92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
13s
max time network
151s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
31/01/2025, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample250131-cwsd4azkcr
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.systemservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.systemservice

com.systemservice
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5245

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 a6bf74c9d24e11b7c2e414231baf8a5dc1c8dc887bcd6dadf4cddbe8f4b5b4cb
MD5 249abb5118022019486f8605a0c4ae0e
SHA1 8db2b3ae3a5c359570507d263196c473610f914e
SHA512 a1e585151a44359485e9e2d8f52233f48991b84d9049db8226c683c6dfeed8896181a3e014307a22edc84d2ba99ca894295c4576b6d375243f147e51058f6a44
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSY:8MEX0wIyNjaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 432695757fc6bb9189c5705c04bfcb9867b60ec7f1b1df50d7ad2344d9fe5f2f
MD5 acdad0d0f819c2d78b6a436e644617ec
SHA1 a58e394e431beb434a50d13fbd756164dc2d9fbc
SHA512 bd31944d1cc59e50edf329df78066c40421a87ea36f172fbc12a55320a287e6ba06d21e382d671b07cde27913e830887c53bbb90b99fd2f0f63ad492da3d80f0
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 6788a803172ff9c764478bb26814984577069310a4c9a9af47785e90eff403e3
MD5 76a6260f16a6e5d36f5ade6c6a1616c3
SHA1 97bda7c557343ec40940038a8b49d1ae1716fb2f
SHA512 6efa1f72a96e8cd13fe4929a00b4fb710a44e94303300068a33d801d7ed3398bb255ec83f5d55023def226914fbf08ca05d0d9e76fecc3236cccddbba1eac6eb
SSDEEP 6:7+/l95gn1pll/vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK6:7+tgqLiuWdwRmBEyPbt
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 3fa366e7c95afb46436a062b8f4467ae4d2f2fb28e08e72b754124afbe33375a
MD5 46226bdfe0132379df82d8296209971e
SHA1 3efc60b1baafc836c72ff7a81d7bb8ff03eadc25
SHA512 0c65e465a6a556dc323e4fcb0ed231d6ac9e12f89d43a096349f7c40a661ecc1cda16c060f68c0f37894ecf670b4cce8bbb1f7316904ff0730d55a3522ac762a
SSDEEP 6:7+/l9n7Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuK8ti9M/4:7+tFzqLJdTRmBEyPbji9s4
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download