b5c5a72af83c757834802f0082d2bf51ecabba24e201a1d63c978be75122b7ee

General

Target
pockeloan_fjifu7_N2.1.8-20260113.apk
Size 7.1MB
Sample261006-pkwctsys8k
SHA256 b5c5a72af83c757834802f0082d2bf51ecabba24e201a1d63c978be75122b7ee
MD5 930287e97fbce0b02e63a469b7690beb
SHA1 20b7092674b7a2087c2bda2cc5c45705f0f34a5b
SHA512 1dee23b17ffcdab5a6bb08b660cb46a0c9e93b5617f8c6ff19ccbdcdccbd42326318a4ebd6220faabe672b84562cf2bddbc246340de64575907ff2b99d2f6603
SSDEEP 98304:YePfFS0ovfkyoJhc3ONh/YGWH4G3yEaqH6uiQf658vauTC6SwEhrEjibRjkzfrRD:1FKn2JSeRa4G3yXu1bvLC68gGtsTuqx
TLSH
T17676019EFB5C7D2EC87F4132595AD231215A4D258A83D7C72958371CE9B36E80F88BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.pocketloan.android

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pocketloan.android

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.pocketloan.android

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.pocketloan.android

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pocketloan.android

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pocketloan.android

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pocketloan.android

com.pocketloan.android
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5081

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events
Size 56KB
SHA256 587fab0d05e1776a1a4305ba59019d81b53391edc9382515f069a24f0d7c9b9f
MD5 ffd21fc966d3b76a527310b467eb4ad4
SHA1 e6796d45823a2e4ff66fcc8ebbe645f324f9a52b
SHA512 34a7823fb4b15e39072c898ab6d32d320e84ac2ee99b43f8bbee77ca81ff17947b10bb3f05739e3fc0b98d01ad674651258cf99356835885e4ca2258f65e0c3d
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSQ:8MEX0wIyNjaQ
TLSH
T17143655D5E2C2221C97D283ED7E243A35B7C93DF5723926239908CF98DC206974354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 418c8eb168ca4cd44524db376790a1f0fa4b9c1acc56f084d8df32d8f16fbc39
MD5 6e56697b9c3a13c8fd3f4cd26d729af0
SHA1 7b6ad873e56edba55129397feb3be33896b6f294
SHA512 eab57dd54fc9b5a239bb1127452dd42315261ab97df3e3c1ce289ce4d2a54964092d13811a20bb56be8ae920a729737fb3ec16b550332c194e98ef98c35f68a2
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 b39e1a43490e22994f9aa4e577b035f6d6303b4b6b1fc33e49be41341bca5f0f
MD5 27212ea3395001c3c72c3a54122ceb3d
SHA1 ba446c5fe3e27ba05e425aadc699386148d85ae5
SHA512 f209e66fa9684b739a402de86bffaa52946b8d0b3f7d9a0f45f8131825cb145488558fa8b5752b8bc839d6b486544341987cc4ad9babfd277c756b23ba907425
SSDEEP 6:7+/l9On1Jg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKq:7+tMqLiuWdwRmBEyPbN
TLSH
T19702129967811922CA1D56BB94EDC3541D50E72AC561CB5B156008D87C475CCACE0E59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.pocketloan.android/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 36108ae92cebe4e8f1dc404565d841e537506e97409871bc936690768b0a677a
MD5 c5c775e3738c322c43083f09d849b040
SHA1 9869ccd633b5f2a179141332b9f967ee431a3104
SHA512 e7a917d4e77637666d81be9c97dbfa7e616970a4754826f2c2353265511f853996f56ce761de6323cae91e2305e01a44baac124d81b078ef78b432a85167119f
SSDEEP 6:7+/l9EPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKCM/5:7+tmqLJdTRmBEyPb5s5
TLSH
T1340222896B400823C82917BB94C883402E10AB148223CB07157018A83C836DCA890E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation2258763964510759226tmp

Path /data/data/com.pocketloan.android/files/PersistedInstallation2258763964510759226tmp
Size 90B
SHA256 2699657ea3dab48e0dac6a791dc52cbb6ef48141bc02063b9bd6147316fc8c03
MD5 2e4944666cfa1b43423270892f86819f
SHA1 d940d2d8e4f96f8671e1d3c7929898be29e4676e
SHA512 71494724fdea2720f99def82b73ce6c00409aed7ce56360d321f051b7b6899362ebfbed0a067fbf6f7badcbdfbd50c35205ecbbbe109fb2dbedc26f6ea1d3983
TLSH
T132B012084731C1D1CDA5A3322C8C95201F6014804C4DCA888A3AA04004811F49143D94
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation3306152627492690049tmp

Path /data/data/com.pocketloan.android/files/PersistedInstallation3306152627492690049tmp
Size 569B
SHA256 e39ade44bf20aa6a2969f9c2cd282f7e6d601ccf56523d434d0c09dda67ee8a0
MD5 73607c2ae5df5ea6db0d64a94df5329f
SHA1 408aab22dd2916d64e04347790f136f7f5792625
SHA512 078c5540d3deb234881a9e95e81ce7b6822d62526f1d45c1cf0c8fa58306bfeee888acb127f7faceac4b32ca59b91a86d5d00702c3274469ebb8a5f8ddfee267
TLSH
T1DEF096CC35F2CB08ECBD2104099C6D028F3D01E10D068178AEDB0C60E9E613D9386E20
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.pocketloan.android/files/behavior_log.txt
Size 68B
SHA256 d3f58430c5778ee6294fd3cb7e6e8877452c2d7b4d178f89b57ec264a3dd7fef
MD5 ebf22cbdcc44d37dfda1e45763d040d1
SHA1 66482bce6621c999a52f1e03545a010726d91e21
SHA512 74a7e5c8759702e0a428f97103b86f0d90246a92170ff5ae86beaa5e3dd7066cfb38be561a97525fb0a403b1d249c3eae65a78c51f183aa8cee65e3d54e0c0c8
TLSH
T1FFA02433C037D05151C41FC030541400473C10F0704D4DC44D41C5C11C1C00C1C51D00
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.pocketloan.android/files/behavior_log.txt
Size 60B
SHA256 d775a02031bc604e58a9cb3542a5d7738c312a3927753cb7114dd92eb3c4312a
MD5 5c48c55b892362e8fdb6ac65f60b6f50
SHA1 92777766c1ef28e6f81feceecbeef91fc37605d8
SHA512 8374768efb868456a473c8e09c2a65bf76fc52dfd988b49b4d744cd283da81ec487600a6142f7b83fb07d5c2c2747f2ba1ff408244f9cefd28130763d040741b
TLSH
T18DA0228F023FC0A200882008A00C0008CB08E0F0202B08E20A2083802802B0C088BC00
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads