275e1ddebcacd9be3ea2c7866621dc35b4426907a893c30321a4e6c8d6b3707c

General

Target
Яндекс Фото (4).apk
Size 7.9MB
Sample260906-rt11sabe89
SHA256 275e1ddebcacd9be3ea2c7866621dc35b4426907a893c30321a4e6c8d6b3707c
MD5 953f39a5ac3fd705272feacf7e4c29f4
SHA1 e24a9233f4cab8ca0f2edb3ce85bf8ad15303a86
SHA512 c5c0c387ab48d4ebefe056a3c7ee621e120b3429ea4c0f0a11663041d6279f8198c36924afaf49efbe27e034df5cfe15688e995281889c8c3e0f25864692d2e5
SSDEEP 98304:nGKn3H+Oh39tliFKHda69P8m33mPRb8UykyT59opeQN5H2HtGUoIMofmZR4Pe8wM:F3XNbiO86B8OMfCdvQPHMGi/
TLSH
T145862232BA092822CC668A36C5B30B97B37DC3891713D71F5AB468717CD36D1AF059B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ggnoppsasiuzlp.sm

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.ggnoppsasiuzlp.sm

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.ggnoppsasiuzlp.sm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ggnoppsasiuzlp.sm

Requests dangerous framework permissions 30 IoCs

description	ioc
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ggnoppsasiuzlp.sm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ggnoppsasiuzlp.sm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ggnoppsasiuzlp.sm

com.ggnoppsasiuzlp.sm
1⤵
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5078

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Subvert Trust Controls

1

T1632

Code Signing Policy Modification

1

T1632.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

signed.apk

Path /data/data/com.ggnoppsasiuzlp.sm/cache/hw_1788705075706/signed.apk
Size 4.9MB
SHA256 4d322942c7b4395dc06b5772862875bb573bb62b76c98753417a0ab74cea9108
MD5 d89e131c3658f81c0d70ee11ffd22aac
SHA1 2de3b1e0b306b07abff314910b344ffdc37e360b
SHA512 429de6c5c3796dfc499cc25f72de762e4fb931195c1010b21f3cfae118f0dc642e928df2973f3d6527d93c2dc9040d17768bb5e1f9983c0aa5535e78aab18b99
SSDEEP 98304:C6Gl8QGrm839/YUL3hNL2LXuXPfcCyWzwSnZvlIHOV:s8tYUtN2b40CyW0gn
TLSH
T1DA362352BBD95773F8BB863584A68782162AFD1ACE05670F2940372C1D33BC58F16F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

work.apk

Path /data/data/com.ggnoppsasiuzlp.sm/cache/hw_1788705075706/work.apk
Size 4.9MB
SHA256 8da12b3c6812f8d4742ba1020f50061e225651e4ea011db2bd141c33edb70671
MD5 b79e920c56b72d27b5f7e7bcca92f1c9
SHA1 459547d365eb92c599fff3d180e3f922f0c7febf
SHA512 d5fd0aae652b0be1a9982d848bc0f1b257a2cd14f4fb9b0bdf9e9cce121c851b049de96f2f356fa0aed026ab4386eb8e8f083431146ba8448b6225eaa9bf1a45
SSDEEP 98304:jDGl8QGrm83D/YUL3hNh2LXuXPfccyWzoObZvbNBup:e8zYUt/2b40cyW0E6
TLSH
T1EE362352BBD95773F8BB863584A587821A2AFD1ACE45670F2540372C1D33BC48F16FA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

work.apk

Path /data/data/com.ggnoppsasiuzlp.sm/cache/hw_1788705075706/work.apk
Size 4.9MB
SHA256 ba6ac0757ab4bc46f773b379255a5785861576ff397bf6c1362aba806c9a7c7a
MD5 53e85664ec0901e143477e826f689b7b
SHA1 b102c3254c7f204b6feb1a440a2a6f3959662ae3
SHA512 cc6f8087ec869c8aefc5e73b61f14248d2cae01155ebf510f5c6e8ca0ac387a677e5604e7cd266ecfd1744be1c713a542cc7afef84620f39db71f92d048946fc
SSDEEP 98304:KOGl8QGrm83//YUL3hNt2LXuXPfcCyWzwSnZvlIleO:K83YUtD2b40CyW0gC
TLSH
T14B362352BBD95773F8BB863584A687821A2AFD1ACE05670F2540372C1D33BC58F16F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads