aa6cfd811f105ab2230449bdaaaf506a0bc003ea52a71eb933e36e744ebccdfe

General

Target
XuperTv-N0F4C3-v4.34.7-NF-OFICIAL.apk
Size 32.2MB
Sample260804-gm2cvssdle
SHA256 aa6cfd811f105ab2230449bdaaaf506a0bc003ea52a71eb933e36e744ebccdfe
MD5 f37a6921a54aed81a93ecbfaac40f747
SHA1 56d7fcb6579e7c49829b83567923aec85d22f745
SHA512 25fa77072e3a010893b17bf63b93357163d4d1f02eaa8461d18e08848f56c022b192dd5644159fd22e146a235f3a3a136c6d418460295444be48fc3e301763a7
SSDEEP 786432:myzkNjjaRrH9p8lypAAlEZG1jiC8KgUC8zHtPFno:9zk0R79p8ly+bZG1N7gUCIt9no
TLSH
T14577235BF708E457C0F7A7328AB91612451B0D614B43E29B6D18F27D2AF36C4DE4ABC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.android.mgstxNF

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
16	api.ipify.org
17	api.ipify.org

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.android.mgstxNF

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.mgstxNF

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.mgstxNF

com.android.mgstxNF
1⤵
- Obtains sensitive information copied to the device clipboard
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

addb

Path /data/data/com.android.mgstxNF/databases/addb
Size 20KB
SHA256 6ea2da6eaed76f4b2a9b19e496fb6a8b418a190a11633df4a572009dd528f854
MD5 21e8f79a0ba118736a07fabc388a3e8a
SHA1 599a0ba95d146644bab45de9a973dc58bc327e47
SHA512 0f706edef3023bd7436098f1ddcd5be65d1454d78badfedb785aa08d7284f00ed06bbeef3c9b909b5200ce1f6e1a6c856a85ccef0cf36ff966c3e0088349910d
SSDEEP 12:TLRyNTSFbyB5m/rWKEcNAZlgcWS9MZJ95EcRmBEyPbAVOwG:TLky5CgX28lEnGSEG
TLSH
T13D9246C74301B321C2B98672A8B583D35AF0123FC2E0CA9764B86C309CA190A30A9E2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addb-journal

Path /data/data/com.android.mgstxNF/databases/addb-journal
Size 512B
SHA256 1c826278b44a4e60f202f72186f5f2308ce5020977472c03da776b1a02fbb82f
MD5 f8c51e2ace419660a0a970e59b7a4af6
SHA1 d65b95f6b90b491f5c6183dd1829fe0f5a70a9f4
SHA512 d6935f27adb792c372243c6c02f254592035c851cb428e2660ccdda0519eb468215e4aa52ae65930ddcf244dcde2ec85ba4142c703e741459d498b07538ec143
MD5 SHA1 SHA512

Submit Download

addb-journal

Path /data/data/com.android.mgstxNF/databases/addb-journal
Size 8KB
SHA256 8e35567edf30586fd49a59b3dbfbea68c3a6afe5043ecd73e1e00f2e98bdfb15
MD5 9b78d377d3293d9803716a876a9798e8
SHA1 54a65cbe11464de60167e3c6c27576a6f02105c8
SHA512 c96ce7b8885b01e0d5ede001832e5778fa316cbd3e33028c9b95a3dfd9fbe86f2877023a69781e2bb0e2c38efa55c779cc0f3a08e8cf85f797077ab61152d019
SSDEEP 6:7+/l9Pn1Eg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKjB:7+tQqLiuWd7RmBEyPbG
TLSH
T1B70212ADB7811922D91D567794E983540D10EBA9C662CF57655008E4AC479CCA4A0E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addb-journal

Path /data/data/com.android.mgstxNF/databases/addb-journal
Size 8KB
SHA256 86f15b0c95ac0da968ed4c20e963b9a3882cda79568bf6c8bbeae3cf840815ca
MD5 99d7d525c5f32ccfb60f3ac7db1d8a90
SHA1 f977e8359f2b4525643793ccc47f1677e0553261
SHA512 3df5e76cbb32dcedd9b1444c7d0ab43bd98a7476fd8032b8d7a2cc96ea93e1b813122b4a07a2646cecc0eb8dd39ec7e4e60048c64da080dca36d49423dd07e8b
SSDEEP 6:7+/l9IOPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKm6a/wn:7+tiiqLJdKBRmBEyPbX6qwn
TLSH
T1C90212A967410A53C52D5FF794ED83941E20BF1A9763CB57569008546C466CCE890D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okgo.db

Path /data/data/com.android.mgstxNF/databases/okgo.db
Size 44KB
SHA256 9eeb1a1347d09d47af824b61e869067c8366efc57c95cb20e39ab3f34abed977
MD5 ba1a1b641619ffa823d5c4ad7b39cb1e
SHA1 9ce893dac1b081c9e34d511421ef54a268dda13b
SHA512 07ea1f95d18261376886d763dc7d32b1a708870eeab2d5b67d92c3adcd983bb3d65723ed5ae7b1dbfc3c65f6c6cee477f7528d28012113ca2fb3820ae560fe07
SSDEEP 24:TLVlEGoTwufmcyZQk1TwufmU9COSgIU4pAXGS+Iee:T2jyZQIhIU4A2S
TLSH
T1DC137C5A2B385430CE1D127258D047B00E7AA77F4B97DB073CE120B5ACAA055AC2ECBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okgo.db-journal

Path /data/data/com.android.mgstxNF/databases/okgo.db-journal
Size 512B
SHA256 bd67b7a9a2d0e709f85ccc7c751e14402969591c5e55daa588baae0fdc4bcf50
MD5 42a0a09b767fe5ecfe9822250e244abb
SHA1 c0f30f3eb2aa4dbd02f00b3579fe0b5ffe4af7d2
SHA512 9178b711ffe38df2bb92dd19b1abd5686927f3418c0bf6afe85595705e041bcd27d2705f799c03a4cddffcbee5ec3852a452692d4f07981fb6552f5422b5b082
MD5 SHA1 SHA512

Submit Download

okgo.db-journal

Path /data/data/com.android.mgstxNF/databases/okgo.db-journal
Size 8KB
SHA256 6cb434fc2ec02dfd8fd5458daacee1d2b8d2beadafea45c7b25b8fc162c49265
MD5 e820a1b56ecb5ce673d2f6ef51e63057
SHA1 49d90f88ca1cbe951041ace16f4656b46daefbe7
SHA512 e93138f02444d221ba23fd3ec9173fbaa46dfec87100655ea789dc1a70eaa8a45d19531619662d7a7c41c3c47c281b2b882f72c7349bb69d3d1f3258d256164d
SSDEEP 6:7+/l9KGn1inpg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKwI:7+tYZpqLiuWd7RmBEyPba
TLSH
T121022298B7800812C819E67B90E483840D00AB588262CB2709A008942D034CCA4A0D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

okgo.db-journal

Path /data/data/com.android.mgstxNF/databases/okgo.db-journal
Size 8KB
SHA256 0ccce68dd24a56580e525b73bc3895f3234623e339bab36ba223b901d94f6295
MD5 60d1764e1b2530eca4449a840155473c
SHA1 0440538a6fafb4e9340af4755d16c12f7b4a0d2b
SHA512 e033626b8c411aa87618068acab9d67bf35120fd0719437ad3951883c39ec91e48d210e2d60ec3a1899068f829642a160f4c7745061b995605238dac171c4a8b
SSDEEP 6:7+/l9sOPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK1l0//0:7+t6iqLJdKBRmBEyPbil0X0
TLSH
T1B002129B67410913C51D9777B0D9D3542E10A7158363CF575A5018686C46ECCAC91D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads