec38d88c837ab0cab7a591495220ce0d39a63aa30b07a48861e4782e96308fd0047f1aaaae93c78c3ef55580cd5141673860e83d2999ca

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/com.microsoft.appcenter.persistence-journal

Filesize
8KB

MD5
d5daf7d3df42fe756660fa6cc93d229d

SHA1
7f25ea4f88f9a5b9f3a521990e11af9274fc1c76

SHA256
09a341ec39eb001bd4b3a6b7310edadd4d0b90614db04c9ce00d9fecf942860e

SHA512
49564ee1f92b339b78e6a10f2984e22e11c15420ae70db975c5f6690d9dceabd3cf33a407122f03ba46caf27f7f22e04fa9279e791e1c85baf49c4db0e8b4b33

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/com.microsoft.appcenter.persistence-journal

Filesize
8KB

MD5
c97d54641fbbe3021da141c3516eb6b6

SHA1
ba7e962471e32289ecbdb6ba9f49527d51a90d53

SHA256
f5d7b54395da2be32afb76ad2d8897c73e098442915de3d7ac5f3b6cb89fe2b1

SHA512
274a7fd4cde7c1c71918b80834734ab5996b99d3cf4a1b8db7a39f6b35390ec04424da99823c36a6c5a337e0b7a673518d39171e136cf94d1f23d35a4db61027

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/com.microsoft.appcenter.persistence-journal

Filesize
16KB

MD5
f97bb39c5a1ae6ee72b89e630560bae1

SHA1
8359ace00f86eb63430b7d1ad8faf2762d78d911

SHA256
5ccd467423fa88bf1d4970fa264554fd1e6901c644a0159c8558817f9db9230a

SHA512
8832dda5e73ce09ecc0acf8df409cf53045ab027e066040e53385b83f87fdd5e6b8fb00cc7cda6b704471fd001b5e4e690c6dd7e783ca3a0909462c17cb0e4ca

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/com.microsoft.appcenter.persistence-journal

Filesize
16KB

MD5
46d1469666f9bb8f1e358eba94bbdd8b

SHA1
bb5e3d7dd741b98aa81568dd003477315170fa73

SHA256
0e504a1048d5d3825d50f6d28ab7edaee84478d7866d224473384a8f26df11f0

SHA512
3e6dd2b7a961abe88d6698cfd27d93e2220b456cb2ae2ffe9601d7a70397d9b5bb72269005b58d7743f2f613806ca6f0df5d117f88c7739ad10b33e4f2764354

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/com.microsoft.appcenter.persistence-journal

Filesize
20KB

MD5
888bfa4c1836d845d50cefaee0d01df9

SHA1
f3923452a6e0847ff4c51209cd4894b0ea34e194

SHA256
3a90f699878cd4ab375d3f9cc53a6d8b06bfd020d75bbd0ed1dab9c2cb920aec

SHA512
ee5c787d3b344ef92f270647ddab0fe4c1a036305efe86d7bb033706964a2abdb7f4a691904dba4e041fb285bc2a576a34b009b8d35fe28fd3d052cc0b4f3231

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/google_app_measurement_local.db

Filesize
16KB

MD5
da4c81d9a032121236a4ed034c0cc9d9

SHA1
6ea1d3d14a34c4dbe056fc4380747d3970cb3498

SHA256
30b7dde5771b5ef3cb6cd033fa2b1618a0674f41f47c1441855f3da24887a0ff

SHA512
e61d8e6af3d48cc6e95e34568209bc24308db9d751dd1451538907df0e7caa67e329c4615911b0c6614275f3e5cfb2a8a38288f5818487c5d292c18dd857849f

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
ca4dc78786d2d74214d58ef0dfac7c07

SHA1
445d6cad34c210de88450c1a35ec03fc286a6c08

SHA256
28aaa6a27263140cfd417ec547eb5dba7591a446bc20f06a014d2b31c00f3224

SHA512
1a7796961fad69132841b21d6bb8b051ff9d782787fa774918556ec609466994c2ea302b5fa6bb193296771dce99dfe0423eccd1e0745c6ca5848ae95d1bd9a4

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
b0e9b9a075731c2a3ad00d88ecd2a8f8

SHA1
0abc5aa5b69aef5efce45fab5dd33d87915abf4f

SHA256
12719ccc33d74b8627e88c92570a64a2345a5d1d647cececa95fd0e51afa9ded

SHA512
49ded2a56c3da2801b2e53c2f2dffb99cbcc9bfc86a70e8e3ae79fd66251ddad5b3ebfa1624aad4c980fd6fc07bbe16a998709bb17ef4de1ebbaad0daf5930a8

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
419f3ed88d341334259f6c5cba643d2f

SHA1
f23646d0409f9a4695ce895744bb9c7dbb4c7cb7

SHA256
4d0533be512fef7871c562bbef43b0667497641c865a612d69e8e6425e93736f

SHA512
dba73ea081e1480c899f6f7d9beb06de7c292c8a35cd706b1945ef63afbd02679b00786475bd57e9533bb90aa2c5f5285c6df57ab13409c7029e2ea7a484cde0

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
2fd266817f66927ead9e7e150e7586ad

SHA1
5f71cc47f50a82a58dc2af6f0ffea2a789c02ddd

SHA256
97b74258d13d9e1dc0e3913b41c7ffe98fa6041b78175d659f8fb11bb81c065a

SHA512
c8f47c722f20a9a74960c29eaefed96d8c52bef2faac0980fdf9540b523a60840d3d537b4d553a4840a79dc8370b5c98e8c486087be4e4409e54940d50658a23

Download Submit
/data/data/org.quackstro.hoursandminuteslite/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
c56f055d2b76c8250f5fb08f1954afca

SHA1
41f08f49b6cb4f9f5e75f40f30751b4bd982b8af

SHA256
8bafce8819ab5b6e6146e880eb0dc0ea60b85d43495bfd337cd0096b1ea12305

SHA512
e243f9a29b55d1f9ff9da3f613c2c8cbb0b6fda9454b9c55b493a1d4cb1ccf63660a5d2ac54a1c6fc8de2162a049f36cc82a4a4b11147c67c41b4fb9086b6c98

Download Submit
/data/data/org.quackstro.hoursandminuteslite/files/profileInstalled

Filesize
24B

MD5
323e765893470ea20147cfa3e62ffedb

SHA1
88e91afa8bd8d45dcb1dbaabe506cb632e06f46c

SHA256
40a1824faaafc9e282d5b27243b9a6db15e2e125462d547cb62222325337ae3c

SHA512
1136d1653facb1e75561ba8c79ad8cebb29084f9cfb91053717f43c8c3164f8b798da076fae8ac691ff28b98f33186627e73782a848cd4b6dff74f284fc58ac2

Download Submit
/data/data/org.quackstro.hoursandminuteslite/no_backup/androidx.work.workdb

Filesize
4KB

MD5
0eb157e1a86d4d00aa601dd2f6ff3ee3

SHA1
fee434f784e73cc7916322e949f727caf8363102

SHA256
b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4

SHA512
b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8

Download Submit
/data/data/org.quackstro.hoursandminuteslite/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
be42bef5ea1d0779f37418ec8fb2569c

SHA1
8fdc6139dce94749d0b72cd8b38322bb22f21a08

SHA256
72b504a2447a7a847fc4f966d12f7afbeca77c631ec8b81b8e604b16e3894e42

SHA512
da4029419ae302717c903e8cce6eee21aa46040f622ff748d0746f1de359cbbcc51e30b6f8d95b5edaaaa73df74bdb61fb8f208feddf3a9bb5fce9f4029b68ce

Download Submit
/data/data/org.quackstro.hoursandminuteslite/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/org.quackstro.hoursandminuteslite/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f8127b772f5d96113e6680907a100bb1

SHA1
5bc940665eb55d90abc36f714a6b3f32ab1a3cf8

SHA256
9406e7f233f592a5094c389f2bf281f7d6d7ae83cbf37061691cb805eed9169f

SHA512
cafa0445bf26318034e4ca46ac36a5d5b25b09a4eb80ce4b37c4707a99789629154a281aa5ab3f1a6298ebe12387e3ddf71a20dae3b4a4c36badf8197ff1ffdc

Download Submit
/data/data/org.quackstro.hoursandminuteslite/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
53e0a098d3868a5dd3048be2cc04e47a

SHA1
ff0b40f008f9a2230e56903469c8639fd9fb6438

SHA256
7d1e8dd637319791a35890ce1027b6b60b72f7bc31e0e3b16f01c1d8db5e96fa

SHA512
56d1e84b4c581b0276ae6e1ca39a171074137d025a05324b80691e2e7f988e0759641879611299842120c8e0a67e09f8fc892e3cdc86ba5c60086c0f57ee567a

Download Submit
/data/user/0/org.quackstro.hoursandminuteslite/cache/1664557424545.jar

Filesize
21KB

MD5
722310b17c81cc3d780d23e1a63eb450

SHA1
0a0c1a939f923570e5da88aa5c7b105052f056e3

SHA256
9f2d7ff525ca785553557c351812252c0beface31440517e2f19929fe76472b1

SHA512
1a48e9383a0befb0c6b4755a8b56f352fba317910308f701e13ce8189c465cade6b0af510165d586745f1913a61cc68f91395949202394336a59c34596691a91

Download Submit
/system_ext/framework/androidx.window.extensions.jar

Filesize
123KB

MD5
3056e1bdb7d4e19789d0319eff484bd0

SHA1
6791ae47aa9466fe0bca27ad6643f846853bbee4

SHA256
8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0

SHA512
c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658

Download Submit
/system_ext/framework/androidx.window.sidecar.jar

Filesize
25KB

MD5
29469324e59dfcc052f24b5af4e7b2c4

SHA1
10c1e17ac6f598037bb51baa07945663645de4eb

SHA256
9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a

SHA512
5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads