Resubmissions
06/10/2022, 16:35
221006-t3rjtaabhq 1029/09/2021, 15:14
210929-smfa6sfbg7 829/09/2021, 15:11
210929-sk47hsfbg5 8Analysis
-
max time kernel
840946s -
platform
android_x86 -
resource
android-x86-arm -
submitted
29/09/2021, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
b2e592c5cf8ccc944c06a11ff156efdfa4233fe46e2281bab3fd238f03b505e3 (1).apk
Resource
android-x86-arm
0 signatures
0 seconds
General
-
Target
b2e592c5cf8ccc944c06a11ff156efdfa4233fe46e2281bab3fd238f03b505e3 (1).apk
-
Size
6.8MB
-
MD5
b1101bb941285fc54a21c271ee7bf60e
-
SHA1
e883525faf27f91493f17a657577289be038cd64
-
SHA256
b2e592c5cf8ccc944c06a11ff156efdfa4233fe46e2281bab3fd238f03b505e3
-
SHA512
c6368129febea4c32145c3f941590afdea9370ceb4ea10d7920125da8807bd733cc27b70d248750afffad832012a5bc2131e08717af1e89a30d1a74539efe881
Score
7/10
Malware Config
Signatures
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.faax.kcnbvlo.dtojtuo/code_cache/secondary-dexes/base.apk.classes1.zip 4851 /system/bin/dex2oat /data/user/0/com.faax.kcnbvlo.dtojtuo/code_cache/secondary-dexes/base.apk.classes1.zip 4523 com.faax.kcnbvlo.dtojtuo /data/user/0/com.faax.kcnbvlo.dtojtuo/code_cache/secondary-dexes/base.apk.classes2.zip 4880 /system/bin/dex2oat /data/user/0/com.faax.kcnbvlo.dtojtuo/code_cache/secondary-dexes/base.apk.classes2.zip 4523 com.faax.kcnbvlo.dtojtuo -
Uses reflection 22 IoCs
description pid Process Acesses field dalvik.system.BaseDexClassLoader.pathList 4523 com.faax.kcnbvlo.dtojtuo Invokes method dalvik.system.DexPathList.makePathElements 4523 com.faax.kcnbvlo.dtojtuo Acesses field dalvik.system.DexPathList.dexElements 4523 com.faax.kcnbvlo.dtojtuo Acesses field dalvik.system.DexPathList.dexElements 4523 com.faax.kcnbvlo.dtojtuo Invokes method android.app.ActivityThread.currentActivityThread 4523 com.faax.kcnbvlo.dtojtuo Acesses field android.app.ActivityThread.mBoundApplication 4523 com.faax.kcnbvlo.dtojtuo Acesses field android.app.ActivityThread$AppBindData.info 4523 com.faax.kcnbvlo.dtojtuo Acesses field android.app.LoadedApk.mApplication 4523 com.faax.kcnbvlo.dtojtuo Acesses field android.app.ActivityThread.mInitialApplication 4523 com.faax.kcnbvlo.dtojtuo Acesses field android.app.ActivityThread.mAllApplications 4523 com.faax.kcnbvlo.dtojtuo Acesses field android.app.LoadedApk.mApplicationInfo 4523 com.faax.kcnbvlo.dtojtuo Acesses field android.app.ActivityThread$AppBindData.appInfo 4523 com.faax.kcnbvlo.dtojtuo Invokes method android.app.LoadedApk.makeApplication 4523 com.faax.kcnbvlo.dtojtuo Acesses field android.app.ActivityThread.mInitialApplication 4523 com.faax.kcnbvlo.dtojtuo Invokes method dalvik.system.CloseGuard.get 4523 com.faax.kcnbvlo.dtojtuo Invokes method dalvik.system.CloseGuard.open 4523 com.faax.kcnbvlo.dtojtuo Invokes method dalvik.system.CloseGuard.get 4523 com.faax.kcnbvlo.dtojtuo Invokes method dalvik.system.CloseGuard.open 4523 com.faax.kcnbvlo.dtojtuo Invokes method dalvik.system.CloseGuard.get 4523 com.faax.kcnbvlo.dtojtuo Invokes method dalvik.system.CloseGuard.open 4523 com.faax.kcnbvlo.dtojtuo Invokes method dalvik.system.CloseGuard.get 4523 com.faax.kcnbvlo.dtojtuo Invokes method dalvik.system.CloseGuard.open 4523 com.faax.kcnbvlo.dtojtuo