a4874ebfe480449a897f86c87a490fbc4c2276d5bad4ff92bc93e2e8ae8efc66

General

Target

easy.apk
Size

2.1MB
MD5

abb4a1192d0919da01aa87b53538fb7c
SHA1

b998c6de3c3835774eea6519102ce1fc040e33a3
SHA256

a4874ebfe480449a897f86c87a490fbc4c2276d5bad4ff92bc93e2e8ae8efc66
SHA512

32c922b6ae4f12e614b44242d35f662fa22cda62401eac4eb5b26ba25cd72470ccd756fa96674210fa7e63ef9a63da0066107f820abd51acc0f3278f8990c8a9

Score

8^/10

evasion ransomware

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.mazocexayori.kute

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.mazocexayori.kute
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.mazocexayori.kute
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.mazocexayori.kute

Acquires the wake lock. 1 IoCs

Processes:

com.mazocexayori.kute

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.mazocexayori.kute

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mazocexayori.kute

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/SRoCr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/oat/x86/SRoCr.odex --compiler-filter=quicken --class-loader-context=&com.mazocexayori.kute

ioc	pid	process
/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/SRoCr.json	5159	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/SRoCr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/oat/x86/SRoCr.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/SRoCr.json	5080	com.mazocexayori.kute

Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

com.mazocexayori.kute

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.mazocexayori.kute
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.mazocexayori.kute

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.mazocexayori.kute

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.mazocexayori.kute

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.mazocexayori.kute

com.mazocexayori.kute
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5080
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/SRoCr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/oat/x86/SRoCr.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5159

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/SRoCr.json

Filesize
455KB

MD5
8b15d6d054396b7f2592bb15715a93f8

SHA1
68578410100527c2a749379c0c198e7c9e7a2bdd

SHA256
0cb370277d333e8d80d5b89983d0986015ede54b8a0a346878bbf97d68cf366b

SHA512
d85b174e376adb31b5d11068998510fc1bf1715ebf57de62187e9410c346a1df23ffeff11a32c0e3b514138e56c97cb81ac276499cab3c037c9f74cf8eb24e88

Download Submit
/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/SRoCr.json

Filesize
899KB

MD5
31c2fc356f6713971015c75a23eeac88

SHA1
3b3a8b5d219358faa69ce71578016e60eb16b6fd

SHA256
783e42abc088c6e4eba1a26f68b6bf9f64cd8238d4f7eb01bc0a1c0ea36d6bbb

SHA512
a53ce44173d4686639f43d335b15381aede230ebcce049d7c9acc4004f4d88334165249d8b9cea4d356d94965501a6a404fb3d9776e5388dbf42f8568e56babd

Download Submit
/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/SRoCr.json

Filesize
899KB

MD5
5563d646c4d02026b36d98acd41bc6dd

SHA1
27165c74688e58352678cad97ae22598fbcd948f

SHA256
78a11223e3450f6d10e7baf5d3f1e8a948e64233fb735e5b9bb7a799717ba11d

SHA512
ac0731e02f33a49ae051e49e89b9ca04dab7bbaeb75772f13fe9040cfc4d53834335bef8c5356f33df48ac7621d538a59716b9dfca4048878bb3b7f34f9bca1b

Download Submit
/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/SRoCr.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/oat/SRoCr.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/oat/x86/SRoCr.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.mazocexayori.kute/app_DynamicOptDex/oat/x86/SRoCr.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing