7de9f9cca026aa2003436faf087d2b57eeaddb5b22971cb07a728a88a5d7fedd

General

Target
com.kimcy929.screenrecorder_1.2.6.7-349_minAPI23(nodpi)_apkmirror.com.apk
Size 4.1MB
Sample260719-wthawsaz91
SHA256 7de9f9cca026aa2003436faf087d2b57eeaddb5b22971cb07a728a88a5d7fedd
MD5 9352453802d01472c0dec4f1ed3c0854
SHA1 97908110d716f0d2b368ae27adaaf2c80b667fda
SHA512 cb92cea3a83eee754222d6897e65f18f79ec830fc2e0e95db012f34fcdc981dd6fe13ae1818f3601275a4b76ae3d4a338688b604ab1ee026969b009c97a42830
SSDEEP 98304:LZHaj8bfrZ2acqf2FuiKt14rdz6Vrh0CD5LTx7:LZItac6/iKt6rAVrhblV7
TLSH
T11416CF87F7699E2ACC7240B24D9A6231266A4DE68E8397873D44375C38771F81F49BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.kimcy929.screenrecorder

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.kimcy929.screenrecorder/cache/1582435991586.jar	4760	com.kimcy929.screenrecorder

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.kimcy929.screenrecorder

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.kimcy929.screenrecorder

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.kimcy929.screenrecorder

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.kimcy929.screenrecorder

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kimcy929.screenrecorder

com.kimcy929.screenrecorder
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4760

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Process Discovery

1

T1424

System Information Discovery

3

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/data/com.kimcy929.screenrecorder/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
TLSH
T1C412AEB4BF77093CD0DB0DB8CA67E800A05F25841AA7D514E0656066BFD47B5F1E315A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb

Path /data/data/com.kimcy929.screenrecorder/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.kimcy929.screenrecorder/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 515ee42b137cf6b80696e2ca0e6e5f11c33315bc6a0b78e81cc067eb18d36ca7
MD5 6359c4de232264a71db4d51b1e9fc023
SHA1 e6ffd95877c85fbd12a15b58888d9dcbf9903a18
SHA512 3433291aac069676f550e1025932f865ba076d627335974caf9e8af39a2539fbc383de501de2f6d6b4377770b1752db22d133ccd4f10fc930dc94f19ab387c00
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.kimcy929.screenrecorder/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.kimcy929.screenrecorder/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 40b0dbd56d308405fdd71db60dcbc46c23a5fbfd6d378fe77a39724871ca0015
MD5 310b396fe142f713a97a9ce5e0d067c4
SHA1 56559dc81f949867b9b2d04cd89db60305d89c51
SHA512 d39bf9bc416c8de69bd77613812e4dee40b9924f25c393c1db2934a0e199facde737c3df1b9a5b632a1a65b0f7b4346ecc0501205f42b97717a20d19eede8e3e
SSDEEP 12:KfJ5xUJdJzdeWRmBEyPbP/dJIasjsODOw2:KhnodJzKGSP/fZsjsI2
TLSH
T11472125493811977CD1D52B274D8C3412DA0672D5393CB0F26F219766EE27CFA594D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.kimcy929.screenrecorder/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 9c77dd9b18d376a6610f19270c56393f9b625962c3691954ae60401f8caf86eb
MD5 e6c140b8fb9fb68a53b8916869b4a2d4
SHA1 16b991c8238986c452b8d48bfef773eaa4ab029f
SHA512 c4f159fc3b5abebd0193b6f02f2d9e228ce1c00472ff9e066fc3a53f27298a99ad0f3630adb0506d5d0593722ac5f9058f0d1e8105f3f39423b91e3e0a28879c
SSDEEP 96:IkZ6+hdjnHtDRMpf8UzS5+TD8q0ExPaZd:rVdjnHt9Mpf8UzS5+TD8q0E5e
TLSH
T147B3104E0F092514CC9D98F0A5901FA17D3E423E9793E3EA69E10075AED1922DE29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1582435991586.jar

Path /data/user/0/com.kimcy929.screenrecorder/cache/1582435991586.jar
Size 20KB
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
TLSH
T1D592A457B3918563D57CCD3F3A3ED390EB20B210CA23970728459AAEBDEA3D525D1AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads