57ffc12f446b77a387b81096a02106bccb6e56d07000b75f7c503863af6c1635

General

Target
rk55.apk
Size 2.9MB
Sample260722-ph2f3a1vgz
SHA256 57ffc12f446b77a387b81096a02106bccb6e56d07000b75f7c503863af6c1635
MD5 2d0bb9ee642b965b30f6c0225efed084
SHA1 5c9b3506f39cb42b20e83f3725ff08fac82a9907
SHA512 9c54a85c88e3e759006507a0f844a6f543652a73bf4b9affa0c9b1fa1ca335636d3e42c67205485653a25de159b378fdbd7efb1fc2b2468c86235fb1647dbb40
SSDEEP 49152:QRh6ZY9JqQ47IfdZjnNAqIlveTDmnpKaTVrodBjnNAqIlveTDmnpKaTVAvSumSc9:Qh6Z+JS8VxnWqIlvhBrodJnWqIlvhBFZ
TLSH
T1DAE50292F729B62FC837C0362D56C23521229E16CB93A703A46437BD6C7B7D80E59BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.rk55.com2

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.rk55.com2

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rk55.com2

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.rk55.com2

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.rk55.com2

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.rk55.com2

com.rk55.com2
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5115

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.rk55.com2/databases/com.google.android.datatransport.events
Size 56KB
SHA256 50cf0e11a0cd3e1cb8eed3f470b0db1202d865853cdc2dca9c134e252343adff
MD5 5e61697efa49d49d5e09e508cb79195d
SHA1 3d272d13507ba5428e286a9954a8f00758ae5232
SHA512 4f9fdef74897dd31344a74ac605c3df853ddd6dd72f895370cc48a49ba74cfddc50738985c6040b4145b59da4814fc8993e492c80d4b5573429eb13291474c93
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSg:8MEX0wIyNjag
TLSH
T10443639E1E2C2221C57E283ED3E143635B7C93DF572392623E908CF98DC306974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.rk55.com2/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 552d5a7d4b5d49fa496c50ad25737a615b7a4b2adb8c2bb52aecb92465c912a0
MD5 3ebd4cbcc3d9555a552c51f72328bff3
SHA1 7dd147a6c00a6fe79cfa05c274d2b9f15b4697c8
SHA512 3f0d0d199621aca56ac461af638ccff9a75faae785f883fc66a68baf418dc5fe65c61cf9a735e9d00ad1e2e1a650a06ff27f32f21272dbbf442be4cde40561c4
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.rk55.com2/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 930d29bf93c9e2117bd9edd6cad2c959805ca2fdcd43223670853a61080b6428
MD5 fdde932ee12d6f85e8c120437b550e04
SHA1 0b925b5ba516d6d185094b15de230ae5c518394b
SHA512 7e23b813875cc89e4ebd901fd32d0d3a602bf0daef05b438299d8e7eb0c9d0dc86bc64a17ad56e0f323c0c345740f0fd1723dbcfb0bf87310fa830974ff7fb25
SSDEEP 6:7+/l9t4An1Wfg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK24:7+tMqLiuWdwRmBEyPbH4
TLSH
T16A02229A63800822C9191AB7A0D583F02D10E71989A5CB07397008D83C435CCACA4D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.rk55.com2/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 8ecff7012a4ca3ebd3167aa6834b4a4d5e429a1f4aba106a823ba33af6bc8d59
MD5 670470f2c9fa98602c3ac125c9063013
SHA1 9d83ba32c076ee1cd97e8a92a17b88bf9debdccc
SHA512 536ce61b51728a4ecf3d5ec37a2f36e865e25df21c8f0eb42917884cda580a33605c3dfa1b5a05d0c162f0fe47fd175a0f9744dcaa60f68a3ecf4f5e2d60b0ef
SSDEEP 6:7+/l9gGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKiyC/4:7+tu6qLJdTRmBEyPbTD4
TLSH
T1690212CDA7410913C61957FB90D983962F50E7158363CB9B36601C987C466CCA8D0D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation6406148083012221236tmp

Path /data/data/com.rk55.com2/files/PersistedInstallation6406148083012221236tmp
Size 90B
SHA256 1401eb4f95876f380209bf65e15b5667f391631aa9e70893ca02bf3350233cd7
MD5 df813c657f7907c452a79c52e73297a2
SHA1 fab6938dbf1cae58758282500146791dd7dbb635
SHA512 88d145950aad166f3bc1454f8c0c35f65264ce3fd046118456144bc16f4a360be3d5f20b5f8948492f917c4cdce7e57f538a14c489751ec1dbc03666ef3602a4
TLSH
T17AB012004FB0C151C4D7A3021DCD91102DB11481541DCF590E08D86440C12D09223994
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation6487402433528143067tmp

Path /data/data/com.rk55.com2/files/PersistedInstallation6487402433528143067tmp
Size 569B
SHA256 59a772e5db793b32d98c3ef73b37194980b42240c17839f13f9ee051b5456971
MD5 7351a3b2c6c3a9e227b3a7e720d5a2e9
SHA1 5e90242881e87e7711edb7b7a1a71a1dec240325
SHA512 a1c1b0554e6c44f293cfe1ae149ba21f0cfd03a90077ff85c5a2b2a2ae5dc3359409f426e52342db7c1ddff1de87a1caaca4ca74f20ac1d125865e21adeb7590
TLSH
T1F7F0264E2671C90DD5D87302279CFF111C0C2AD1150586BB7FEE865519E0AFFF567190
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads