b5c5a72af83c757834802f0082d2bf51ecabba24e201a1d63c978be75122b7ee

General

Target
pockeloan_fjifu7_N2.1.8-20260113.apk
Size 7.1MB
Sample260929-ppa8fshb49
SHA256 b5c5a72af83c757834802f0082d2bf51ecabba24e201a1d63c978be75122b7ee
MD5 930287e97fbce0b02e63a469b7690beb
SHA1 20b7092674b7a2087c2bda2cc5c45705f0f34a5b
SHA512 1dee23b17ffcdab5a6bb08b660cb46a0c9e93b5617f8c6ff19ccbdcdccbd42326318a4ebd6220faabe672b84562cf2bddbc246340de64575907ff2b99d2f6603
SSDEEP 98304:YePfFS0ovfkyoJhc3ONh/YGWH4G3yEaqH6uiQf658vauTC6SwEhrEjibRjkzfrRD:1FKn2JSeRa4G3yXu1bvLC68gGtsTuqx
TLSH
T17676019EFB5C7D2EC87F4132595AD231215A4D258A83D7C72958371CE9B36E80F88BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.pocketloan.android

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pocketloan.android

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pocketloan.android

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.pocketloan.android

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pocketloan.android

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pocketloan.android

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pocketloan.android

com.pocketloan.android
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4999

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events
Size 56KB
SHA256 51719417ccef56cb779e8f0b50b4843344442499eecb42e69fd3212813f2504e
MD5 8e38d94d9efc3806df81094e78a7db13
SHA1 246240fb18ddc37eb18c08d0fd3369e1507ef49c
SHA512 6e25f25bfbf1635a8d40658a83d82d7654f608b59629fb185973d9e1c6dfe3fe26c4f02e26af329b08c18a031a126f742637a1b66ac75c1b9ff2127224122a66
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSH4:8MEX0wIyNjaY
TLSH
T17743639D5F2C2221C57E283ED7E143635B7C93DF5723926239D08CF98DC206974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 837741d09ee8c2f9fbe112430ab5427806a6847c12f0bc8dfda9fc302659f623
MD5 4c131419ff6cd5942fc7f9b47540e64f
SHA1 c5475f1f39aa6441e2c88467818d32b11bcab101
SHA512 780be7db9835491f055a1222f3a91820be9248f6b9c6843e4c040629f08a985c5ea6e5f454a12c9729c0ac4f61542999f3de0a40f596629a6f6d38bbd2009984
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 5f9b60a89d1bf9bda8f09ad529a685cef4383d536834d1bcdc28abd3812454c8
MD5 33559d7ed5ea18462f416652afd29a9e
SHA1 1f81ab28431b43c48807868ad0b898fc82760049
SHA512 81a49e1a871a3202143d3ac94041321b5b64c98258176a021a77354b7439a3ee566ff22bceb5d411f3c2cecd26c8c0a0bfb11cc163444181f8a02e90149bb54a
SSDEEP 6:7+/l9fLn1Ig9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKd:7+t9aqLiuWdwRmBEyPbO
TLSH
T13002229963C00A22C8191AB7D0DAC3940E10E71985A2CB07356008983C03ECCE4A0D14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 528259e53cad60ddfa9fc43461a33c05df064754bf9a0fe903e7f6a144ac0b36
MD5 8891fe036140a50d74c7ad061d7aebda
SHA1 106ecf907274e0aea02848b0b92976a03ec81b60
SHA512 32f4437c7a1eb8aa258b1d729095244213cbb4dd9fbfc219c298ca1fea15d2948e27216c34ef4a6dfa59e82cb9fe0cd23428df46e3b4b25849ee2970574daaaa
SSDEEP 6:7+/l9c0lFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK1l8l//EH:7+tfBqLJdTRmBEyPbkKXEH
TLSH
T1E302128967410933C91957B794DBC3592E94A719C273CB5B2AA009987C476CCACB0D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation2782298699010491850tmp

Path /data/data/com.pocketloan.android/files/PersistedInstallation2782298699010491850tmp
Size 90B
SHA256 eb41b369a82f3421bd02149dbcdec4ee09fd6e9a6ae29f78eb384bf28a934ec1
MD5 4f4096ea6d28646dfae4fd81b7b77cdc
SHA1 f04a40f1b1c873cf55a6c8d7e29fe128392f396b
SHA512 39270bc693cabc82859b7d82586cd4559898b2dba1d30f9611059d4c10a3501f91c309bc79e28ed3ddafa9bb52a757869ec251ca7ca5cdb90a14702e2b36290f
TLSH
T1A4B012449674D192C4A9B6039E9CD1401D5918818A0DDE170E08D55080922D5C2439E4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation9001376888876591017tmp

Path /data/data/com.pocketloan.android/files/PersistedInstallation9001376888876591017tmp
Size 569B
SHA256 b94e9625a999cabe19991d1dd36ef1ccd3762671b4542bea9edaab0bc8936945
MD5 5c6583c9958e89b9f9deb19ed9c59944
SHA1 b6e9ed1fe27dbda4e28055ae119b6fe4e9f54d8f
SHA512 3f55920d9bc3a4d8e23f1634eb9dae7d88296fe992001044f5bb989baac7acdb187fc33a1dc09dcb2ce5efebe7888b7a263612f4af77a6a8c03994dae9ef9c8d
TLSH
T1B2F04102E264880EE8987300158DEC028D5E256F2E0804E2BD53885052E8AEAA3039C0
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.pocketloan.android/files/behavior_log.txt
Size 68B
SHA256 0813689fef239a322b5e1931f3056dc8dd2ebb4f2ce6e134988f055ec421d248
MD5 ef7adbc9836143b0939d0d7984eaa07c
SHA1 506151dd7bbd2acf97686dfa84d81754d58e0133
SHA512 9f297822784ccdcfdf8c83d29d1c510618e0d968156b1761cef80e9a4e7dcae1589808d65858adbd980990a1b057128f09a3c3adf52b2804db50b5cd9fe7d774
TLSH
T19FA022BB22BAA23CB800820CC2882BB0800CF0A083EC82002A0028300C0080C03EBB88
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.pocketloan.android/files/behavior_log.txt
Size 60B
SHA256 3134f0705546ce46c350ee451bd43673499a54625cb86b7f7a4c89051806287a
MD5 3411da2d3582f3fe8c17129ebd11cb7a
SHA1 95ab481581b61ca54b9f397fd39f54590e8d1151
SHA512 9c02a2aff7788d6f4baa2787933a672a54ba2fb2a9ab60809f943a9735a16cc0c77a35d1e8ebdaf10f8da3ebffecb5819edaedf0deefd79afb2289fc499aad35
TLSH
T167A0220B023808330088A008E30E0A0CC008E03032E288202A2020008A0220C008BE00
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads