bb0484c78fab76dc9b94e8e9bf4d48414e2c5442a30923516c86217f57ff54c5

General

Target
SkyVPN.apk
Size 5.1MB
Sample260924-pk26datdmc
SHA256 bb0484c78fab76dc9b94e8e9bf4d48414e2c5442a30923516c86217f57ff54c5
MD5 3ea70b06c9aa86bbf0019fb26625f4c9
SHA1 a345dc388bd9179e4320f898b31b2e9eac13a23c
SHA512 d7f2c5910b360f5b8c02522c7c99d7a0cfbef3a91397c41c7c98a4f5299ad245bd381bb28afe549ecc068182da81a566cee7c48a6b96380ba85aa58f6932f1a4
SSDEEP 98304:BiSPmYDKwqBW9XCV+2lSGs53sTn/nzEE8bmKGurJsevGP67VwPc+SVPMYP:BiyTDKc1oxpPn/nzEdKKGu9xvGiwPD4P
TLSH
T1AE36122FDE4DFAA2CD464070803EA507A8D817DD0D11A00B87CEBA5BA6F785D4FA58DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

banker collection credential_access defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mobilex.safe/code_cache/.np_ext.apk	4744	com.mobilex.safe

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.mobilex.safe

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.mobilex.safe

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.mobilex.safe

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mobilex.safe

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.mobilex.safe

com.mobilex.safe
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Makes use of the framework's foreground persistence service
- Checks CPU information
- Checks memory information
PID:4744

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Subvert Trust Controls

1

T1632

Code Signing Policy Modification

1

T1632.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

libiikztyxc.so

Path /data/data/com.mobilex.safe/cache/libiikztyxc.so
Size 134KB
SHA256 b010cd1d6dd94e563c56b6643c417c31c12ff65ccb9222a62f55b2d1a17b9007
MD5 a6755f4b938f21e4a511b296adc087a0
SHA1 7dafd25ced1b8d3b5c132153968008b87295a446
SHA512 0e0ccd0cfc589e94b75043a08ddca18442ac6f2acccf39f8829968af13c0018dd06182184d59352f679b3364cc963c1c1e72184b764dc025445267dfcbd310df
SSDEEP 96:iGdsvcR0DRLTgAQ7CZ7sTnr2ZBOdA9M1Xo/x/Vc0K99IwgdTtB:vsvmo/eCZ7sTnrmfM1Xo5a0KThgR
TLSH
T1A9D39756B7088A37F4E8963C0893077CF676AC94D79252D31504323A3E732E55723BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.np_ext.apk

Path /data/data/com.mobilex.safe/code_cache/.np_ext.apk
Size 1023KB
SHA256 99e85439ff211262f70a4910b32038a79efd64fbef0710921419482d83eb48ef
MD5 586376adf13dc5b502a552a1c890cfa3
SHA1 d2ad60eca0a80320743000143111bfd88eebed07
SHA512 9c90ba7c5d18e0eb044a73ba96a9f62ae6cfd4aa3f35fce9a88fbcfd894dfbee7b3981cebfec00bf20bbf3f21c063da0ae44ba5649c17557a0e6b558bdaee0b8
SSDEEP 12288:ejE7T0Hxsld2BVa1ynQQb1Lc7QzA9iUVTiyvAQeLcaF45ucRr2ydkDg0J/caQ:ejg4HxD07QQJVTietmcHQcRr2ycdNQ
TLSH
T1A9252339DA40F9CAC2C29239037360897B3C4D160BD74DD865916EB46C7E2E9ABCC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.np_ext.apk.cur.prof

Path /data/data/com.mobilex.safe/code_cache/oat/.np_ext.apk.cur.prof
Size 203B
SHA256 6823e3d320a175a390264197349c80ed61627442ddc4e08eb2109cbd33aaabe8
MD5 ceeb79a99e478f2e47ea21690b906912
SHA1 1285b7d3534e90428153dc2c829ad66211098ecd
SHA512 0d5b4a5f108d6b1ffb4bc86a94575ff1102f84d1db58f30825f3240fe15108747f8ac15f28a3aaed37a2b3913277ca239a342418f6eb6eabe69c98320db5feca
TLSH
T1C0D022D204C1A010E8FB62B0CAE28570FFEEC30985310052316E92D2B2A024C8648353
MD5 SHA1 SHA512 TLSH

Submit Download

.np_ext.apk

Path /data/user/0/com.mobilex.safe/code_cache/.np_ext.apk
Size 2.6MB
SHA256 191debc79812e9878a47dfe9b406ba8df2605aba43b1e887b25ee44d41e0c057
MD5 54b5796c34379d9cc7674e6bfcee51d7
SHA1 a50e34f83550c13c1e4d89c27670918fe514e0e3
SHA512 04a0948f7968926342bd8ba9f136db55550f41e2abe21ca06b412f97bc5953a4d44880c63042f861beb013b4d4b06967960c0a3673da68f75d69fca15a37c365
SSDEEP 24576:aBEeoR26QkywBNHtEro5kP1ag7LIQuzXQDgqhPtn60zFd:aBeByG55kP1acLIz0DgCtpD
TLSH
T1A7C56C1BE8058F32DE1D41B085E57656A338E2577EC3C717128A0FB93C8719AA9CE1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads