92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
16s
max time network
132s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
26/12/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample241226-ct2vravjft
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.systemservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.systemservice

com.systemservice
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4931

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 537fefd8967f736b04b33fe3f1c884923a52992c33b161973d877749471e0d4a
MD5 4d4e7ecdf2f030c70ed635293ffde297
SHA1 32eeab03d1c1f648f9fe1ddef8bf79bf39705564
SHA512 b0eb411ed4cb696f25406d92f5e22d45b45c351fdd3f181954b20ac3eab3e0764b24c4ca1870c9b405dfb2c15ef6d05908ef8ae3cced177b28373de5981a0329
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSc:8MEX0wIyNjac
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 e1515bcdbabc67b4a0fb57aed1a59e1a212053e63990d58bdf6f68993fbb10a3
MD5 935da8301511a2c64ac05847b6ced662
SHA1 95b31da60fb996b44db4df1d6b360395e1c80362
SHA512 c988ee6e872b4e4ec5d9e286fbbd92030b4cd479a697c56b0c78a6e80b73233ab352f32d8d74b6acffc0f3475fdbd4ca066eac577f68b74d86983414c57e2be6
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 fb4d5288fa6215038d1368cd1fa62323cd41d2d9fc9698c37e46c87f0bd03754
MD5 64c8c698e9e5e28a071c348f597e288a
SHA1 8d73b9ba2663bdc9bb22b6eb2a056325e7e79ee3
SHA512 a297f2c8d6a2ae3c6c68aee48db7ab770926f066a12924f4af79b6ac2bda8579f5cced17e5f1da79cac4def92d8ff3d60a76ce6a2dad7232b24942480e22cd11
SSDEEP 6:7+/l9IQA4n1lAvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKf:7+tY8AvqLiuWdwRmBEyPbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 b8601c8198039a79913ea7d446f4037507daf8308a3077d0a7684cd7b61457a2
MD5 b37c771c21ba6acbfc950a1ee3a1d6be
SHA1 a8f7b575e35b9a5716a8573cdac05938a3c7d83d
SHA512 c83a9eccb5ec9025cdb963ad6ad49d9a55c48ee884d2d87252e221d93516f68b1978be3b2be6e7f9974f949aa9e453f4b0282b641f30bcfd29e9b83009741fb6
SSDEEP 6:7+/l9WPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK0bBM/X:7+tMqLJdTRmBEyPbrsX
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download