7bacb2857b13fd33a7d1e9245c434e56b703358fe3ac96d6a3925d5309600ed1

General

Target
Μαχ_vιdεο.apk
Size 432KB
Sample260623-pdg7macx2z
SHA256 7bacb2857b13fd33a7d1e9245c434e56b703358fe3ac96d6a3925d5309600ed1
MD5 c2757f9d1631582c89ee6c38f530404d
SHA1 7d8f22810b882ce2e04bdb5882c39acae5ed869a
SHA512 0929114c37f988040ce25ae1e796e0492a1daf35003d53240001304392f60ecd99870cc807b952b85a75dc6f1e855b164d738ef3914cfe0a9a5d9ec1a77497d2
SSDEEP 12288:mBNb8bcrO5btNYI2+f+Mv+qUGqUlE0IekjEjNg3ZJ:mL+btNT2++Mv+qUGqUlE0WEj4J
TLSH
T1A2940157E31136DEE1F6953B5A47136640338E348A935BC76E64F23409BA3EA874E3C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	ru.bqwlef.qbbeg

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ru.bqwlef.qbbeg

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ru.bqwlef.qbbeg

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	ru.bqwlef.qbbeg

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	ru.bqwlef.qbbeg

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ru.bqwlef.qbbeg

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ru.bqwlef.qbbeg

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ru.bqwlef.qbbeg

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ru.bqwlef.qbbeg

ru.bqwlef.qbbeg
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5047

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Process Discovery

1

T1424

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

c2_config.db

Path /data/data/ru.bqwlef.qbbeg/databases/c2_config.db
Size 20KB
SHA256 e4c5a9510d49b478a6164bd809132ef17b806ebe9c7db21fb28e546b0f2faedc
MD5 d2a362d06b8c45abe65b6334d2aef889
SHA1 c6708c48ca111cd1a7406cdc32072638006684c4
SHA512 502a6efa139ca1a6a89def703680ad65fe8f8bcc2aed64d500b3851c2ad6dd1e1d11445251bce2a1dc6e011e39a38d2ecb3cfda322a0169ad2e4172e8ce8693e
SSDEEP 12:TLyKE/HOrQid/4DWCo/RmBEyPbAVOwPqZeE:TLy9niR46CxGSEseE
TLSH
T1FF92ABD75B0C2E03C2190EBBE49783E10F626F8E421DDB17229224983D01008A5A9D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2_config.db-journal

Path /data/data/ru.bqwlef.qbbeg/databases/c2_config.db-journal
Size 512B
SHA256 619e29bd064eb5e6d831a44b3280c37a2b245ab930d8cb159479c936448328f6
MD5 616b4b7b268afe9bb02c02c5df9a4a21
SHA1 2e2b4a3d18efe1347fc4ba31be8d3b6efa7c4c0c
SHA512 faf0f529e108a485a19ed20c247a84385ba96f6f7223146522318b613ffd50873fa175cf95169715742f47d3670e3073c00841be46f2bae2313d641b77dab31a
MD5 SHA1 SHA512

Submit Download

c2_config.db-journal

Path /data/data/ru.bqwlef.qbbeg/databases/c2_config.db-journal
Size 8KB
SHA256 4870a76817a22d8a9642385d8cd9050baa9c0e1443dcc208f7e8e1f2fb11314a
MD5 40737aa54907d64664c90860e42b75dc
SHA1 5b0210e9944ba7b9c1e6c39792fa0751877e4af8
SHA512 1f3a077fed638b072e22764a3fbceb018b352076997c0afd47e4fb83cf3321941b29135faa58132d7bbfc24cd34a0527324df81e521a3c0d4e18f1b67806f5b0
SSDEEP 6:7+/l9o4n1gpg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKp:7+tGfpqLiuWdwRmBEyPbq
TLSH
T1AA02229963C32822C82D56B7A4D583842D84E76981E9CB07256008983C038CCA4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2_config.db-journal

Path /data/data/ru.bqwlef.qbbeg/databases/c2_config.db-journal
Size 8KB
SHA256 67a87cd9ad234f373f976500b6ede113fbf27a612bcd609dc4650fdc98b2bb38
MD5 b87d5e75e42f8cf685f9b4bb7c013b04
SHA1 970e58238d10144b07296a3dca0747624209887d
SHA512 3cda122a258efa3977f18eefb81cad8c23e150176e4a3374eee9ac9a32fdbc8dfefb4365565c075e1180019a4eabd0ed0774402336233bb08bd79b6417ea5841
SSDEEP 6:7+/l99lFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKat/G:7+trvqLJdTRmBEyPbX1G
TLSH
T1B702228A67400913C02D67B790CC83612E10E724C623CB87196008987C066CCACA0E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2_config.db-journal

Path /data/data/ru.bqwlef.qbbeg/databases/c2_config.db-journal
Size 12KB
SHA256 c6c59a923b2d9cbfcb4294ba6112a4d38f4134c5dba28458472a6e798b3860fa
MD5 5f54b553fbc740356b4926c83bf13361
SHA1 ee3f410769e7d6b0076983f6227d72fec9abf0d5
SHA512 616e3443a1e892a1c7c0e4f42a59d83cb014b6bb625124ea0c43a0e101ecf299bbe9181f88c788d821656e6d3aeb445f6560607bb936ba03f00af902ab091bee
SSDEEP 6:7+/lg7vg9bNFlq4yl1SlQloaRGAd3MFCLuY3KrBxgERio4D/GLCgf8ERX4PBX4ok:7+tgzqLm5HOrQid/4DWCo/RmBEyPbm
TLSH
T1C042C0DF5F080C23C15B1D71DCF203941E2557CD4264FB5B6A9014AC7D0248490E9D40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads