233da440b7f997e6062f0acf6bb98431df52e8d94351aae4f471fbd739aebd54

General

Target
cpc-daikin.apk
Size 6.0MB
Sample260724-tk35wsgn5x
SHA256 233da440b7f997e6062f0acf6bb98431df52e8d94351aae4f471fbd739aebd54
MD5 bac0bd5ab7ebd789cfcffb920d725c71
SHA1 75c1c6cc49f5a972b4f17479f8bb58b441ec9ebf
SHA512 7ec2a0711beb82d889e77c3c5de7520f45e54e3a8d3ec72388a0cc9ee079ab361a1b8a6996f4e64c424b1da7abb41e936a706e418e3a9ef2122609d794c37d3e
SSDEEP 98304:3AfCj8j3YBaywqn2sPbWpsrSJjlQFWlGUP7ylEylbOHGGQoa1IosdiSo/KrgUMVO:3MCgEI0WpxxlxwaylJuQo3iqoO
TLSH
T18856F1DBF7D8992FC87340B289AE52B1165B4D128A839F476D44371C38B75D81F8ABC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery execution impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	dev.cpc.daikin

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	dev.cpc.daikin

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	dev.cpc.daikin

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	dev.cpc.daikin

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	dev.cpc.daikin

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	dev.cpc.daikin

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	dev.cpc.daikin

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	dev.cpc.daikin

dev.cpc.daikin
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5090

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation5475680340499533531tmp

Path /data/data/dev.cpc.daikin/files/PersistedInstallation5475680340499533531tmp
Size 569B
SHA256 a5cd108039eb6c3fc38afbf982d656ac55de525bcf2642eaecafeeafdc0173ba
MD5 31ab9fa9d98d64277e299aa11351bb62
SHA1 7b08593909085968dbab3d1209c20a1b6a1eb9db
SHA512 d8749ca7437ecf3ebbeb886a5391358a728cc3ae0205cba483879a047463528abf66c8db67a05b924806202016916b024ab68da1b95bc27a8dcc69ce304af95e
TLSH
T1C4F096192B57C337E5414343248E7C400CAA0CA41E6F9CC8BFDB8DB8CAF08AA210F078
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation7692039198404000323tmp

Path /data/data/dev.cpc.daikin/files/PersistedInstallation7692039198404000323tmp
Size 90B
SHA256 0b57503c6058e7ac77738c2498a5c3a787b415d8ed0df393cb717e7ad1c69458
MD5 60f7375f88c47b699aee2c148d112182
SHA1 c73230d4ca3919644e29426a03134127af38625f
SHA512 219209ced4a796cd4af2421e74b78c2f8ba26d0505a205480b82035eefd3a7e550b1a0bc1566462a22c513b610d4b9c967dc7305de6347d8cc494ffa3d143118
TLSH
T149B012009731C1518587A30B1D4EE2801DD21D40050EAF840F0CD05085C12E08703994
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb

Path /data/data/dev.cpc.daikin/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/dev.cpc.daikin/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 19bf85c274d6a1ba25c095313ad881fabb83be849ad9c4bac77bff4e64befc5c
MD5 e4a083866ca078bdeeadb38183b48061
SHA1 f03db430a07037fd81fcd1b9fb825474bf4d1328
SHA512 9fdaa8c2bddddaa66f99c88e44636433386f256f33404224db867d07e71c4d0cd48d7bb3b9260d27528c3bae5687b3c1ec62645447a1e497ec88202bb86b751f
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/dev.cpc.daikin/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/dev.cpc.daikin/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 8fbea3de68732cf8166ad07f3a53fd72ca0aec95c8fcf49358bb8482d8159aa7
MD5 a18d5bd1aa87ac61fbe7886fe4edee20
SHA1 3ce1ef9eebeb62b1caa37c52c719a39bcfccee74
SHA512 b48d6115cf4619fd9816cd68da597ff79b4c474e450dc1485bcb4205a883521e684b69a7e43cbb9ef96e271be094a8f06718385de42851d396d24a4f10af88ba
SSDEEP 96:UyMle6+etidjnZRWzzb8/KeKcK+zSKddKz+ZD86u0ExV:cDtidjnfWzzb83zSKde+ZD86u0ED
TLSH
T1DFC313CD0F292600C0AD55B0E5E00BA1793E456E97A7E3E179930075ADD2A25EF25CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/dev.cpc.daikin/no_backup/androidx.work.workdb-wal
Size 261KB
SHA256 622f92fce79cc1c09ed627b589daac005758b0814ae64672ec66a15f64617085
MD5 480078f6785b376554dd93d3c81799c0
SHA1 86ebecabc235fe0804c333f85d8a529b95b5a2e7
SHA512 196f13ee2e6e2371f8b176169f18c2cedbc893b0dd70eb977be4b5a6d3524c72720031b728149c043c8df0f3aaab5c1143bb9a6623579b713d68947062df2637
SSDEEP 768:qrDtY/DtYWDtYIDtYbDtYlDtYdDtYZDtYdDtYZDtYO:ihY/hYWhYIhYbhYlhYdhYZhYdhYZhYO
TLSH
T1F344F0F9B6108102D56E73FCF6ED21A8515ACCB452AD6E753D2B3B31A76310F3289B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/dev.cpc.daikin/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 b698a6d7d2eebf82fc3c512bca86eebd33110749f9efc516f890a7f08ce6e19e
MD5 56da3b138c4226dfd65593c772011961
SHA1 382f0cd529d28707e51c79a979c142bb14040334
SHA512 628a1d85ab88cf2e41cbd18e2297ddc2a01cc31e07bdabf1fae9b2d7bce8070464baf8e9da7e3ba7bf5a99f2226d03226a13338d0293e9aa598588e47c234b70
SSDEEP 6:KqS2xIg9FZdrlOERX4PBX4ogLugMBX4suuK+/Ut8f7x24f7RL2r/+TOw2:K/LqzdTRmBEyPbP/i8f1fR2rgOw2
TLSH
T1C172C2D553500BA2C61D2376B3A4C3053DA05A5C837BCB57BE532425AC02B8CF350E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads