b2e592c5cf8ccc944c06a11ff156efdfa4233fe46e2281bab3fd238f03b505e3

Resubmissions

06/10/2022, 16:35

221006-t3rjtaabhq10

29/09/2021, 15:14

210929-smfa6sfbg78

29/09/2021, 15:11

210929-sk47hsfbg58

Analysis

max time kernel
840946s
platform
android_x86
resource
android-x86-arm
submitted
29/09/2021, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2e592c5cf8ccc944c06a11ff156efdfa4233fe46e2281bab3fd238f03b505e3 (1).apk
Size 6.8MB
Sample210929-smfa6sfbg7
SHA256 b2e592c5cf8ccc944c06a11ff156efdfa4233fe46e2281bab3fd238f03b505e3
MD5 b1101bb941285fc54a21c271ee7bf60e
SHA1 e883525faf27f91493f17a657577289be038cd64
SHA512 c6368129febea4c32145c3f941590afdea9370ceb4ea10d7920125da8807bd733cc27b70d248750afffad832012a5bc2131e08717af1e89a30d1a74539efe881
MD5 SHA1 SHA512

Score

7^/10

obfuscation

Malware Config

Signatures

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.faax.kcnbvlo.dtojtuo/code_cache/secondary-dexes/base.apk.classes1.zip	4851	/system/bin/dex2oat
/data/user/0/com.faax.kcnbvlo.dtojtuo/code_cache/secondary-dexes/base.apk.classes1.zip	4523	com.faax.kcnbvlo.dtojtuo
/data/user/0/com.faax.kcnbvlo.dtojtuo/code_cache/secondary-dexes/base.apk.classes2.zip	4880	/system/bin/dex2oat
/data/user/0/com.faax.kcnbvlo.dtojtuo/code_cache/secondary-dexes/base.apk.classes2.zip	4523	com.faax.kcnbvlo.dtojtuo

Uses reflection 22 IoCs

obfuscation

description	pid	Process
Acesses field dalvik.system.BaseDexClassLoader.pathList	4523	com.faax.kcnbvlo.dtojtuo
Invokes method dalvik.system.DexPathList.makePathElements	4523	com.faax.kcnbvlo.dtojtuo
Acesses field dalvik.system.DexPathList.dexElements	4523	com.faax.kcnbvlo.dtojtuo
Acesses field dalvik.system.DexPathList.dexElements	4523	com.faax.kcnbvlo.dtojtuo
Invokes method android.app.ActivityThread.currentActivityThread	4523	com.faax.kcnbvlo.dtojtuo
Acesses field android.app.ActivityThread.mBoundApplication	4523	com.faax.kcnbvlo.dtojtuo
Acesses field android.app.ActivityThread$AppBindData.info	4523	com.faax.kcnbvlo.dtojtuo
Acesses field android.app.LoadedApk.mApplication	4523	com.faax.kcnbvlo.dtojtuo
Acesses field android.app.ActivityThread.mInitialApplication	4523	com.faax.kcnbvlo.dtojtuo
Acesses field android.app.ActivityThread.mAllApplications	4523	com.faax.kcnbvlo.dtojtuo
Acesses field android.app.LoadedApk.mApplicationInfo	4523	com.faax.kcnbvlo.dtojtuo
Acesses field android.app.ActivityThread$AppBindData.appInfo	4523	com.faax.kcnbvlo.dtojtuo
Invokes method android.app.LoadedApk.makeApplication	4523	com.faax.kcnbvlo.dtojtuo
Acesses field android.app.ActivityThread.mInitialApplication	4523	com.faax.kcnbvlo.dtojtuo
Invokes method dalvik.system.CloseGuard.get	4523	com.faax.kcnbvlo.dtojtuo
Invokes method dalvik.system.CloseGuard.open	4523	com.faax.kcnbvlo.dtojtuo
Invokes method dalvik.system.CloseGuard.get	4523	com.faax.kcnbvlo.dtojtuo
Invokes method dalvik.system.CloseGuard.open	4523	com.faax.kcnbvlo.dtojtuo
Invokes method dalvik.system.CloseGuard.get	4523	com.faax.kcnbvlo.dtojtuo
Invokes method dalvik.system.CloseGuard.open	4523	com.faax.kcnbvlo.dtojtuo
Invokes method dalvik.system.CloseGuard.get	4523	com.faax.kcnbvlo.dtojtuo
Invokes method dalvik.system.CloseGuard.open	4523	com.faax.kcnbvlo.dtojtuo

com.faax.kcnbvlo.dtojtuo
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:4523
- com.faax.kcnbvlo.dtojtuo
  2⤵
  PID:4851
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:4851
- com.faax.kcnbvlo.dtojtuo
  2⤵
  PID:4880
- /system/bin/dex2oat
  2⤵
  - Loads dropped Dex/Jar
  PID:4880

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads