1e1489deadd613d8a0ef3477d4a113b6680f91f0023f5daf39400900144743aa

General

Target

1e1489deadd613d8a0ef3477d4a113b6680f91f0023f5daf39400900144743aa.apk
Size

3.2MB
MD5

b40df30630f5c633fe87ee5a185be1d1
SHA1

9e3f94ebec0cb4dafe8c97dfa45f41abcfde55a2
SHA256

1e1489deadd613d8a0ef3477d4a113b6680f91f0023f5daf39400900144743aa
SHA512

3faa34c838ec964e0251d62fd42fb4dd97f9c1790d97a3b0340c652abbbd4ba9b0ff7d40c877f06a33bb96b98e62f0d8afdf75d49dc5f6e857640ec9124162c7

Score

8^/10

Malware Config

Signatures

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz

Acquires the wake lock. 1 IoCs

Processes:

wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/oat/x86/MtAhQy.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json	5193	wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json	5301	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/oat/x86/MtAhQy.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json	5193	wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz

wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:5193

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/oat/x86/MtAhQy.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:5301

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json

Filesize
2.0MB

MD5
54ac946b9f240236a85f48726d9bd82e

SHA1
571f48f3fe6a08e3b67221a80f8693c76dc0003b

SHA256
1f4210c5e60e4f95ea4f36d3d1ad6881ecec25341962d6477d1ab0238aa86080

SHA512
4051064c2903d1a27bf217bcfe73e4cab5a648afcff0020bd02e3876a3342073c25f1faeda96bd4b2c0f97ad1fd406516efa249ce427ad1cd5ff72d3c5b554c1

Download Submit
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json

Filesize
2.0MB

MD5
0e638a36501717f15d6431022b4980c3

SHA1
920ffaeee3807d5cb607e7ec3bd11648ead78128

SHA256
e39ebb324970b3e03a4c4de00710e83020ed20a8286a534402d1ec5109c2172b

SHA512
ff20964036a0acf6e72516fd9a6eac1649b87a707401909c6affdf0647aaf789a894378f7d5d75abd3d69fa6527c14786bad04bfdc497693e95d78ee05fc1f11

Download Submit
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json

Filesize
2.0MB

MD5
541e8ec81a6dc63257e3176b14f41e62

SHA1
c73182864c38abb4a0bb5194c91de17dfda1e0f6

SHA256
a6b6fd60cfe81842cbe6b7f6daea051bb69668d50f74ea36b4a41b42a575ab23

SHA512
9cacf5d4cfd52a9b32cfaf701504ec8d42616ff192f2f0d07f025cdb7f413ec6c24e1b093b099ac2ba04174b9fc02d3109dbdbf50e2cdbc9aff994d6481ef7e8

Download Submit
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json

Filesize
2.0MB

MD5
0e638a36501717f15d6431022b4980c3

SHA1
920ffaeee3807d5cb607e7ec3bd11648ead78128

SHA256
e39ebb324970b3e03a4c4de00710e83020ed20a8286a534402d1ec5109c2172b

SHA512
ff20964036a0acf6e72516fd9a6eac1649b87a707401909c6affdf0647aaf789a894378f7d5d75abd3d69fa6527c14786bad04bfdc497693e95d78ee05fc1f11

Download Submit
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/oat/MtAhQy.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/oat/x86/MtAhQy.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/oat/x86/MtAhQy.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing