3519b1e949b9e4d6724ccf1057821495ef8bc32688019ded7c5c049493da4837

General

Target
tb-training.apk
Size 5.8MB
Sample261102-pllvsaws3p
SHA256 3519b1e949b9e4d6724ccf1057821495ef8bc32688019ded7c5c049493da4837
MD5 53834e06f4a39d4e76e367ad9523d704
SHA1 6767f2fc2e555706a77da2a0ee59e6b7fe5299a3
SHA512 16ccbc84640ff369de117582165266b3a68be409598e74ad7926c0df2955f260f9cdeae8fe0d524e09d9994241bc0a5587e9ec27f6f2ac3ad971ca06769760de
SSDEEP 98304:PYkEGqpR6X9rToiKu7yd0HfMypiF2k+STLqoTbeH1MhwJpcr95LtrpCTy+1ZTBI5:PYkE96XtTQOMypiF2AjBicrHl82+1ZQ
TLSH
T127561282FBE96E2FCC7780321B8A123116268E53C742DB0BA948377D6C776D84E54BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.tbtraining.client

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tbtraining.client

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tbtraining.client

Checks the presence of a debugger
defense_evasion

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tbtraining.client

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.tbtraining.client

com.tbtraining.client
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4978

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation2124472603542598669tmp

Path /data/data/com.tbtraining.client/files/PersistedInstallation2124472603542598669tmp
Size 569B
SHA256 97bd5e908c7cd384f11c10cf5c7040cdb63c5ded7cd00ed4c0707e030038c266
MD5 f6af36e2a398014a7ae8ea19ec646d2f
SHA1 f41ea72314fe7ab95951f531ce4e8fdbad2cb587
SHA512 a090f658c123cd8914323d821d28755ee7e7c91f7ecce39cf112f4a47b81b4360461b0576f4531096c9c6516deed55b9174cbfbe1e241f566ca0726ed2a09488
TLSH
T1BEF0414128A081E0EA58AE0126449C025C8888E6E2E2B1E216DA94A08B83C4AE983199
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation289615500367011454tmp

Path /data/data/com.tbtraining.client/files/PersistedInstallation289615500367011454tmp
Size 90B
SHA256 8d9249d96efc8fea0107f61de36018aed01c080ecb68149b108c33d92ed80ac6
MD5 6366061e69db699778f3e02c09ecdf1d
SHA1 26e1634462a34a358cc108b5bc68f114172d609e
SHA512 de693ad1d50f28d1d5684f4bc4ee7c5552732c0ebc5ac6aca6f4bc56b65760cd50016520afbb353829663a70cffafff7a8963f893fcd53252b629192f5ded2f7
TLSH
T19BB01280C6F181918ADDA7066C4CF1021F4228422489CE164A0DA04040815E08293AA5
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MToxMDY5ODY1MTAyOTY5OmFuZHJvaWQ6YjllOGZiNDMyOTExNDE1MDQ4NmVhOA.preferences_pb.tmp

Path /data/data/com.tbtraining.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDY5ODY1MTAyOTY5OmFuZHJvaWQ6YjllOGZiNDMyOTExNDE1MDQ4NmVhOA.preferences_pb.tmp
Size 321B
SHA256 159f027a69e4df7015c781bcf393f7ae42eac5b2610f99fc431d3d3c0928aaf7
MD5 d834b7cfed9fa8021e1b5ac2f3a77c68
SHA1 0f706f659a6e5e170bdae5ca57db698aa6cc5110
SHA512 1c1d42838e1284d6af8bebcc4afe109cb59b5fcbddd644a0526c88b908a3b9177fe98bcc4c5e2292ebbfef38938dff459246d3d1a2b36517e24464da2e139928
TLSH
T1B7E0CD14D6929EE1193F514D3FBC011C0F2FB3D2727A149965F54180F51EA55D6C2F1B
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MToxMDY5ODY1MTAyOTY5OmFuZHJvaWQ6YjllOGZiNDMyOTExNDE1MDQ4NmVhOA.preferences_pb.tmp

Path /data/data/com.tbtraining.client/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MToxMDY5ODY1MTAyOTY5OmFuZHJvaWQ6YjllOGZiNDMyOTExNDE1MDQ4NmVhOA.preferences_pb.tmp
Size 345B
SHA256 dee092c7629116bd51c3a78d698e8737738f61be7f88b84095f5e672324c0cc6
MD5 faff600e1517db67b240c82c64c32fd0
SHA1 e239bd8de38def6328aa49777ba89e3ddbc38d4f
SHA512 bc6a58dc2a45d5d1f627bb9fa88bedf57c70d18912358c71bdad1990e01f3ecfebc07bbd66c24ddeb3f017e33ba16d1d880faa03b0f3e034b4aa454dd5fab808
TLSH
T1EEE02610D6929EE1597F510D3FB8022C0F2FB3D232BE449965F84180F90EA55D6C2F1B
MD5 SHA1 SHA512 TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.tbtraining.client/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 24fb499c1ba05f21b67f530bc557de025310f6d365c7649ccdabdaf79c8c7720
MD5 8c8704cf413f3a6743bb4411e891dd3a
SHA1 67e608179fcf674368ce7c20e8b91f039aff225f
SHA512 691260477996c02899c4482fcaf563b86eaa4dbeb0ae3462571a0f77c1cb17a75fd2b3e1f91ac191b5fa8a058be3810b4ce6f37c624eaca7e84357cf1733de4f
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.tbtraining.client/primary.prof
Size 2KB
SHA256 36675a10e592178f27620447b0e71407e008dfd4dbe0541c4b5dab49b0aed141
MD5 436573f679121e7f8c430dccf76808a6
SHA1 eba42caa30e537cd14bcb2eccbe9e6a13e96fa57
SHA512 7a9f80534ad0088d03a8bf06bb266074613d8395cc40462467ea1707bbdf6e1caf27b660b32f569df3dd4c3574dc58b2daad11d334653a1cf11778ee2b2b2746
TLSH
T1E6514B032CA0DE09723911F76E05B51CD22BDB867A82BC36801453B4E7A6B5D26B9B00
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads