Analysis
-
max time kernel
3870009s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
21-05-2022 11:27
Static task
static1
Behavioral task
behavioral1
Sample
6dc103a02df579a9fd667672b964f9d3ea860c3275eaa8530fc44a1376937c15.apk
Resource
android-x86-arm-20220310-en
Behavioral task
behavioral2
Sample
6dc103a02df579a9fd667672b964f9d3ea860c3275eaa8530fc44a1376937c15.apk
Resource
android-x64-20220310-en
Behavioral task
behavioral3
Sample
6dc103a02df579a9fd667672b964f9d3ea860c3275eaa8530fc44a1376937c15.apk
Resource
android-x64-arm64-20220310-en
General
-
Target
6dc103a02df579a9fd667672b964f9d3ea860c3275eaa8530fc44a1376937c15.apk
-
Size
2.6MB
-
MD5
7754887b45ad387228fd485ffb659476
-
SHA1
5f02ab9b0e6eb0c4beca5b7de128735f357f30ed
-
SHA256
6dc103a02df579a9fd667672b964f9d3ea860c3275eaa8530fc44a1376937c15
-
SHA512
653c218fb5d682d86fcdab88b61de62708c00e105efdfe7b26bdb24c7b505c7ff85e848009280b1af221d628502d9b4cd13aa007e657ce18b92b17db86af1a35
Malware Config
Signatures
-
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
tro.jgb.oawllkyljojmwzkuxcqxddescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId tro.jgb.oawllkyljojmwzkuxcqxd Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText tro.jgb.oawllkyljojmwzkuxcqxd -
Acquires the wake lock. 1 IoCs
Processes:
tro.jgb.oawllkyljojmwzkuxcqxddescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock tro.jgb.oawllkyljojmwzkuxcqxd -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
tro.jgb.oawllkyljojmwzkuxcqxd/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/RxGML.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/oat/x86/RxGML.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/RxGML.json 5289 tro.jgb.oawllkyljojmwzkuxcqxd /data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/RxGML.json 5396 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/RxGML.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/oat/x86/RxGML.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/RxGML.json 5289 tro.jgb.oawllkyljojmwzkuxcqxd -
Reads information about phone network operator.
Processes
-
tro.jgb.oawllkyljojmwzkuxcqxd1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/RxGML.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/oat/x86/RxGML.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/RxGML.jsonFilesize
1.1MB
MD5dcf31b242cdd9100a3cd425007b216fc
SHA15110f68eed71905e94961b731870d2742b79e3b0
SHA256475763a1fa838191bed9831fde887f944b9fd882656f3fb8ebbd5bb8b9d67f54
SHA512da7a734da4df75d61f19049b13b839d0b0da48c0d5c74fe50533f653d5ebd04f0ae3da695f4275ac8e27498c7f0bafcb4b75453ee0da2e32dec193a5aa31ec81
-
/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/RxGML.jsonFilesize
1.1MB
MD53c38342a75b0ce6314ff72bf395be057
SHA1cbe3d153e6f0eca3a6c8a5966a93d78653a8bd89
SHA256c0258820c90459aefb72595bd717f5c7cc036f3866acbcb4ddeb54444e8a35cb
SHA5122aadf0ce2b6ae8c867f46411ac9c6aa99da331b8a51d5a4328fc28f7fae49ef5436fb641a53eace8a447e2be284ecefe9a135de2801b44cea5a42ad640035282
-
/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/RxGML.jsonFilesize
1.1MB
MD5102cf56093b5635f74286108d44fc5b4
SHA184d308775b7862dbbda6abf4d876a04ec4dd018a
SHA25684d975d28046436ba9c85449fc4bb14a58e26043bc553b663106ae29729f36eb
SHA51202ab4ed60a0d2956581d0cdc4c6af65c1cad35741fad93b1f2ae17875ee7cff38b07e96b55f925c6fd89b632a4299d9f976a355ecae741c81c7fe614cb767b8a
-
/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/RxGML.jsonFilesize
1.1MB
MD53c38342a75b0ce6314ff72bf395be057
SHA1cbe3d153e6f0eca3a6c8a5966a93d78653a8bd89
SHA256c0258820c90459aefb72595bd717f5c7cc036f3866acbcb4ddeb54444e8a35cb
SHA5122aadf0ce2b6ae8c867f46411ac9c6aa99da331b8a51d5a4328fc28f7fae49ef5436fb641a53eace8a447e2be284ecefe9a135de2801b44cea5a42ad640035282
-
/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/RxGML.json.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/oat/RxGML.json.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/oat/x86/RxGML.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/tro.jgb.oawllkyljojmwzkuxcqxd/app_DynamicOptDex/oat/x86/RxGML.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e