7bacb2857b13fd33a7d1e9245c434e56b703358fe3ac96d6a3925d5309600ed1

General

Target
Μαχ_vιdεο.apk
Size 432KB
Sample260623-pdg7macx2z
SHA256 7bacb2857b13fd33a7d1e9245c434e56b703358fe3ac96d6a3925d5309600ed1
MD5 c2757f9d1631582c89ee6c38f530404d
SHA1 7d8f22810b882ce2e04bdb5882c39acae5ed869a
SHA512 0929114c37f988040ce25ae1e796e0492a1daf35003d53240001304392f60ecd99870cc807b952b85a75dc6f1e855b164d738ef3914cfe0a9a5d9ec1a77497d2
SSDEEP 12288:mBNb8bcrO5btNYI2+f+Mv+qUGqUlE0IekjEjNg3ZJ:mL+btNT2++Mv+qUGqUlE0WEj4J
TLSH
T1A2940157E31136DEE1F6953B5A47136640338E348A935BC76E64F23409BA3EA874E3C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	ru.bqwlef.qbbeg

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ru.bqwlef.qbbeg

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ru.bqwlef.qbbeg

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	ru.bqwlef.qbbeg

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ru.bqwlef.qbbeg

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ru.bqwlef.qbbeg

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ru.bqwlef.qbbeg

ru.bqwlef.qbbeg
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4853

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Process Discovery

1

T1424

System Information Discovery

1

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

c2_config.db

Path /data/data/ru.bqwlef.qbbeg/databases/c2_config.db
Size 20KB
SHA256 f5681ac970c359894422fc91ed4a2415b57beb9eb3f25f575fb65147259ba911
MD5 ebab927beab30dc40f9ed3c3eaa48206
SHA1 fe32969461383c943790d420e4135bb09e4a4f89
SHA512 f80f379678d573a33ff9c441c85fde1c5abc36c636945bc0ecfeb31a5ec6cf76422efe7eedd4b37ad97b624b953c97e20f00394acf339a74f1a0d7732de17212
SSDEEP 6:l9bNFl8l/yl1nlQloaRGAd3MFCLuY3KrBxgERio4D/GLCgf8ERX4PBX4ogLugMBa:TLyKWHOrQid/4DWCo/RmBEyPbAVOwB9b
TLSH
T15092ABC74B041903C1590D3AE4D783E40E625B9E421CDF47268228983C2248494B9E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2_config.db-journal

Path /data/data/ru.bqwlef.qbbeg/databases/c2_config.db-journal
Size 512B
SHA256 ba05a47a47a6c011768980aa163896a82fa49980e2e7cefd6a47653f502ae519
MD5 73bbb592808de3d82800fbb8005cf0a0
SHA1 ea88920e386983a7c81e4d41a013c22d2688fc9d
SHA512 0d008900ddc6d5b9b42f4fbc8dbe7e8d77babdd09000f749bfeb393a6c42065444fdb1ae2583a51609def4e7f053987210a465da2665ef253f6e705add024e04
MD5 SHA1 SHA512

Submit Download

c2_config.db-journal

Path /data/data/ru.bqwlef.qbbeg/databases/c2_config.db-journal
Size 8KB
SHA256 ade1a9f4b2082eca23ddf1f0112ff7c882d20266859ff3105fe814f113e1132a
MD5 c56b5543b28235da04ca24c0ee9bf5e1
SHA1 f8500e816d6034cd67fb8bc817036d24c240f965
SHA512 52397d5ee90cc67ac9da6c0d8b476d67320070652efa91fea707cd251b5007a5078a3ab6b70bfbf9f1331dd114bbe405ac79c51d13e72f48c6084ad8315bc282
SSDEEP 6:7+/l96jHn1wHhWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKiF:7+tKyHIqLiuWdYRmBEyPbTF
TLSH
T16502C0DCA3800823D82D9A7F90D5C3641D20E72C8575CB1716D2089C3C0F4CCE4B0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2_config.db-journal

Path /data/data/ru.bqwlef.qbbeg/databases/c2_config.db-journal
Size 8KB
SHA256 7713034dbc89bde7dc11f084a9cdf9f586c3900910c5c815762506e1f763e944
MD5 6f86ae6224a32b5c9fca0563a986bc49
SHA1 8b78e9b0f2bf646cf2fe46c1b6937662aaf80061
SHA512 5bafbac366195dc2f5fc47fa0e112c8b3fe270613ccedd8e057095379161ff2c5293cde3d282d27cc5857b842098b8359c8e7a12fa1dc01536b8cd6b30273d68
SSDEEP 6:7+/l91ZqFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKI/Gl//xn:7+t9qBqLJdeWRmBEyPb6Xx
TLSH
T10602228863401A03C02B1777A2C883405E10A7289223CB47269109682C06ACCA8B0E90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2_config.db-journal

Path /data/data/ru.bqwlef.qbbeg/databases/c2_config.db-journal
Size 12KB
SHA256 5b6df6bbcaeba2199417aafa19d009defee04a5cad24cc0e5f048a885cb4d90f
MD5 21159bde4694addc69fed716b83ad261
SHA1 476ef734595327bdb5fd15e8e5f0af7d246cc548
SHA512 8868882d497298e8ee1405ef6e9753373b23eb5e3d9f4176f0f4591d3be5b38d7b0ff4a172e1a276ebeb9d1e29e92f9cf02374e45e256f47d081b13ae8761dd7
SSDEEP 6:7+/lX6Yug9bNFlq4yl1KlQloaRGAd3MFCLuY3KrBxgERio4D/GLCgf8ERX4PBX4T:7+tqYuqLmhHOrQid/4DWCo/RmBEyPb0
TLSH
T1E442C08B9F081C13C55A4D71D8FA83902C21D7DD4256FB43179318982F0348490ECD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads