d14247ea058ba1c1e625370d00dcfc41afd69275065be576abb008936dc87db2

General

Target

com-mod-tasker-mod-apk-v6-4-9-beta-5405.apk
Size

40.1MB
MD5

a3e67dd6627319f1bf57f22d47bd779e
SHA1

785d513dc4be4cfa90f41ad18e6935ffe8d5a2e3
SHA256

d14247ea058ba1c1e625370d00dcfc41afd69275065be576abb008936dc87db2
SHA512

7fe2023bebbaef5fc57001430f20483b127480b9342d7edf0866b08f65eb10e6b046f782e312cf6e73fd04324be311b74d80f2eb39c95a375c9293b66d1324ff
SSDEEP

786432:clLgf64/Szm6qRr8PwCQ7I+j7P3AAUsYi2IRSPzOdmdljlVWgXijsIJe:clgd/SSCPoD7PQALX2I4Pzsmd4gSI8e

Score

7^/10

collection credential_access evasion impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	net.dinglisch.android.taskerm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.dinglisch.android.taskerm

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	net.dinglisch.android.taskerm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	net.dinglisch.android.taskerm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	net.dinglisch.android.taskerm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	net.dinglisch.android.taskerm

net.dinglisch.android.taskerm
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4443

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/net.dinglisch.android.taskerm/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
83b8efc355f3d819574477a3280ddc00

SHA1
6e9d6301d29a58342033b081e8029f8298bcbb61

SHA256
d4cf2823b5065e025956cf6aba1f48f330daffefa3cf539ba76c2f7b25aa9af7

SHA512
5e4f624cfdaf591d33cbb59876fd70ff94487be2c9b64f0fd169ce5596b102dd7f78570f64a45064aff013661965d8645eaceb7ba34a9885de96160b095003a2

Download Submit
/data/data/net.dinglisch.android.taskerm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/net.dinglisch.android.taskerm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
9886a5ddf3ae055035f1c34ccc9c7743

SHA1
1e4cbdc981099f51156664b0ad6b16b95b6f2991

SHA256
45434021ebdf182b85cee8fe74a1b873abe2f01e983fbea03cb2fc13449a50a8

SHA512
0513a15ce001b56cf855c831d40af3913c66a3975d9f39e8e5d912659b237689556e77e2c0b0bcfcc5c1e4bfdffc74b9b20f627d53e1b6f7b0b8b7098ff8ee7f

Download Submit
/data/data/net.dinglisch.android.taskerm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/net.dinglisch.android.taskerm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
651727ece671f2420914b51ea124c6ab

SHA1
2219a0c379d6e21a24c859bd4de33a3035041218

SHA256
c4bbb4ae3747b6dedb37afec333c285de54ea111e88b151f779bf92ccf823bb8

SHA512
075b2fe1dbc165d75f7429f58c0748131278e4d52fe5f35c3214275156bd3533ea137425b90c28bd5d36cf2bb3e714f2bf6786fb77b7cacb9c8585a47587bd9e

Download Submit
/data/data/net.dinglisch.android.taskerm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
ea3d986a7113556c8f3ca5aa9ed1503f

SHA1
3c4e19db1d0c0c4ca56696cb8572480349f16153

SHA256
784602dfe323a7eb077f1d7ebb79c53b680f780c4ef4c9c5e6b43c4bbffe9999

SHA512
9d78574f1a656e2f4811707a59e5c3b8ca1b06bebffe81c5e2e10606c340ef43dd6b5485cbfe941e4e6c2ad1459b6a36c061a5689d87ccf31926041095b50b6e

Download Submit
/data/misc/profiles/cur/0/net.dinglisch.android.taskerm/primary.prof

Filesize
11KB

MD5
da4c0c36ac84311528ae780d3c1f3204

SHA1
32380c6e2171c9d1bda2950e433e172840764da8

SHA256
78cb60e400f4d74147c6e2bbd63afd0f83627f4c801582b6d644b46f111be388

SHA512
a6ebf2a1aac71ae2d53d27e81eeeec227782923d37668e6d2ea2c1b598acf9e68f6f2f67563cd137afd0e43007e983ab37bc4ea4ef603a2d99cbabb9fa1482ac

Download Submit
/data/misc/profiles/cur/0/net.dinglisch.android.taskerm/primary.prof

Filesize
25B

MD5
b9d9e0f8902d129e1aeebff0ae7b725b

SHA1
cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

SHA256
25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

SHA512
f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads