4a6fe0fa75fce1fe0029a0dbbe4e0b263812b011dfb0ba509e52f7f480389acf

Analysis

max time kernel
19s
max time network
155s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01/02/2025, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

M-Pajak.apk
Size

22.1MB
MD5

c4ed726c3d5668d29193c664dda421b3
SHA1

d1a667675e2c3c6f8ce851e73acf75bfcf638951
SHA256

4a6fe0fa75fce1fe0029a0dbbe4e0b263812b011dfb0ba509e52f7f480389acf
SHA512

6bf9ec9f47043c261c4eb03ed0a47d1b06644a2dfd5f6f36c1f39bbcc885c6ceb2c90b180a3cb10c05c324d11f54875c2c5a98c565d86c42f11d860640032f15
SSDEEP

196608:iHOLwtZ/1WYD4u0fNEjHz6hJs1sgAXFNgI7a7YSu33Zu9yzhLrZXsnFphv1rnFpL:qUc1W6KYgss3FNgIuc9zhL9WY/+enC

Score

8^/10

banker collection defense_evasion discovery persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.pa6388age.pak

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.pa6388age.pak

Enumerates running processes
Discovers information about currently running processes on the system

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
26	raw.githubusercontent.com
27	raw.githubusercontent.com

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.pa6388age.pak:remote

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pa6388age.pak

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.pa6388age.pak

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pa6388age.pak

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pa6388age.pak

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pa6388age.pak

com.pa6388age.pak
1⤵
- Checks if the Android device is rooted.
- Reads the content of the SMS messages.
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4253

com.pa6388age.pak:remote
1⤵
- Makes use of the framework's foreground persistence service
PID:4555

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.pa6388age.pak/app_crashrecord/1004

Filesize
224B

MD5
b2a1a7958df491e9effce51937d3b68c

SHA1
227b085447516ea4caa1dfccf33e4fa590fd1fc3

SHA256
938bd53eaf69fb5edff832696c2b8b269e245c58ab982a2fb18ea7768322ecdf

SHA512
2a3e8917131594000550f50392f2ab05c7c931d74c4e60c1d7cd229652e7e3a443e28a40a47de7e220866ce6a6204d02dff4497884a8ae191dc4a9f53e2fd270

Download Submit
/data/data/com.pa6388age.pak/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.pa6388age.pak/databases/bugly_db_

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.pa6388age.pak/databases/bugly_db_-journal

Filesize
512B

MD5
208d0d4e2de9c77c46cb7002c5ee8953

SHA1
6f03fac1247658487927ab77af42ca0e24dee94e

SHA256
b61750e2648f38fc7e696627332cedbf00ebbbcdcc913cacf3abc97bc670bd3c

SHA512
f90eed3ce49e4d27202c4236a46d8f6dc091240e02b118cbbc5efa4b03f8c25d6833ade5eb3f6334a6499edfb241f1eb636b5fcab6c58f369f8798dc7f9a2615

Download Submit
/data/data/com.pa6388age.pak/databases/bugly_db_-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.pa6388age.pak/databases/bugly_db_-wal

Filesize
249KB

MD5
afadefa3b4f4f4533e3b0b6e9e952ac7

SHA1
0489f42516994ec1c51062b645d4a64409f410ac

SHA256
497cc26da4b81964b81d39db516bba974032ace3f700cbcd7c5c42bf5c2e7498

SHA512
96fc42dd03efeb848f86d76edb267b55495399bc5a5ad4eb9caf2445f8a70776b6376ec86c1253784022a110471c93eca3ffad286f4a7be764f6176555c6d1a5

Download Submit
/data/data/com.pa6388age.pak/files/bugly_last_us_up_tm

Filesize
13B

MD5
5e21e56cea0ae8934ca0a15780ea83d1

SHA1
b382a335aaa3cfa9b07d930b0ee583796f18a120

SHA256
1be160937f21ef5ff79ae35ab6ecc13bfab3c21a6e71f2221a8f6203fab3cecb

SHA512
53ff4d5f0038f9a23e9ae4226e7e9ef88b3758eb10fd7a6cd361452bed3c3aaac4952a908687dbbb885381924bd7b08c06b3c608fc5b53292ca16a48984ee43e

Download Submit
/data/data/com.pa6388age.pak/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/storage/emulated/0/Android/data/com.pa6388age.pak/files/log_data.idx

Filesize
96B

MD5
734e134281fd7c5f7e4c6d7c4533ccca

SHA1
a28333d5f398b0ea0c8418bbd5f00cacf6ab19b7

SHA256
739df2902c5c9a5694b15aab630df88f359c13c2a50880dab3f95a8c283da737

SHA512
96de60b0264510b60c36bf0ccc57caf6539e9760d9c9242a43cdb6741ac6405fa3e637178b9a3c089438a2faefd0fc40a596abf0b33f5a4ffb0950d82f9e6746

Download Submit
/storage/emulated/0/Android/data/com.pa6388age.pak/files/log_data_000

Filesize
5KB

MD5
dca09530f3910b17755d6431f889dd8f

SHA1
c37601eba2dfefbdcea6d40b706ba042f5dbcc96

SHA256
cd0c085da78f6036cd4c250e2f16142523a4d15dd484cdce0b3af8aa459150df

SHA512
dfc8cd8a2f914faac611b2de5d5b4e8776b729f44ede4e5a3d36f1db176bc2beb0aaa2e15b2cc32ece07237d1c94e4579c82999c311650e82fd725a001bf8d6e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads