92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
17s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
31/01/2025, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample250131-cwsd4azkcr
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.systemservice

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.systemservice

com.systemservice
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4254

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 6be49c61944dcf8cc4fe3fc93e926308714d20ede04543b1874dc9b53527c7d3
MD5 134c899a942815e27282daa845458d3c
SHA1 0d04409b81c1d9180089074f13dd7f79a09d06ab
SHA512 0cac7a1a4083c5391cde954bf0007683a6ac7bdb52bb881f6348d86ca16aeff7fb4d3ba9bbf081f2a24de88b5552fc3c7532aec417722eb6dd176e86e09a2350
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-wal
Size 68KB
SHA256 f9fd9365f6d5b27c1a9a45e8a7bd8e50387a2c2d50d390d3799c55205c00419e
MD5 38fb1afe53259be217603ce7be7d8549
SHA1 27ba1fc30b3691af1852fa194f0676f16bc378f6
SHA512 3cd797a818d6edc27d1138cc52364eb687e50e951865957f2f0c12cf7a1804f85f414b31a8fb563e8ab7a185977b74c084aba07fcb6195607d90c01a58005e82
SSDEEP 48:0zNSP/A1g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP/YaV1kT:c0PJMEX0wIyNjaP9Vq
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.systemservice/databases/google_app_measurement_local.db
Size 16KB
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
SSDEEP 6:l9FCls1ulO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TgEu9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.systemservice/databases/google_app_measurement_local.db
Size 16KB
SHA256 689d2f7cdc7f96be50291f2fe23ea2b7ac8789b5bfff302f497502fa3c885b63
MD5 30dfa407851a77c5d4262e3392d4e0c1
SHA1 8400db7cacdbf60362cccdae1c27244fa5c99b35
SHA512 f5a39260e9d26357652fe69f4df5ac3fa2d7e4390093759c6b7096baf972549c9c08f9b6530e60675d34f7ae6d20708f5daca6bc18786134cd75b50c3559aba0
SSDEEP 3:qqb/NjghzY+/lzyliMlTXmDprGhtABlRzMlklKllgIn:LCM+/lulvl61a72RQlrf
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.systemservice/databases/google_app_measurement_local.db
Size 16KB
SHA256 3f0bf17f9bcdb177210339ecb00b42e64eedb1f415453aa495617e50e8d615f4
MD5 da8fb2c5f2b66ed0b9d1bbfff8a06f7e
SHA1 53ee02b36ac0da17ac14860d3c8d5d652a0e7dd9
SHA512 a4d5468ef6a64b5636054dfa279c10eceeca60ee354d5fe0da52333ac721f55b9523f25597f764934eae4253519dedd084d8037c2bdce7ea32d27ad7cb876220
SSDEEP 6:rLP/gEhV71m/9blDqlrElvlEUTfQlr26lCM+/lulvl61a72RQlrf:rr/gW49blqYFlEpN+/0Fl6I2i7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.systemservice/databases/google_app_measurement_local.db
Size 16KB
SHA256 045a40ff6bcf7d0497cc2c6a17a1ae26df8695fec977b9e3712b2b29f0aadece
MD5 3e1ea3cd02cf591b0c6cfc3b5ff222e4
SHA1 5adf0f884663c0e4f5ded6cd2fa0e66c6085507b
SHA512 924a505634d924020d071546c8b1402650084fce35c7cd5a73b9050d755343d9fcf34184b2a633889fde91108ce859fd14b45cd57ef08084879b8f6b2f9d8864
SSDEEP 12:oFiOLaOS/yAUbYUyWlaxE449blqYFlEpN+/0Fl6I2i7:osKaT6lQ1499FqDlFaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.systemservice/databases/google_app_measurement_local.db
Size 16KB
SHA256 659d5d6b0264992b34eb0acd4b4c859cb7cafa2e2d93e8fd6e817317dff1df3c
MD5 e2e16816fd0367c09f60fb01b29beb34
SHA1 9a518b9531b8b66b3db3a182fd258b0233cc23a4
SHA512 7e46b4b80f0d149680c6e298786e6d2d87670adcecb5fe19fb4d1c696407428a5827731364fd864c9182489fded88a9a168b9ce081fd458e61b6c2b48d5d5773
SSDEEP 12:zFiOLaOS/yAUbYUyWlaxE449blqYFlEpN+/0Fl6I2iv:zsKaT6lQ1499FqDlFa+
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.systemservice/databases/google_app_measurement_local.db
Size 16KB
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d
SSDEEP 3:o1D/zqllll:oS//
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.systemservice/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 6c4a6d0a1bb091393c279ff1c5ff18a6bb383d6a73395bc2c4ca78040ea1c576
MD5 a92ee3827e582e455f3e3e9253c1f380
SHA1 42613346e9a25207c3bf758327cc13ef179937c2
SHA512 08f95ba0969cf360c52495d2ec6e8f19251c14f6fc1fad6f7e94070eb2fbd09c0f922b868a18964fd833a3bdfaf205e1e50bcec1369910246a7c28f9fd8699f8
MD5 SHA1 SHA512

Submit Download