General

  • Target

    app-projz-20240512.apk

  • Size

    360.3MB

  • Sample

    240701-eea5layekm

  • MD5

    19aa1c8d4738b33b51889886cb4a4d27

  • SHA1

    aa9c122aa5a67f5a2454b70377be4ecbaaa4292c

  • SHA256

    c9d8629070d5cefc3aac5438218e9c1c63a4353b3026ffd8738e34e92060101a

  • SHA512

    512fd08f2be3d22fd8ae6e35c94f118c80795f384e9f218effdce948b225f14f30ec220673073bc9be6e75f7982582cc40a35a92f72dbbb687ba1841c8be6785

  • SSDEEP

    6291456:wgYxYkeW/qtUW0Pfh9H6OLF50Juvt65pU/CNpYHTa:wJeGVpGJYUpU/CSHTa

Malware Config

Targets

    • Target

      app-projz-20240512.apk

    • Size

      360.3MB

    • MD5

      19aa1c8d4738b33b51889886cb4a4d27

    • SHA1

      aa9c122aa5a67f5a2454b70377be4ecbaaa4292c

    • SHA256

      c9d8629070d5cefc3aac5438218e9c1c63a4353b3026ffd8738e34e92060101a

    • SHA512

      512fd08f2be3d22fd8ae6e35c94f118c80795f384e9f218effdce948b225f14f30ec220673073bc9be6e75f7982582cc40a35a92f72dbbb687ba1841c8be6785

    • SSDEEP

      6291456:wgYxYkeW/qtUW0Pfh9H6OLF50Juvt65pU/CNpYHTa:wJeGVpGJYUpU/CSHTa

    • Checks if the Android device is rooted.

    • Checks known Qemu files.

      Checks for known Qemu files that exist on Android virtual device images.

    • Checks known Qemu pipes.

      Checks for known pipes used by the Android emulator to communicate with the host.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Acquires the wake lock

    • Queries information about active data network

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

    • Checks the presence of a debugger

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Matrix

Tasks