harly | 05b4c4dd8bf9f376c767330e649d725ad35c0c9c3b1b2dbbfab7f39e90c5bac4

Analysis

max time kernel
48s
max time network
143s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
17/02/2025, 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05B4C4DD8BF9F376C767330E649D725AD35C0C9C3B1B2DBBFAB7F39E90C5BAC4.apk
Size

24.1MB
MD5

20119bda1b6c51fb1e14d9c14e0bca00
SHA1

2af901160d51d4060b10721b7db958fce6813bc6
SHA256

05b4c4dd8bf9f376c767330e649d725ad35c0c9c3b1b2dbbfab7f39e90c5bac4
SHA512

7d3314d39c785c47a7ee9f029a11d1c3ab66786e77c7e3a8c31e95b2ce35513265bd686ef07f807e17836e488ddd618c5afed29c9fd78329bdfde52abbdc0384
SSDEEP

786432:UTMyS8RbcSQTJwG6RV+oWOVzTZEBvD9WKLabY:KMyS4bpyJIoO1mBvgKLabY

Score

10^/10

harly defense_evasion discovery evasion impact infostealer persistence trojan

Malware Config

Signatures

Harly
Harly is an Android trojan subscriber first seen in September 2022.
trojan infostealer harly
Harly family
harly

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.armstrong.scentvideoeditor

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xc7b8c000-0xc7ea45bc	4260	com.armstrong.scentvideoeditor
Anonymous-DexFile@0xe7df5000-0xe7df7e78	4260	com.armstrong.scentvideoeditor
Anonymous-DexFile@0xc54b7000-0xc561504c	4260	com.armstrong.scentvideoeditor

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.armstrong.scentvideoeditor

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.armstrong.scentvideoeditor

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.armstrong.scentvideoeditor

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.armstrong.scentvideoeditor

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.armstrong.scentvideoeditor

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.armstrong.scentvideoeditor

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.armstrong.scentvideoeditor

com.armstrong.scentvideoeditor
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4260

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.armstrong.scentvideoeditor/cache/1588462714860.jar

Filesize
9KB

MD5
86066e62936fea939b14bdc2a636ff1c

SHA1
c0faa2f4c6f206b92bd611323c8f81b02dc8f16c

SHA256
e4270ee2c7c624bde9dacf923066032fd734e12cd70c8c70c949aee553896ef2

SHA512
1c0dee21b55c6ee6d4cbfe8c7c13f03bd39fbe26c329e77b87d0b13505e91242f93d1dd541f08c66bb701c591ad75c3d0b5ca846a2498b1a28e38a365875ecaf

Download Submit
/data/data/com.armstrong.scentvideoeditor/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.armstrong.scentvideoeditor/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
80cb7d4c34f494c30e70fb43b769dc97

SHA1
9477a9fa89c03f0cd946fe8f85249a74e7fa5782

SHA256
d6a3b66e56002433366c8042ea1df6d7006c870d09d9fcf33f6a15584c8b5e21

SHA512
84ee12699378e772c6b733cc83cb1cf9acb093964a73ee881e5e5c9f7deaf9362cad12fa093549ee263c0b1075b8d823a0baebec71c8f04fbf7a0d494105fafa

Download Submit
/data/data/com.armstrong.scentvideoeditor/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.armstrong.scentvideoeditor/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
61e1ff68e298cfe08e1874220714993a

SHA1
9602be6b481afbda861cc22bda7ab10573bfd03f

SHA256
386cd2073d2646e64f07c06de4c7da4d5f52bec7f43c776c99b4de5b2624cc14

SHA512
6abb32692389a5838fcc89617f8cc716651898514a615ab28c2f94e761874f26fb11057e6af5a2be4ed69f4836449b9fdbd645153e029f9a7df23382b7649f28

Download Submit
/data/data/com.armstrong.scentvideoeditor/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
13063c2e1741dc15a0fa427f651d0baf

SHA1
c27deba2a6d2df4e5ad02c46c9cfadbad1d518ab

SHA256
5a0fc893e823e301d35e0db4720af81e6a60cd10380fdff92c828a9d7af7eb84

SHA512
459822b639e3d5ef86186e32ea3f6be5858bf2a2a3024ebb3b0d4dbc527cef99511534eb7ceab68843989f146e767fe696d3760367984343ee0f87c116760c63

Download Submit
Anonymous-DexFile@0xc54b7000-0xc561504c

Filesize
1.4MB

MD5
49aed826f8984aced1c2468fddcd6d3a

SHA1
05db530fb33c97bbc78996092fa82b2aa3b8e791

SHA256
18ca849b3591533c106002eedaf6a5bfd0f48ec4bb15599d230fa2eb1875af13

SHA512
1eca121408dea95a213a1db1aa83a8861ece55cced5e52f4a5cf3f69cae260f2a9802c2ff1954dad50a232b7f1dec1dfc1bf7c9d45076af1baa017499aa4c0a0

Download Submit
Anonymous-DexFile@0xc7b8c000-0xc7ea45bc

Filesize
3.1MB

MD5
36e27ba587247aa7c63bc610643f658e

SHA1
e0e191e2fe5983005de444b1051ce68a32489c6a

SHA256
7cd311f806352c2a69f8c22a48f732a1c27fd00ad07690a8ae2b1fdb0aa7b1e8

SHA512
8fbcc69ac3a363ed76376b6bc7d49616f5335f6cf9791e8498e25f14542764e73407b47492aa29c0af671aaa56f777fe518a9a8575ddefd8da5f370de48622ec

Download Submit
Anonymous-DexFile@0xe7df5000-0xe7df7e78

Filesize
11KB

MD5
411f5586219aab48eb873ad07c8fcdfa

SHA1
0fb5ef8b65296e407a5f4f8dcd2a18cb3baadf0b

SHA256
109e65f169896301a9ec904a4974bee28417f25748d791cd03ee5d9920a5bc0e

SHA512
fa2614d9e5f087cc32ac6665d5c6457b5db6c2c30d53f2da70368d9f724afcff198759562ec441cfd14ec3ca92fb2b114a4bd6fa94c9d543f094cf901fabee42

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads