311ce8a50fb25ee86084f81a1173af863859d37fe4e45e559afa183be05b88e1

Analysis

max time kernel
17s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
02/07/2025, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
311ce8a50fb25ee86084f81a1173af863859d37fe4e45e559afa183be05b88e1.apk
Size 4.3MB
Sample250702-1wp6qsak21
SHA256 311ce8a50fb25ee86084f81a1173af863859d37fe4e45e559afa183be05b88e1
MD5 c138d4f48e0259ba3db2da5a0d6e3093
SHA1 99420e62167e1645d33fa6536759c159584a5dae
SHA512 d427338f864c00900d950e5174b9e53d6b12e4862d40f884becba96c612d4aed2e966803fc3f5b4c1e073389666682e53e556e1c31647c4ab173c4a41e3d5cc2
SSDEEP 49152:0Map56WQZ8p45jxtGtCYxcko4Lgo73ML+M1+SDSJcY40+4Iiz9hisl:0RpqPYz1x73MB/JD0wSisl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access defense_evasion impact

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.delta84.comet77.rover4.zulu42.reactor77.vortex28

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.delta84.comet77.rover4.zulu42.reactor77.vortex28

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.delta84.comet77.rover4.zulu42.reactor77.vortex28

com.delta84.comet77.rover4.zulu42.reactor77.vortex28
1⤵
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Checks memory information
PID:4579

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.delta84.comet77.rover4.zulu42.reactor77.vortex28/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.delta84.comet77.rover4.zulu42.reactor77.vortex28/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 b1638e5233d4738f52be8eb1d97c361afed754dd5c9aa97a4276ece0fa166a55
MD5 d76b9db4032cf227579a97500d1d140f
SHA1 150a528d877db75e8e60f785f0de187dece66b4f
SHA512 83fd62cdc5f575ff2ad3ac18c12b39817e69af138f2592b77545e31deec71e662dc8c95efe8e9d7012a7d59859f966a6e2e1049d64d323255793cfebe7b22ddc
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.delta84.comet77.rover4.zulu42.reactor77.vortex28/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.delta84.comet77.rover4.zulu42.reactor77.vortex28/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 327bd342a23bce337f799589b0fb49b7ba69a4e2a2573618491044ff1f6f16b2
MD5 59e57537efc08d9486ace5687012456e
SHA1 37dbb1faa15410bb881238b4b1a03a65e591cc45
SHA512 5a88841d003b8a33773d9f2c8a40599f66f5cbd3b39acc125a2cd3fe03a855e59136cb85cff67aa67d5ed1b9968bc072a1f598c07522a249e6b64b1837d82992
SSDEEP 12:KvW8zdeWRmBEyPbP/PHkdZpvFdZpyZpTOw2:KrzKGSP/PEdZptdZpyZp72
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.delta84.comet77.rover4.zulu42.reactor77.vortex28/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 d732879ce874acbb008ecb27c4e5c010e80df0db52d2048918c61332d245220e
MD5 8b2fa199ef2307490b9b2c5ba33cc3ef
SHA1 a8d42f101cc2e485cb2f98448b56be84348a00af
SHA512 bfb1f9238b3ae9793c40df497809c4e5e38bdf3f266aab0b5b7d889cbfe1e6ab89217f06a58223ac38789749a9de2328e30b580a7b3034f1179e812da37c4ddd
SSDEEP 48:YFY66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI9a:e6+hdjnHtDRMpf8UzS6+BD8q0ExPyA2A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads