c6e52bd7d8a1de54e5a6551a7a737c989d93537c1bb440fdf37914c799e77f16

Resubmissions

Analysis

max time kernel
18s
max time network
154s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
19/02/2025, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chínhphủ.apk
Size

23.4MB
MD5

9b4aaaebca0f904234d371475d3dcc6a
SHA1

fdbd2957048a9564a923bda70d68ab292bcb7540
SHA256

c6e52bd7d8a1de54e5a6551a7a737c989d93537c1bb440fdf37914c799e77f16
SHA512

d8ad4d4d10747264e2ef960dcef5e70049ca7eab102fbd02ea07982e01b6af2130f95856694a9ebe0f3bcc3e2512a8bca92f944b1b5aa9f54a0cf5e34ecd67cd
SSDEEP

393216:HehX6Cksss3FNgIuc9zhL9XmENEuEyIlRrU:+hXedsFitchHXT+U

Score

8^/10

banker collection defense_evasion discovery persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.cam321f.mac

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.cam321f.mac

Enumerates running processes
Discovers information about currently running processes on the system

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
28	raw.githubusercontent.com
29	raw.githubusercontent.com

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.cam321f.mac:remote

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cam321f.mac

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.cam321f.mac

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cam321f.mac

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cam321f.mac

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cam321f.mac

com.cam321f.mac
1⤵
- Checks if the Android device is rooted.
- Reads the content of the SMS messages.
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4217

com.cam321f.mac:remote
1⤵
- Makes use of the framework's foreground persistence service
PID:4545

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cam321f.mac/app_crashrecord/1004

Filesize
222B

MD5
a8cbc67f275dd5acd81e8b6cbe78e341

SHA1
fc1f7b701f84ea1c4c0dcf02a13a4cfcb97e31db

SHA256
d6f6ba3549bdfa2c7873712d89a1defd8668bd577ffadd3c5cd7787901d57b3b

SHA512
b9fba949dfdb0b4ffc21cf09f9dde17f65f30de196cdae76bf941d1b48898d9549445883963a621b9ae7df64ee53947028c67c9bf5fd3eb1b616871ed29162d0

Download Submit
/data/data/com.cam321f.mac/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.cam321f.mac/databases/bugly_db_

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.cam321f.mac/databases/bugly_db_-journal

Filesize
512B

MD5
b772c6cfdde112ae85bf2c204015517f

SHA1
29820ace4305c6f65291c159790bbd0d2595e145

SHA256
2c37e12c2133083e39a00ef8a3290a5ed1526a59b1826ad5307afe82308a3d1e

SHA512
729a249d84ce78c4d52af6d25bb0de9ee9fa76fafe7f314daf1e96743a089e86d520bd8b4971e3e75963cd93b4afa1ab0beeb1074fa87835246c3165e64f12cb

Download Submit
/data/data/com.cam321f.mac/databases/bugly_db_-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.cam321f.mac/databases/bugly_db_-wal

Filesize
261KB

MD5
bc8a0721158c3784e6e54bff7d3702d0

SHA1
d2d0e4bc33ca76df22d6c163d28df9e7df4208de

SHA256
813a50a4c842e6b46e6effb4c85171f4f3679f0b3277d29f67fd05c33f227593

SHA512
04b44dcf5c6d9d6cd3f1e2bec068a7c19c32db42fa9231eb02de107469afc53d0fcf2316d0bd8d345db32c0a6aae44fcbb553a80d324bf88cb65b6eca368d658

Download Submit
/data/data/com.cam321f.mac/files/bugly_last_us_up_tm

Filesize
13B

MD5
53f04649672cfe37389ba173a4ba4aed

SHA1
0e1a01cc9e6512c04a1b59fce768c4ad80cd63f8

SHA256
d6487c5f1279ac8223ffd17ac3dc8a3907fb695eb48fa950893a1e064ab1579e

SHA512
e916eac3ab1062343d370fdc397e8cd0dfbb9984e9a4e8f6bff635fc02bedd8758ed720497d02f7a4bf440832a1f5c9d6a99f4d4e7ed5039c9ffc5fca6ab577b

Download Submit
/data/data/com.cam321f.mac/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/storage/emulated/0/Android/data/com.cam321f.mac/files/log_data.idx

Filesize
96B

MD5
a2a1c1250595dfe3ce2b17e29192ec2e

SHA1
6163b9d2f7ac3d80b71c7856e88ca9636811038e

SHA256
6d2e0dfcc71b4ccacc179fd19dcc2eb20d85e9fa24b25521e8fa26bb53f02543

SHA512
e3f5c5c7b5398e7e1646d62e9f90896ccaae7a59a8fd97994736423502f4d66883f9071b84503c42bb482ca258654c80db95a63d9685bf23e3ae074abb4c2612

Download Submit
/storage/emulated/0/Android/data/com.cam321f.mac/files/log_data_000

Filesize
4KB

MD5
7b6f49e9e27f20945515e9c59d23e880

SHA1
308b118898c6e9248cd8eb27b14e161956ecf264

SHA256
63e8f08c8253011e553eec78326c5e588036d4b09bb8bb54035f867387eff35c

SHA512
47bb0b55ee2fcd70f8ca766916c2719a298cffa55a3fb410e6bec39405709a18cdf35d3311cdd3078676d20a4cdc71ea095c00dcec4600d253aeae253724604f

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads