d6eb48ecc1a0831a805c5920b2cf9655e60097eb6c7eb822bf87003d71afce95

Sharing

Copy URL Twitter E-mail

General

Target
File+Cache+Cleaner_2.1.3.xapk
Size 27.5MB
Sample260803-gl6k7ach42
SHA256 d6eb48ecc1a0831a805c5920b2cf9655e60097eb6c7eb822bf87003d71afce95
MD5 d83b5b9d0200cd0e7b3f5581a1090244
SHA1 4e743dfb3043d31f5687dc6f4c3562eb5ed86ea2
SHA512 540c560ea9c4713f7fc4fdd61d96f2b465a13ff74935e1c15d6b8d8f90bb04987efcf95cea26dd253993e40003247b2b7c4e3fa006e3097fb7bf4cf59bea1963
SSDEEP 786432:e5svKxqqVpVvR5SXRrDOVM+YHn6LSagjIVDbm:e5sSqqVpVyX1OVGHn688G
TLSH
T11857120AEB0DEE2BCCF7B2784D39126260166C649B83D7D76901B23D7AB3AD44E157D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  com.smart.buddy.file.clean.pro.apk
- Size 24.0MB
- SHA256 9e4750922186c155097b76cd3ba073b9a8dd48a2bbd4462e0c8284d596c25c25
- MD5 00212ed70e7b3008aa96df1ec6d9e71e
- SHA1 e56f4593cacf42218a977556bb6ef3fead8e717b
- SHA512 d6f2b94a4cd4814209011c45e0ff27ee29e022c0366cdcae034bd815d4b05313e49eb0d4db5be57fa7f699d7187024aaf344b9a932f94622234102a39d7869d0
- SSDEEP 786432:c5svKxqqVpVvR5SXRrDOVM+YHn6LSagjIVDH:c5sSqqVpVyX1OVGHn6887
- TLSH
  T16A471296F318EF6AC4F7573249792232105A0C659BC3DB836805733D3AB7AE04E5ABD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery evasion execution persistence impact
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
- Checks the presence of a debugger
  defense_evasion
behavioral1 behavioral2 behavioral3
- Target
  lib/arm64-v8a/libapminsighta.so
- Size 99KB
- SHA256 b1a70dabf68e95e1910bb080dbe1c78ae628a0bf7332f7ba41db23d9bbe282c0
- MD5 50f0955f9427bfe14e9c11309256003e
- SHA1 1b29f6b1cbe389547c7892c2778c39b9b38c3039
- SHA512 22bb9058d3cac07b7883a120d8ae601bc69a09d94d17bfc0178112caf115e78fb47ba15c8d37a3585c3806f3f1b36e47a8b0dda9b664c4479b19c5e65129ff23
- SSDEEP 1536:MVLzQuxdg8UGu/rbBF1h28Maie/gg0TRZ/Vv0BBF80ddvOp/2egZwwHnjun5:MLzdm8dCLGKB9eSZwCnjun
- TLSH
  T166A34B98AD4CE837D6C1F0FC8B8801A3D22B743AAB1583767D02D14EEA467D96F5C712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5 behavioral6 behavioral7
- Target
  lib/arm64-v8a/libapminsightb.so
- Size 121KB
- SHA256 c36885b7189dc5173627ff9afb5a49cb94420b9b98341536b4476b792babab61
- MD5 92bb55e2cc4a05f6111a2afff955d550
- SHA1 811086f179c50d40821e2ce5873d6d1c9566f7bf
- SHA512 b538807cda04a247d1ef1915971c95765b6576ceace5715a3e3ce5af15a8d324179c581ee04533a32b4c128c105faf241cceebaa043caca1326e2f2eddd04238
- SSDEEP 1536:6ampst1YcbHih5jtbKHsqGBAPjc03UATf87903Cb0qrkAU7pK4cYakt6aOFuTcoT:IUOAu55BOLxs5OuYxIuoo/MiDC
- TLSH
  T160C36C44BE8DF437E6C1F0FCCB8909F1B13A3C64676482363C25915AEA81BD59F297A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral8 behavioral9
- Target
  lib/arm64-v8a/libapplovin-native-crash-reporter.so
- Size 847KB
- SHA256 d3bb134c06aa92af3995b1aeac1e77ef429c707bf5f4c2ed196d045d441cdf19
- MD5 a4947a7f1cf4239c7ad9549f581c57b0
- SHA1 9cd03a4425f2d5df7a391511bbb685296b800033
- SHA512 e38a624dd8ac177229fa73bd59ab06462986626a5d9e5ea1999153beb712473186c562bddc9123fd1424837b3e90d445a0d61afc2248450b003fbc390ac954ae
- SSDEEP 24576:BMGx+VKya+LUvz5/t/vEsOIWVd3j3evw08KK2sujDn9ksGD8OWbwFU1r2KMJnijU:BBvVtDr2KMJ
- TLSH
  T19F055D05BB0E6D17CEC5F8BC4EA72321B121BCDC151482DB1A12C119FED7AEA5E127DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13 behavioral14 behavioral15
- Target
  lib/arm64-v8a/libbuffer_pgl.so
- Size 8KB
- SHA256 d416381c202993e4a03fd6ae0c5b407f1531f61fc45f518ad5b7f4620d5a2133
- MD5 f33617ab57aacba361f92def47076b8c
- SHA1 a3fbfbf7e95e38da5d4569976229c18c716f3af4
- SHA512 023e243791213ecccaf72e60a7f29a0d5dc174d96fae46705056861b183ccb5d8386a916b526d56887c767ecb8597408da1e81fe0141ab033bb8c710d9fdf543
- SSDEEP 96:JU9mnW+WBL5KskFHV+XWz70jiqNBpxbx9wZHU2:JU+W++0702kTHAU
- TLSH
  T19502855AEB48DA37F5CE363CCCDB0370BAF1A069970282439325D4156D436EAD9293B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17 behavioral18 behavioral19
- Target
  lib/arm64-v8a/libfile_lock_pgl.so
- Size 6KB
- SHA256 d14096b150b4b2f21263fdb4f1c61eea3fcd76804c776de2395b13dfbe1d8ca0
- MD5 38092a06fc30324faa9b906f3abd7373
- SHA1 f87bab4dfcfd26d5fc40cda3e0eff14dc28248c9
- SHA512 a982ba62ee74edf8c0aa4a58db857a223820d1cee08c297a0cd63fc6951176008a7519562d7daabfe015ccd56f0f771db19509cd3de50daa47bc9e48e9e23071
- SSDEEP 48:AFcoer/tMWMZxM6MNM6MmSFA/PaOUuz+dkvGiuTk+xHPpOWcBG6R3B8bdYif39sO:loyAxWDzqkfuTk+VpU86VBo9nFL8uN
- TLSH
  T1CAD1759EE3588F27E4CE37BC8A970230F9B1E116976247035E60E1653E037D89D26BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21 behavioral22 behavioral23
- Target
  lib/arm64-v8a/libmmkv.so
- Size 583KB
- SHA256 3850acf55b2c29bd3a3714ac84b7ab6ef402fedc61d9646209dd273d604d1bd1
- MD5 09ae22c9513088a18136b1131b0faed2
- SHA1 b22ea16d0c9811c3d3fa50c87f84ac4e2c84d649
- SHA512 53c0bd4db973312ed081441ba3da0ce4a182da3d7f4f36f57bce65f9fe3f041d0670c446784b27e7b0de1721bca015ac61cacbfeba620260554a52adbd96a453
- SSDEEP 6144:k4FpRYui6AcTh0bOTtoCD0i09L/D64OGNTWEKnh7DAMu/FQqbszgLsJw8IVozuC3:/FutJDJIaiAEKC3O00Pt2j9E7U
- TLSH
  T1F0C46E1DB50DB83ADEC6B07F890501A1732F745C5724D3AE69128209EDC37ED6A3ABE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25 behavioral26 behavioral27
- Target
  lib/arm64-v8a/libnms.so
- Size 289KB
- SHA256 1db1d9bcf347d38bd7b0fd7a2542d18b2069151f936bf115ff0728e5738a08c9
- MD5 e5f66508de633457961c9cdd9bbbda83
- SHA1 3cc79289b1f59fe5bc57883c9e70340c5943bc92
- SHA512 fd763eff93d6be52216b971dd47d2f42c472de3656bb792c339f52df202e32e8d10ad20f9777085911d88a65f16d559329ec5d3174838044e0b7626bc0f64598
- SSDEEP 6144:kCGY7ZPSdoXxZTFGp2tjU4DP14uSX8fbDCxkePOz:kyPTFbD94uSsfbuCePO
- TLSH
  T19E544B4ECE4CFD36ED86A0FC498D4953A832B85A47D0C1163126D67BFF872D1D9623A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29 behavioral30 behavioral31
- Target
  lib/arm64-v8a/libpglarmor.so
- Size 66KB
- SHA256 c590266c06f99a194ff209b9c32036191903f0cbe3421919df540851b3bb958c
- MD5 7f8a1e8e51cd5b9730c5f75d2e3fb927
- SHA1 a22bbb0e1f233330514d4e673d08fdd5694e23f5
- SHA512 2347b31adb45eed6eef32eca9b9dfe8ed511939c38831b502c5bfda961e09a95ee7c3547fe8b83677abb4606b818ffdaece043dfc5613674a169f96aeb2cbbde
- SSDEEP 1536:ZKUQVrdV8WUWHPjVy02dBFDiq0JHuANEbI93z2yB:m8OjUFDibuAOcF2
- TLSH
  T102635D0ED90AED3BEA8E30B458494716DE34A98159C6DB2792307DEBFD479C14CC22E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Loads dropped Dex/Jar

Queries information about running processes on the device

Acquires the wake lock

Queries information about active data network

Reads information about phone network operator.

Checks the presence of a debugger

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32