b5c5a72af83c757834802f0082d2bf51ecabba24e201a1d63c978be75122b7ee

General

Target
pockeloan_fjifu7_N2.1.8-20260113.apk
Size 7.1MB
Sample260929-ppa8fshb49
SHA256 b5c5a72af83c757834802f0082d2bf51ecabba24e201a1d63c978be75122b7ee
MD5 930287e97fbce0b02e63a469b7690beb
SHA1 20b7092674b7a2087c2bda2cc5c45705f0f34a5b
SHA512 1dee23b17ffcdab5a6bb08b660cb46a0c9e93b5617f8c6ff19ccbdcdccbd42326318a4ebd6220faabe672b84562cf2bddbc246340de64575907ff2b99d2f6603
SSDEEP 98304:YePfFS0ovfkyoJhc3ONh/YGWH4G3yEaqH6uiQf658vauTC6SwEhrEjibRjkzfrRD:1FKn2JSeRa4G3yXu1bvLC68gGtsTuqx
TLSH
T17676019EFB5C7D2EC87F4132595AD231215A4D258A83D7C72958371CE9B36E80F88BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pocketloan.android

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pocketloan.android

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.pocketloan.android

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pocketloan.android

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pocketloan.android

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pocketloan.android

com.pocketloan.android
1⤵
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4209

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 ec1f430911e03ec32a52632f00241e78b2a46eb093b4953e9c64353371f263c9
MD5 93142bd2c55928e5e381eaa0802dddb3
SHA1 4f54185002cae8aa9be615426f1b2679ebeb0396
SHA512 cd838e8de10a9d0e9f22e7e826cd761bb82dcdbd7ea2ca2cb155b8b88b9cfb59cd638b56ccc3e9a982f33d63c4dd371f2bc85ebf8285a94e11a649e90ca4deca
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-wal
Size 68KB
SHA256 c998fb5c6d750e5690be433283919cf850ab3ab1048b21b9cba592259ce5f1d3
MD5 95a8fc08a9dd4d0c01ab110af4b82d4c
SHA1 2949918f8b9a15ed502534e99f50ba2838832930
SHA512 974037f0183d533443cd280b0fe001549169757359e3b5be3f85dbdb4230c5c008706f715046e3a816d2a906818b9744ee17df1b2c915a12547c16d9f5c9fd1d
SSDEEP 48:MzNSP/6kRj1g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP/TufXEz:00PikR6MEX0wIyNjaPbqc
TLSH
T18263315C9A682231D9BD1A3ED7D143A39F7CD38F5322A3226F504CEA8EC6079F025D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation2228032621588974513tmp

Path /data/data/com.pocketloan.android/files/PersistedInstallation2228032621588974513tmp
Size 90B
SHA256 bfc09c2e41a217e32e600b879fc70bb1c8cdb40ffa8194aed766d3718ca14be7
MD5 56505288aaa7c12b9b7b04ea8b5f836d
SHA1 81aac641db8328c72d552503b81d32c08dc2e716
SHA512 b6b2b4ec5fbe6af068aba1cea3c572b41dcf77ca7a629f061e5e1c99214b7695f0e6c04807628189c7e47b81838ddff5c16dd7651b880bd214819414822108bc
TLSH
T1B4B01240DA715642C9C5A30A2C4CA1006E402581040D8A890B8CD44040912F1D10BE98
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation6385961970685523974tmp

Path /data/data/com.pocketloan.android/files/PersistedInstallation6385961970685523974tmp
Size 569B
SHA256 7052f73582f6d4deabd3e0db469081c3a36be2bb515e64a3e674d7673680fae4
MD5 c11126bcdeaf8c05a5b4b0720a7eedc1
SHA1 fc3e01f6103c88ef7ae9e261688944341d72e772
SHA512 594b58182689c7e258cdacf4698b0f608eceb3b7dfa70e9eed58915bf431197941c771bb95ab3eb4d221d5cc186718a61e8abd84110bcec28611e70d239e7980
TLSH
T129F0968436B1251ED8A2250125C4FC208F5D11FA1B5952D2BFCB8411C9B94F9530F944
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.pocketloan.android/files/behavior_log.txt
Size 68B
SHA256 aa22d068ffba1181394d14a11e2b8fd9e42549aae06963bae9d6a462f3c3e0ba
MD5 dea1d720f64103dff364642ebcd70b19
SHA1 9c298408f615c9f31b28075ad7c31fd8677328ee
SHA512 0f1a0a78569bca63138d8a7a464b897ce14098bf376286d624985eab8f4d5ce44a527c1bed75d92f925d33b15273ab9bd52e8b6179566654b1e58455e4e5737a
TLSH
T184A0228EACB280238E02C828C3A03F200C0232B20ACC8A0BA8033002033000E02E330B
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.pocketloan.android/files/behavior_log.txt
Size 51B
SHA256 fc1502bc26be6e41bf55fdd3c7d8f9bd2bfba71ead50dd0b7da6cefcaf2ef376
MD5 134f82f7e406c98622d690ccaa55c447
SHA1 d806bcdd60f58e9b80cf9e1350a734a9d22dc69e
SHA512 0f011b70a8447608d5506787280c28ff0c543ea7a278491b67e7cb65902b3418d78dbdc7fbd236c479b37ec55d880af2c2a139054df2c902eb0f9b9a5220dbe7
TLSH
T1A090021B107646362581B40BA2AA59380018627156C8952136802131594544C0683A01
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads