75b8ea912f87586a32e48bac489be8e63aa66856840f1b2b98e77820c6ee4b82

General

Target
103adZccGP9.apk
Size 11.4MB
Sample260624-pg4vssb17m
SHA256 75b8ea912f87586a32e48bac489be8e63aa66856840f1b2b98e77820c6ee4b82
MD5 cc924e31d183cd64cfe696e289ccdb3b
SHA1 a27bb688cd69ab0d5a0d52b24711c1c4018a4b9a
SHA512 456b006efa1e0303f305df920da2d956ae8d57b581a0dd43d2b3ab0628c87f9c46a5d2f5b8f8f516eeb485d96804fd136bfd4ca341b563b383c0a64aabe7fbc6
SSDEEP 196608:TsrzrP94c/F6Xoh1MXyqCvdH+p84xnqlLMbiZd5BL0LC6Rr1G2zwW3JCx:T+f1H/F8oh1MXyqIdeWyqdM+Zdn2G2z2
TLSH
T1A5C61287FB84996EC4F743B245769766514B4D368B4387C37948323C28BB5E02F8AAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.fiuqf.h1av.za6.zsxj/app_p_dex/payload.dex	5117	com.fiuqf.h1av.za6.zsxj
/data/user/0/com.fiuqf.h1av.za6.zsxj/app_p_dex/payload.dex	5117	com.fiuqf.h1av.za6.zsxj

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.fiuqf.h1av.za6.zsxj

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.fiuqf.h1av.za6.zsxj

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.fiuqf.h1av.za6.zsxj

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.fiuqf.h1av.za6.zsxj

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.fiuqf.h1av.za6.zsxj

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.fiuqf.h1av.za6.zsxj

com.fiuqf.h1av.za6.zsxj
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5117

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Subvert Trust Controls

1

T1632

Code Signing Policy Modification

1

T1632.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

payload.dex

Path /data/data/com.fiuqf.h1av.za6.zsxj/app_p_dex/payload.dex
Size 8.2MB
SHA256 6613fdd2948acec7af15bbd08a08a976a83a8299a640fff023fd05589e189dfb
MD5 15044a89229da2aa3f71f8f944743211
SHA1 5b680e99b33df2fcb4d3c9c02669fa7a26a32099
SHA512 d5dc18459c4a8f4f8cf4a26161bd23aeb86d6435c5e6586d5c46ce2065216e7c0a7d4ebc5b1244b328c6a9c318f4823fbe5d4eb1528beb7f1cd0f6070ee636fc
SSDEEP 98304:oGPPSrGmMqBXmt3x/wQtae88kErKeultb5T92U:fnSrgtae88zKeU
TLSH
T1C596AE2BBA554C37E56E433B28FF4312A733728BB7C75F56154491BCBC822C16EA9284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google_Play.png

Path /data/data/com.fiuqf.h1av.za6.zsxj/files/assets_i/Google_Play.png
Size 25KB
SHA256 48a59feb4aa446c3c6c6343dc5163e127b4cf4609fbbbe4bdd1dcf3f0e5dc895
MD5 862d282e3de9e4ad6e75572ac8c01c19
SHA1 970d6879146e2b7155055f35c644afb11f7d448c
SHA512 9b90dc3e27fcd25aac7c0fbcef1587cfe63c5ff1532b56829c80705d4cbba81db78f374ca977b61a23c27515d61a9392c038b29947e732aee43aa98b543f52fe
SSDEEP 768:vt37Ml3lt2rPAIvAv1jrXf7hqTdzvm5t/5N8njmaVrV58a:137syrpAvBrXj2dqRyjzVj8a
TLSH
T1D3C2D05CF356A5F8395A006E686F9C585F08E2DD191193E880278F376DB19CFF2E13A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b.apk

Path /data/data/com.fiuqf.h1av.za6.zsxj/files/assets_i/b.apk
Size 5.7MB
SHA256 3c2a2b364cc0e0f5664ffda0ac891332ec2c5edef2c05eb5d48b3cffec10a883
MD5 004397380a37c970364b597a6990aaa0
SHA1 ab9eb816540f965c5c8029ce8689cf4d5b71db7b
SHA512 016f9b1009dd66196304071d4b899a1363772a1fd504c5fb46805c19a4aef73a21bec5885f67284117d03ee13b74906a83e13317dfa51d39ecec6c69f7163eba
SSDEEP 98304:rTEZwEuZmlEYt58hh45wJ7nMe3XtVksYNKRo/Krr5FkJqNt7inMBlL+dNM:rTEZO3Y/8r407btCgSJqObk
TLSH
T18956F08BF740996AF4F743B255765322E24B4D268B8392C36C54323C69B76D07F8DAC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baseline.prof

Path /data/data/com.fiuqf.h1av.za6.zsxj/files/assets_i/dexopt/baseline.prof
Size 2KB
SHA256 83c12efaf1b2338a1ae6899bbd543b19e01c0ba21d1130e72fb8a6868b2c409d
MD5 059f3958ae58d8dd9f3dfb4785672a71
SHA1 90a138e73d8a9b9ff99fae300474e28380230db4
SHA512 996e08915a6b2c8affc29dc31bf60d0c0fd13638377de41fbfc58da088463b718a298965b0bb99e7fc5af9e3efe1178617e20371860b9c53ea39768bacfdef89
TLSH
T1E6515D172BD9A650C573D0E2DCCC12118B64C0F38FE805D6E0336AA4164E750603B467
MD5 SHA1 SHA512 TLSH

Submit Download

baseline.profm

Path /data/data/com.fiuqf.h1av.za6.zsxj/files/assets_i/dexopt/baseline.profm
Size 240B
SHA256 b17ef32451cfca08809c2044d28641f27323623ba9088e74e0952cccb0808a8c
MD5 7469b1184098a5fd5f13940d81a53e94
SHA1 2ef4ae059fb768ad5d141a2be6dbdd9362229d5a
SHA512 61a0e3a653cbafb97fa305bf3efed8aa90c7567756231bf4751b2d7d40fdee1aabc791253c5e60ed61a2fe3c7e65477970e8804121a60f197578373893c7e321
TLSH
T142D095C438E4D3105A44B5D3407F977C714C0D79F40305454ACD031621E926343710E8
MD5 SHA1 SHA512 TLSH

Submit Download

installing.html

Path /data/data/com.fiuqf.h1av.za6.zsxj/files/assets_i/installing.html
Size 4KB
SHA256 a3f251208047be980d6861ab759e2b911c07713e884c76342c03e621ea15c096
MD5 144950a19d53179b5187531b9bc8f7ef
SHA1 42a0c4943f7f339eb28ccc85ebb0655f58e2521f
SHA512 df64a912898a3eb73a86947ac0af559764aeb18d2c0d08d5bf251afc58d5d5ccc10c7b66eb11c60c130d16b6178fbd8f74a5e79752a117478f13bcab16278d2d
SSDEEP 96:uEXIYC68faHW/vKv30CfMfwIGzBD6T1XXb:XXIYC68ffvGv6FXb
TLSH
T18A913D15A865051A56B3D33E8FE7032DFFA60183830B53553EEC22468FB2A958893FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/com.fiuqf.h1av.za6.zsxj/files/profileInstalled
Size 24B
SHA256 01701f793775871694a45ca6fd130f844b3e9315ab341f4d2272ec2d0ca76e13
MD5 b1840bd58e6852efadb6e806aa4e9d22
SHA1 0d30ca8a5264c0f1c44eba1ad87430d772823818
SHA512 a0a758fceab6e32f9ae3d1ebc404bc63869d30f34358ad2eda6443c638c3b79f5e0b3dc03a5e9c4947d6c51ebd340b37f3ad13281651562b936019d7a5da60d3
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads