2a82f6b5d79255fb8f741970518490c1ad591c0b256bd73c5fc03c63efb9396d

General

Target
hajari.apk
Size 3.6MB
Sample260628-amd41aev2r
SHA256 2a82f6b5d79255fb8f741970518490c1ad591c0b256bd73c5fc03c63efb9396d
MD5 2edba87bf4ebf92d4c4dccfd153f1756
SHA1 13f8d8150ed3c38f79be8a7fa3511a60377b7a79
SHA512 7d4d3ed00741f6c050162c78cea1bed6847354845e8024875c074dee41634dbbe49b9dee51e12cffb48e030af43066b5bdeb849f283cfab2067edce1975625a3
SSDEEP 98304:S1/3rP/vCtg4PjQI6zVkx5jMQ7L82X5lX4wLi80xyzVYgu5:SOxrQIV5jMyLXX5N7Li8xA
TLSH
T1BA060242FF68DA2FC87380331D9A073512569E1EC692A74B64DC772968376E80FC9BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.hajari.customer

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hajari.customer

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hajari.customer

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hajari.customer

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hajari.customer

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hajari.customer

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hajari.customer

com.hajari.customer
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5026

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.hajari.customer/databases/com.google.android.datatransport.events
Size 56KB
SHA256 1e916b174cdc1762c7ac50842d092c03ba86e8efb2a50a7a4186685c1d445c60
MD5 cb07d8c302f768b2a66ed760e898f4cb
SHA1 91f4884d0827696dfc665876f8d6668fc37be7e0
SHA512 90f85e1befb2319d40b868815931d9237c50d5ba9bc7197e9d3c51db775378d2b9972df0ea420befb222a16d1ce713f4d87b913ede123b9797b595ca2e2acb77
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPS4:8MEX0wIyNja4
TLSH
T11943639D5E2C2221C57E283ED3E143635B7C93DF572392623D908CF98DC2069B4359A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.hajari.customer/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 cc90923c7037a795f7b7cbe1f6f4b4d86ae06a26c92522d070d77353b9c205ca
MD5 cd2b87e244d8479a90b8a2c71a4f366d
SHA1 a2d169913170b8c5908f319a9d5395cb1d4f7b6c
SHA512 6ed290edce90af8890eeab7a529a3292443e343e5a88d20dbd210d780c5c6c7338bc8e91090e213de5be79f7722bfe9c242b1c1b3c6189699b35420eabc57562
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.hajari.customer/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 694aee36a69e68b0da114b9177d21a14093d9bf7c2989d353b1caf306436bda3
MD5 208247c68cdc3a5eeaa6553c45fc9ccf
SHA1 83d36029ea71b0203bd726172c73a78ba46bd8d4
SHA512 4894efc622b5a5ca54aa960a0a01111046212c6ea716218ad0dbc0de95a9c1ec39b7f9c3bab2b44f273058fc04cb776d0e1a90161692713b7f4801ab79365efc
SSDEEP 6:7+/l9As+n14mg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKg:7+tTNmqLiuWdwRmBEyPbj
TLSH
T11F02228A77900862CA2936BB90E483410DC0E7198161CF0B156008D83C078CCB8A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.hajari.customer/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 a591c446e678692c0ca1c1dd46062de17a20f17a5a5fb1ee6a3bfa9856d7961f
MD5 cc5e48cbe70651bdc6101a8a07b11bfb
SHA1 0bc46a122288faa241dd6169318217c59f31a3b8
SHA512 18f9723c271a9856ba703e32d210c3c0ac243b56d206378e29d9a5536b331bcaa8570937675a97bb39d3cd169e892c1b8af4656936a2e85850cc816e88e45f19
SSDEEP 6:7+/l9TFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKfxkt/q:7+tjqLJdTRmBEyPbqi1q
TLSH
T16802228A67400C23C9192BB790C893482E60A71482A3CB5715700A9CBC0A7CCA892D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation3085008128446745826tmp

Path /data/data/com.hajari.customer/files/PersistedInstallation3085008128446745826tmp
Size 568B
SHA256 2eddbe6ac3a16e93c88c8d54db4af1fc708258be2ad15875a197322f05e89dc5
MD5 7df3255a790bc957e8a9365f7c124714
SHA1 35fc71cd47d94b64f9ab21a96212b6fbb0fb8196
SHA512 0a601f727b6cc6cbf4ebc8c4f950001f96ee8e966a13f2eb45638ee2cec0b2c3a5d8f443de01ba402fce2c6bc90786f5a7f7887401ba1362440ebffdd2a5d47b
TLSH
T14FF0208716C0C208D5DB578724C939260E135DE92E051D6F7FFC9894EEE119B964FCA4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation8296306894518871075tmp

Path /data/data/com.hajari.customer/files/PersistedInstallation8296306894518871075tmp
Size 90B
SHA256 340c55074966006970f116674c7bf2a44a17ef173701f73d6b6b549a1e204d12
MD5 4d8543e068d90a413eb4418b644f75ba
SHA1 eb9a21f93bef70d96287d09fda2f99768dced48b
SHA512 3c80ffe0e2af4fc2cbb72a46655efd86d5b0f74d58117f591b538f6835fc18e2d9f70b36118b71739a62694be7ba1716e8dd887b4f121d8d3a624f643417984e
TLSH
T1B9B012014671E5519AC9A3021C8DB200AD5118C10449CB0C9B0CA44080C12D58203EE4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads