92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
17s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
08/01/2025, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample250108-cs6gjssjar
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.systemservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.systemservice

com.systemservice
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4963

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 a7b14ba9fce248dbc5e65c2b6115200166e321a2eee1b2d00fc4049419951408
MD5 df6754a576d505de8e1e7f69226f3ae1
SHA1 198074e6dd0fa6abdc7d9e0bb04edbca736b3a0d
SHA512 e58f6570c4d2b69651b1a62a79ad5ac15567c7d30d8f5a812ace95eedb3dfd115faa0d1247d590e5d932036cf2fbe70196c28152e91bf465f2c6eb5e253ad5de
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSI:8MEX0wIyNjaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 2742671684991b7042f02a8a189d7519f38d19c68ed45ed95cee7765d79f79c1
MD5 6547dd928dc84769f54ae4f9f2259b1d
SHA1 85bbd8f3697f3d9bec14372b2e2d20b39423c993
SHA512 afda901a9e74f8b1347e8993ec41da99c8ee7f742a09d67cefd2e3103eda6ca816ae87c43135b945fa3f24c1541daea20eabffc21164eb43a39d2134673bc94a
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 8f0d1ec411a3d63485561bde3899434ca6c9ccba2e82586822cc64206ca26859
MD5 966b083a22aa353dc956ab41637280cc
SHA1 88d1c7dddb9b299f02baddd35fc66f979947195f
SHA512 432e3f849220463d08eaca7971c500d1c03e3ab43d194547015b581a753925a67e90d572384dae6fb4eafef61ba50423b8a81588b801888adb0bba1670f3522d
SSDEEP 6:7+/l9Gqn1Cvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKstA:7+tcZvqLiuWdwRmBEyPbzA
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 84cd178355272e45b5dbf4e3e632dd1cbf5c41c6c137a2f4e6908352155f2dc0
MD5 896e85aea99233cd45faaff2d047043c
SHA1 6dd3ec58b0713a93cff47899ee207951a50545e4
SHA512 3cd0e2817d9ce744fad719867a64af4148a0a29018309c410c3169a00087a0e43685f93c4aca7914b8f0b1205a9118d9b1d651ecb2fd3027ab9f299b96e982d5
SSDEEP 6:7+/l9+/8HPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKNl/C/G:7+to6qLJdTRmBEyPbFG
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download