13aa1ba5d76d8b00ce33b8a9945c53faf44775b6dd58efc52405ed484a84879c

Analysis

max time kernel
23s
max time network
45s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
29-01-2025 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tasker.6.3.13.apk
Size

36.8MB
MD5

a2c6b73f945414d6e3f8c5f1df938496
SHA1

279466216e515b0d3ce45ba8052ce6474c6749f5
SHA256

13aa1ba5d76d8b00ce33b8a9945c53faf44775b6dd58efc52405ed484a84879c
SHA512

f264e3a8c8978ea4e47b74698ac3af4362cc8369bbf30295912ad3e425924ac2517e222c076520d73b4f5685ab97df04914d3d0380597ba4d0917798bfc0964a
SSDEEP

786432:Fj02ohPYwlgIjSZCbm6qRrHPwCQ7X+j7P3AAUs7i2IRSPzOdatvr+STo2:ESqSB1Po07PQALe2I4PzsatD+Sj

Score

7^/10

collection credential_access defense_evasion impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	net.dinglisch.android.taskerm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.dinglisch.android.taskerm

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	net.dinglisch.android.taskerm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	net.dinglisch.android.taskerm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	net.dinglisch.android.taskerm

net.dinglisch.android.taskerm
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Checks CPU information
- Checks memory information
PID:4389

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/net.dinglisch.android.taskerm/files/profileInstalled

Filesize
24B

MD5
73d0e1b934aa63487a36d29d2bd06070

SHA1
219582a232e1727c00b2717effe1012b845cb9fd

SHA256
e0b56bd2cfc9f9cb2d9f433604ece5b56f1fec78b7f2bcb7446ee3603fe2beab

SHA512
04f39be032efea99b25f6934ac9077a0bdbecc135af0fe383591d6b1cebaed4de8299d698a219560da8eb73c0e9a10b46d02e69130fa1059dab0bc6dba29af13

Download Submit
/data/data/net.dinglisch.android.taskerm/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
720dc366973539aae5b827c8e72c7404

SHA1
53e32efc83906f6bc2cd49da069404f318d2a834

SHA256
cf5767c156f36161e28c74f9063a76e3938bfad61a949593aa47bad6342bf91b

SHA512
cfd9da5bd12f21fe6703189fa9d22018ad98b667875c769071f505133c43eec080e394cf5d5ca2cb2ea87bb14c48fd20ad511be862562d36529c2b76c2a4ba95

Download Submit
/data/misc/profiles/cur/0/net.dinglisch.android.taskerm/primary.prof

Filesize
9KB

MD5
a98c572c85bf664220190ec86488d274

SHA1
842c488a3463d5198b58026a74f0b7dbf4d91c75

SHA256
96cb57292ba37ebe31fd6b6437afb9a37b18468d801209a6edd2332ee7ff38d1

SHA512
3d1727d69587fed506b1994968a8aace71b2308d7ae02c6b7a5cd812b07edf5c85b4625be65ce72dc76287ec5c09718806cdb04cec25f8068718d1bab761c8d8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads