644c35d3ab03cd927e64e3891b67812b93e5c039221abe5ff7ad96adfbf912a6

General

Target
ADS_android.apk
Size 18.2MB
Sample260804-wweb1svsct
SHA256 644c35d3ab03cd927e64e3891b67812b93e5c039221abe5ff7ad96adfbf912a6
MD5 8cff3535be386c7116c796d62819e8d0
SHA1 81d8730f740b84353479f8d7fd30648da3d45ae1
SHA512 4129263e038518ff7f36284d95fdf33c108a098da99cbd48cf5b87d62cb72e686f8102b7888e9d4330888f01f90e64f7325b6843e2285e71c89a08afd0c9ede4
SSDEEP 196608:+katidRDTRs2Z5zKF8GnMSv65M4fWL+huFr19tIp0hkcp:+xIdRTRbZfhSv65M4fWLd119up0p
TLSH
T15617AE52A6615D31C6AF433948FA4B513B316D966B8383131008B67DBCB33D2ABD97CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	app.adsplay.android:process1

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	app.adsplay.android:process1

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	app.adsplay.android:process1

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	app.adsplay.android:process1

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	app.adsplay.android:process1

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	app.adsplay.android:process1

app.adsplay.android:process1
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5076

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

exoplayer_internal.db

Path /data/data/app.adsplay.android/databases/exoplayer_internal.db
Size 32KB
SHA256 3060f9074cc864211aa0f66d621bfce1f943f93ff791afce5987682f5b2d9ff8
MD5 33c3cb9c39f65c13d132e1db807fc880
SHA1 e8ec812534f9aa6d979d74155750141d5422fda7
SHA512 944a2041beaeeae23d9661b405c1a10ff2cc59c13565995a7705b016a620d45568af538214fde266e5dee9aa89023fe41e128698f5314b669613e2d3a99b5776
SSDEEP 24:TL/FXw8UQw8iw8fFeWvw8vw8KYjzQjijR9Oy9vGoGIVyteGSZPhQ:TZZ8zvv1EYgmtooGEwS
TLSH
T1BEE2D68F0B2E3732C475C17164C69AB15BBC6A38C3134242BD99F45B5D8724F61518D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exoplayer_internal.db-journal

Path /data/data/app.adsplay.android/databases/exoplayer_internal.db-journal
Size 512B
SHA256 a5774671d9d6c96a72ba1429206c16311bfac7d2b11e048e336c798c03718429
MD5 3ce51faed5194ce2fe5e78a7a3e81b21
SHA1 32a019c0ef2f1898739475345500deb14f3736c6
SHA512 897c1aa2f999c0baa7b2271630b8c6ffe3ee6e9474570104e2671fa65f094cf357152140ed8299f0b80298ccc901f414c7db3b78ed805413950131b748f330e7
MD5 SHA1 SHA512

Submit Download

exoplayer_internal.db-journal

Path /data/data/app.adsplay.android/databases/exoplayer_internal.db-journal
Size 8KB
SHA256 371c0e4841641f0aba79bb1b834bf8392ad10cbab09149f585397fe56a2463dc
MD5 1b6e6dc4df7668ab8ae7872d5e530bd8
SHA1 40c2bc946c5f9d8b969e855ce7a0731509605b6d
SHA512 a539037e69a657d773fd043eb8354f5654bc1118492ad44ca667accc959bc5d57ac8b0ba8e5bb91d0b687dd3e6e1a196bffdb27ab916684972b415e83d1a0d93
SSDEEP 6:7+/l90n15xvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKYL:7+toqLiuWdwRmBEyPbz
TLSH
T1A102228967800932C82A1EB7ACD483400DA0EF298162CB07166008983E034CCF4A4D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exoplayer_internal.db-journal

Path /data/data/app.adsplay.android/databases/exoplayer_internal.db-journal
Size 4KB
SHA256 6032f8c63acb796bf6dbf2eb764db8a333f07d04c00b918fe796d443a3749d23
MD5 18465857a79dd8e2fe24b1301078ab0a
SHA1 221e3c6a3e709481b2d82615c14d62ec7bc28dca
SHA512 8d4baff7a36bf0a00cda2a34a6209cc9a7aec066b7c86142346231a4e825cdbb8b852764aef6237a3e8656d941a0f0f2ea419cc75c2eb69d54a5613766503ee9
SSDEEP 6:7+/li/0FPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKqp3:7+t9qLJdTRmBEyPbbp3
TLSH
T1E791808977811913D51A5BF790D583552D50A715C377CB5B566208987C476CCE490D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exoplayer_internal.db-journal

Path /data/data/app.adsplay.android/databases/exoplayer_internal.db-journal
Size 8KB
SHA256 37cb3702ea776f507bbd8bb6f9159bba1d75adf04dd1372c3421d4ec612d3aa1
MD5 caba472389dd819e3cdbf5146e593643
SHA1 7257cdf926c5e825afa75c7dc3fbe6e3d1d268bb
SHA512 627fe9a4aafa4f6a9d5350d023e4f97f0d91aa3e1131f1153a0325687748876afd660bb272a1406ed427fdbd1ddf98c06de393dfd559df907b97e8ab5a5086b0
SSDEEP 6:7+/l91s4Pg9bNFlqhO1IlOERX4PBX4ogLugMBX4suuKuln/G:7+tfqLmqCRmBEyPbf5G
TLSH
T12602228973840C13C41A26B790C883422E20E3148121CB0B1A600CA87C06CCCE8A0D80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exoplayer_internal.db-journal

Path /data/data/app.adsplay.android/databases/exoplayer_internal.db-journal
Size 16KB
SHA256 3d98fdd9b023edb687ca974f08d05ce7e61cb1cfde607c0dd11f03c565196561
MD5 567b595e624b9f037b52ebff421ab2ea
SHA1 087193c92c66a659f809dfdecc2bc1a5188ffe4f
SHA512 0d7662c040090751c009b21e3615f2f1b542164c02e33640ae8c41614384f55b2a24811de257f2b9a8408fa2480dac28d0c4d9f183f7800319cf7c1826665182
SSDEEP 24:7+tFaqLbgOJjzQjijR9Oy9vGoGIVyteGSZvti:7MEqXgOJgmtooGEwSvi
TLSH
T18472494F0B2E3732C036C2B6A0C786B29FFCAA78C2138242B995E06B6D8714D5056894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads