3519b1e949b9e4d6724ccf1057821495ef8bc32688019ded7c5c049493da4837

General

Target
tb-training.apk
Size 5.8MB
Sample261102-pgvxwsby6k
SHA256 3519b1e949b9e4d6724ccf1057821495ef8bc32688019ded7c5c049493da4837
MD5 53834e06f4a39d4e76e367ad9523d704
SHA1 6767f2fc2e555706a77da2a0ee59e6b7fe5299a3
SHA512 16ccbc84640ff369de117582165266b3a68be409598e74ad7926c0df2955f260f9cdeae8fe0d524e09d9994241bc0a5587e9ec27f6f2ac3ad971ca06769760de
SSDEEP 98304:PYkEGqpR6X9rToiKu7yd0HfMypiF2k+STLqoTbeH1MhwJpcr95LtrpCTy+1ZTBI5:PYkE96XtTQOMypiF2AjBicrHl82+1ZQ
TLSH
T127561282FBE96E2FCC7780321B8A123116268E53C742DB0BA948377D6C776D84E54BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.tbtraining.client

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tbtraining.client

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tbtraining.client

Checks the presence of a debugger
defense_evasion

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tbtraining.client

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.tbtraining.client

com.tbtraining.client
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4812

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation4130131369042164868tmp

Path /data/data/com.tbtraining.client/files/PersistedInstallation4130131369042164868tmp
Size 570B
SHA256 4ace686c8c2a12c975ffba5a56b1bf3ee32283d3bc52db2bd3a73b76a7084cca
MD5 3d4eba18b91478cb6af1a872d35c9e41
SHA1 d90513b092df722b3816fd2f8a3a7e366d3c1aa2
SHA512 df0f55b696aee80f266546d8e89912bb8f70769fd0549c639feb4e9378357988f3721b2976ad8b8a178126ca477cae698557f5ca4e016c6df6ce676d6c5d8ee5
TLSH
T19AF0E1AA35904529FE9E1A332589AD4B5C8C44F01966B4D236CDCC608686D9AFD032B6
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation4781645084992276334tmp

Path /data/data/com.tbtraining.client/files/PersistedInstallation4781645084992276334tmp
Size 90B
SHA256 006d5f66a6899babd41f41571cf81fd0e115e739501992f4a7eb806bd96b9b76
MD5 3829baedc379286c8bd5c2d17728820f
SHA1 4ea7b2b4c6b472ec5441599b871501013ebba767
SHA512 aa51263c471c38bb7c2983f7f3f634e8b722947588d58f68a97aaa5bc1f8faa9762d7ca5a767047bbdd28ab0c81b9eed276c83aed04745323c3c860fbeaef8dc
TLSH
T183B0120046305141CFD9A2522D4DE1005D401440181D8A374B0CAC44C0813F0CE039A5
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MToxMDY5ODY1MTAyOTY5OmFuZHJvaWQ6YjllOGZiNDMyOTExNDE1MDQ4NmVhOA.preferences_pb.tmp

Path /data/data/com.tbtraining.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDY5ODY1MTAyOTY5OmFuZHJvaWQ6YjllOGZiNDMyOTExNDE1MDQ4NmVhOA.preferences_pb.tmp
Size 321B
SHA256 cd3608f9465b2c0a07e91b500f56640a41e9e5c5fe3aa6a4bf7fb1e5b6fe4b17
MD5 8ea65915e19812134e00d5c4ed6d71c8
SHA1 7c65090e16c7d62a4c6c95988503e6965dcae4f0
SHA512 0225aa4c55bf8daa468e3d1055611fc9216356ba40fab310d2b4ce5f31bfc2fb94f8090ff387fd8a7cf53a26dc91f89a417475da82e94393ae83cc2ca718935b
TLSH
T1A2E07D10DB91ADE01A3F110C3FBC01280F3FF3E22176049961F40180B50EA45D2C2F0B
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MToxMDY5ODY1MTAyOTY5OmFuZHJvaWQ6YjllOGZiNDMyOTExNDE1MDQ4NmVhOA.preferences_pb.tmp

Path /data/data/com.tbtraining.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDY5ODY1MTAyOTY5OmFuZHJvaWQ6YjllOGZiNDMyOTExNDE1MDQ4NmVhOA.preferences_pb.tmp
Size 345B
SHA256 b52e1d44799d9c78a6592a8ea48118cf78bb1b7137975597bf2135bcef20db6d
MD5 e6226c2f310b1e3e930da748a870d3bf
SHA1 313b9ef524500703cbd2578364ae29e84c48611d
SHA512 baed56386f36ef8d75605934b68ac52c96d0513be70c2173d5c7dae74a51993713cec637db6859ef01f518819f39893632372755190edf104781dcd34b416e0a
TLSH
T145E02610DA91AEE11A7F514D3FA802280F3FB3E2217A449A65F94180B91EB55D6C2F1B
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.tbtraining.client/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 74793ff203a0608fcc7183c62bb0bbd4e26319a20b3d62b2308a1eab98fef036
MD5 9dd8a53b33ad38384b184aff2f949017
SHA1 a99e290e700463861256c07d0fb2fde1e64068ab
SHA512 487fefdc680e4b6b411deae083e4ed7709512ae4c69a95efe3742ca9813e3b4e3442f8de1f7127658c335310801fc50681c2f19ba55eaf16443a1946ac5c52f1
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.tbtraining.client/primary.prof
Size 2KB
SHA256 36675a10e592178f27620447b0e71407e008dfd4dbe0541c4b5dab49b0aed141
MD5 436573f679121e7f8c430dccf76808a6
SHA1 eba42caa30e537cd14bcb2eccbe9e6a13e96fa57
SHA512 7a9f80534ad0088d03a8bf06bb266074613d8395cc40462467ea1707bbdf6e1caf27b660b32f569df3dd4c3574dc58b2daad11d334653a1cf11778ee2b2b2746
TLSH
T1E6514B032CA0DE09723911F76E05B51CD22BDB867A82BC36801453B4E7A6B5D26B9B00
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads