Analysis
-
max time kernel
2122828s -
max time network
177s -
platform
android_x64 -
resource
android-x64-arm64 -
submitted
14-10-2021 11:13
Static task
static1
Behavioral task
behavioral1
Sample
f82e2249a18b101e6309fb9fc73e2cf5ac1bda9ec1c20af7131b9c41f9d4e49d.apk
Resource
android-x64-arm64
General
-
Target
f82e2249a18b101e6309fb9fc73e2cf5ac1bda9ec1c20af7131b9c41f9d4e49d.apk
-
Size
4.1MB
-
MD5
d94d0b5ef1d2bc4d31c005ad005da951
-
SHA1
24a71cf921687da79bf16995513ca9b8b13db69b
-
SHA256
f82e2249a18b101e6309fb9fc73e2cf5ac1bda9ec1c20af7131b9c41f9d4e49d
-
SHA512
433b029eeb20df0ec0f224f888d7b1fbedf0cdbb5e80926105d66dee7b1b55d65d5f3eff895cb5403452d29bc5fe92874db8664a75a40b39501ec18d5284ffb1
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.baidu.searchboxioc pid process /data/user/0/com.baidu.searchbox/mfhbfvkfxj/hsspvbjhahjjhfh/base.apk.pndpmdd1.von 4689 com.baidu.searchbox -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
com.baidu.searchboxdescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS com.baidu.searchbox -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.baidu.searchboxdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.baidu.searchbox -
Uses reflection 64 IoCs
Processes:
com.baidu.searchboxdescription pid process Invokes method android.view.ViewGroup.makeOptionalFitsSystemWindows 4689 com.baidu.searchbox Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox Acesses field javax.security.auth.x500.X500Principal.thisX500Name 4689 com.baidu.searchbox
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.baidu.searchbox/mfhbfvkfxj/hsspvbjhahjjhfh/base.apk.pndpmdd1.vonMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.baidu.searchbox/mfhbfvkfxj/hsspvbjhahjjhfh/czzchkfb.fjlcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.baidu.searchbox/mfhbfvkfxj/hsspvbjhahjjhfh/tmp-base.apk.pndpmdd4804558437537963980.vonMD5
f9313ed684e69dc62fe5b66160fb9f41
SHA14fdc4306e5b27c0734d2467e0aabf30cead88f81
SHA25632ae2241d118eec01789756a87453e6302a5d2d80f4bda9fe81035cfba3afa8c
SHA512720544a67e2fe7aa3c59fd750524b549725f8a5d18892851b7a59246112db7b46113e49219f5b727271d4e71b6f23df7ba8940cd545bdd4a5cafdb644d18b5cd
-
/data/user/0/com.baidu.searchbox/shared_prefs/Voicemail.xmlMD5
1faf95cc36d225cb7cf173695258a343
SHA1eb016daa0c6c26d8023fcec6a0fc45e97ac0d5a5
SHA256b3fafb1913cc8cc508956d0a4f142a7102c0f1447030825c186d492be2b3ecaf
SHA51238c33070160503f03dd727fa825a8c61bb77c4f3cc262f5e7cdde045ac6c8b4dd065786bd945d6b8fe93046ac0ad014317b2b9235c86a1fc20546266045b56f3
-
/data/user/0/com.baidu.searchbox/shared_prefs/Voicemail.xmlMD5
d42c0c85ffd8b54d63264d8141dec2f2
SHA1c607dd302ced2cc1612fdb204ede483f7dc3dd9f
SHA256b25b1f6b9bb820cd01d25b3970f3256dca8e69495985e65f7a0ad0866be0403c
SHA5125c096c426c7b2df00ea26c7f417b0d290a0d548a032801dddacd04dc517a8557f2003c442b4d32c2b12cb68172c42dc3f29fcdc605f31cc6e724aa7858d818d9
-
/data/user/0/com.baidu.searchbox/shared_prefs/multidex.version.xmlMD5
b4366794a31d3c0a980d48df1267bfdb
SHA15984577f51d83aed0009001c02be15c4f1e1cea9
SHA25626bdfc99c197ab324b680653ad11ef995670c351bd11738e16e46d2b060a9632
SHA512e3eb82178faf79a93acef7407c56581cee8faeb8d711c5307f497fd1dadacb35b8aa999866de2c02f3d0f95a002f92b215499dc9e193b248e52f72f9aef71b8f