8e2f70ff04bc9adef1a591fc49daa6f6b035dc24491d1176c0e66da77824460e

Analysis

max time kernel
75s
max time network
138s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
29-06-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e2f70ff04bc9adef1a591fc49daa6f6b035dc24491d1176c0e66da77824460e.apk
Size

2.1MB
MD5

4cb82880f878e48dce90131abf791eed
SHA1

3907c3d739014de8a7be87ac13a5b45e7b091759
SHA256

8e2f70ff04bc9adef1a591fc49daa6f6b035dc24491d1176c0e66da77824460e
SHA512

c4b0735f49e5dd8e59f7d9a5feeef5b0d052f803cb9c9fdafa440ec085cbf99dc14e8f890e20732f763b1ec306f8ce729417f55fc1ea0fb87c749d6fc4a9b8a4
SSDEEP

49152:IFq00C3GNA34Nbh/4ezw4/q88QhmXdFMT1at3H65pFYtv9:Y0JNA34NPw4y8nB1gEU9

Score

7^/10

banker collection discovery evasion execution persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.govkrportalmai.kr

ioc	pid	process
/data/user/0/com.govkrportalmai.kr/app_ui.App/newobfs/0.pobfs	4509	com.govkrportalmai.kr
/data/user/0/com.govkrportalmai.kr/app_ui.App/newobfs/0.pobfs	4509	com.govkrportalmai.kr
/data/user/0/com.govkrportalmai.kr/app_ui.App/newobfs/1.pobfs	4509	com.govkrportalmai.kr
/data/user/0/com.govkrportalmai.kr/app_ui.App/newobfs/1.pobfs	4509	com.govkrportalmai.kr

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Reads the contacts stored on the device. 1 TTPs 1 IoCs
collection

T1636.003

Processes:

com.govkrportalmai.kr

description ioc process

URI accessed for read content://com.android.contacts/contacts com.govkrportalmai.kr
Acquires the wake lock 1 IoCs

Processes:

com.govkrportalmai.kr

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.govkrportalmai.kr
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.govkrportalmai.kr

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.govkrportalmai.kr
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.govkrportalmai.kr

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.govkrportalmai.kr
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

T1628.002

Processes:

com.govkrportalmai.kr

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.govkrportalmai.kr
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

T1603

Processes:

com.govkrportalmai.kr

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.govkrportalmai.kr

description	ioc	process
URI accessed for read	content://com.android.contacts/contacts	com.govkrportalmai.kr

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.govkrportalmai.kr

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.govkrportalmai.kr

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.govkrportalmai.kr

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.govkrportalmai.kr

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.govkrportalmai.kr

com.govkrportalmai.kr
1⤵
- Loads dropped Dex/Jar
- Reads the contacts stored on the device.
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
PID:4509

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.govkrportalmai.kr/app_ui.App/newobfs/0.pobfs
Filesize
2.8MB

MD5
7836185dc8f50d2ae39579357670b7c7

SHA1
b4376ebd25ea7c0809abe721d40211cab97de42e

SHA256
82977663278b0daa56cd178e87b7ab2e3621b8147aa6743f79c35891893fc9d1

SHA512
74e9ba302e1497911bcbf55c62527f441f9c3a51dfd2b098faeb8adc9f039744c401404b48fb7ce6c5ad526075ea2a7722aae17230fc1c468d2b1bf3d586706d

Download Submit
/data/data/com.govkrportalmai.kr/app_ui.App/newobfs/1.pobfs
Filesize
382KB

MD5
06bce5cb2abeb69d44848841b12b3be0

SHA1
563363c3f987e9f2ee8dab58ddc33f1be93e802f

SHA256
aea6ffef21ee597a275d2a88051a9d22f25655475b4e98dd62d31f6574f9f742

SHA512
1bb8992c59a727fdcd4f7bf7782f50b634fdb6c31687cb10414d60c97f4f1f1ca90d9d5cd3ffec149a43628c5678bb97455e7dc69e8995937d33f0872920604d

Download Submit
/data/data/com.govkrportalmai.kr/files/config
Filesize
92B

MD5
2957afdecb5926ac707b0a3f80dd4f39

SHA1
ce7c618cfada9a071803a2bcb90e3adda0e12e3c

SHA256
89954fd301f257e5e4639ebe7b40e5932def1627cc1e0788e0042903900aba91

SHA512
def0720594717e19769ae3e939036b7ca79a8ee227193b7cf2ff886bad5d01ebe5523533d678097ac569a7b9418cf89e01c876176d4bfe0700a07049bce22b93

Download Submit
/data/data/com.govkrportalmai.kr/files/config
Filesize
90B

MD5
a78e48a137f39ef5a01cf091eb2aa2f7

SHA1
840a65203facb2b539d803b857b1a59d8c1c7937

SHA256
eb8889e4f023d20b0dbbd53396b4eaddc07c693c3ddb050170962d14bc96fba9

SHA512
5ec4612dbf21c20fdce6e152dedd7f23e97d2013cc5db7444f965104b6d90ed4326ef4b879e64d7a7e0f2e14f38e4f41e0be5e3e5d7618692e09e55125c4dab4

Download Submit