2af0c41419c32ef4b6bc59fb1aa1aca3b1ab127393924480b415a13d0aade7e5

General

Target
Фото (2).apk
Size 4.0MB
Sample260712-e7j8zaey4t
SHA256 2af0c41419c32ef4b6bc59fb1aa1aca3b1ab127393924480b415a13d0aade7e5
MD5 ba3fef6981ac6564278ec567502e14f8
SHA1 ebe9a35957a7d6c77c5bf088c9d08070938723b4
SHA512 2a598c17df577df49e629c2c68f86776a3748cff82b3bce33f92ff8bb59d4d64da79dd862091206a0f72f93e458efc0aef20f793f9df1d842d4cb9f91e21cdeb
SSDEEP 98304:7SdkHScrMbF824woFNRfmREqOiOfrQrQQReWnwo7eVCHDZry:eAR6TONRrqiRw1ekY
TLSH
T189162302F3A4DE0FD876DA752CA29A781026BE11DE12A38B7018777D70B76E84F907D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Checks known Qemu files. 1 TTPs 1 IoCs

Checks for known Qemu files that exist on Android virtual device images.

defense_evasion

System Checks

T1633.001

ioc	Process
/system/bin/qemu-props	org.softlab.manager

Checks known Qemu pipes. 1 TTPs 1 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/qemu_pipe	org.softlab.manager

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/org.softlab.manager/code_cache/d.jar	4158	org.softlab.manager
/data/user/0/org.softlab.manager/code_cache/d.jar	4222	org.softlab.manager:g

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	org.softlab.manager

Acquires the wake lock 2 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	org.softlab.manager
Framework service call	android.os.IPowerManager.acquireWakeLock	org.softlab.manager:g

Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	org.softlab.manager
Framework service call	android.app.IActivityManager.setServiceForeground	org.softlab.manager:g

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.softlab.manager
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.softlab.manager:g

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	org.softlab.manager

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	org.softlab.manager

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	org.softlab.manager

org.softlab.manager
1⤵
- Checks known Qemu files.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Checks CPU information
- Checks memory information
PID:4158

org.softlab.manager:g
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
PID:4222

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

User Evasion

1

T1628.002

Virtualization/Sandbox Evasion

4

T1633

System Checks

4

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

d.jar

Path /data/data/org.softlab.manager/code_cache/d.jar
Size 1010KB
SHA256 dff76356499f32d3b7e14680a675392da13036d53123c409cd1792fb9883d7c3
MD5 4798831c3fe00454115e80f5c1c40c2a
SHA1 2554b764e964864cebb32a1fc6239a6dbd7257ea
SHA512 867193acfdb69c7035fa69b729e5f66f99be44b94787452a1d638980eb0b51b3cd2f61e2016f2d7183a51960c6d3d3352764da488a4dc725352a3d0fa9ed721f
SSDEEP 12288:0bN53Z50Fd1OvuqsKCFZZJdrInrOkYd4JVydjpumsWhfuhYD/vRgBIIx:uN53Z5abOfgIVRWIhi/1M
TLSH
T154257C8BD6DB6E33C43D93B648BB639477B6A2477B438B07141890B97F471C08AE6784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/org.softlab.manager/databases/com.google.android.datatransport.events
Size 56KB
SHA256 f1dc729b62cc9039afa9781044199b00d02797c634030406dba70895ddf35180
MD5 b2692d05fbc7998bcba5cd0a25712fb2
SHA1 110b36ceddc925ec7f00963015dabe2618063be8
SHA512 b0796f83b6f1983ac1a11ae4aa1f9147cfe321e2eadb3ba1e992f657e63ea8fcf195df6f23a2fba6a58eda94ece112979d43d8d2ebb1fe62d7706a00ba838519
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSA:RMEX0wIyNjaA
TLSH
T10943839D5A2C2220C57E283EC3E143635B3C93DF1B23922239908CF98DC202974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/org.softlab.manager/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 f841d3f7e0451c14c53c89625718ace5173ecbc2e39b3b0fc651f695f589e486
MD5 bf1cc08f25839d37bc808dca778dfb80
SHA1 fc534cdbb50c9122f8e511b7940fcbd573787bcb
SHA512 6feb7b640e8bf76d605c5bcfbab747c1d7f0e717c2442607859709c5193f1af5c046dbeb4bab328bc3805ae8c119a2a26c147633d97c316aa5bd0b938b0d3c5a
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/org.softlab.manager/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 663443f845b8ca2926bfb811f5e4ddea5a2c4aef45f55f4edd9b79e0dd17ca6e
MD5 158031bded90a6293df0548304380b20
SHA1 fc10b2dc990c157d1051e410409573d77e9eedfb
SHA512 583ddef1673fa2fafbbe382061505d7b5f25ff9c52c2281661783c936a828419501b2da9cb4e1473a6ec10ffa734e24b7e65c6fb553206e2910909122a3c2ecd
SSDEEP 12:Y1oBK7WTjQAEtQm2nzNP5cHDPIDDszVDkhne21iscPkOwxvqLiuWd7RmBEyPb5:YWBK7WIT+cMDFe2awxvqLiuWmGS5
TLSH
T1EE02659AEBD10A4AD089A3BB64D4A7410C18172303158F973E980CF09C40AACD21BC88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/org.softlab.manager/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 614ac4fcff91ed3f0c8422d451fea573ef9216dc3732a4be80de7683bb305521
MD5 481bc36c29d5b25e50de8acad077cf19
SHA1 5dd8e71592f657314a4db7a20195dc824f4ca3bf
SHA512 fc8e2ecc4c89c406cef1204242fecb1234ffa93f945de50f458d7187c661ac55e3b5280ccff3daecd1e9b114cfab1455e4303d5e19fc41d1fa6f02c85c652330
SSDEEP 6:7+/l9LPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK43jl//I:7+t1qLJdKBRmBEyPb91I
TLSH
T1AB02129D67410D13C6296B77A0E983582E10A7258363CB67599508746C476CCE892D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.pid

Path /data/data/org.softlab.manager/files/.pid
Size 4B
SHA256 aae49ea590f262f6ac48c5b7ced9469d00f15c4c398533e0ff28c8cb590a4c64
MD5 3e3aa687770f55c704ca997c3be81634
SHA1 16cae4ea9cb650e849036c7331e7737c94a217a3
SHA512 f53a955558d60002311a7ecb3f69dfe3d1853047dd98cf46741c06c2dd309b7d67ea30323104cf0f994071c5b0d4d3dcc19667bbd1706324ce1d2c052e0ad5aa
MD5 SHA1 SHA512

Submit Download

PersistedInstallation459893914545443985tmp

Path /data/data/org.softlab.manager/files/PersistedInstallation459893914545443985tmp
Size 90B
SHA256 5e6d95210b97fb121900a3c5744896d7cdcf113344d8cda1111e10017deb9ff6
MD5 350a1c97a89cafd02caba9db555e3d87
SHA1 2a47d54b5a5ed607eb969d0c117cf642333f072e
SHA512 969c5083118a93c9f0b69fd2da5cf42696383ff8d9b23290657901456353309e7286a3566d18bb14fe1ef6aeeee0592c9e07d2505d0170b3760b177658612b13
TLSH
T184B0121086F18181849AB30B1C4CD2401E842884160D8F044A5CA48081812E491439D4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation6072186834726795554tmp

Path /data/data/org.softlab.manager/files/PersistedInstallation6072186834726795554tmp
Size 569B
SHA256 55ba0aa0fe0d94a1bbad6e3bb52070337054544beccee6b14067ef15143cdf96
MD5 7f3590b03c2063d529e3e391da44f363
SHA1 59a2f705ba259eef614d8c2744932c4be798bf68
SHA512 a59b345196d4ffa3e16251f518fcbb31f851bc1af3ab49b2c3ab4fa70aebfcf678ef023c10fad2e095d089f011ea51bfa8b7916c26c8a4ba7822a4cea33e9186
TLSH
T19AF02065169143CFA4CEB3C3294DB8100E6528B957861D92BDEE08E2E9A8E67624F448
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads