Analysis
-
max time kernel
3872704s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20220310-en -
submitted
21-05-2022 11:30
Static task
static1
Behavioral task
behavioral1
Sample
065b92511fbf9c7a8262d4ff9ceb4abc2cf1d19c75fd80b6e5ab95ac3bfafb22.apk
Resource
android-x86-arm-20220310-en
Behavioral task
behavioral2
Sample
065b92511fbf9c7a8262d4ff9ceb4abc2cf1d19c75fd80b6e5ab95ac3bfafb22.apk
Resource
android-x64-20220310-en
Behavioral task
behavioral3
Sample
065b92511fbf9c7a8262d4ff9ceb4abc2cf1d19c75fd80b6e5ab95ac3bfafb22.apk
Resource
android-x64-arm64-20220310-en
General
-
Target
065b92511fbf9c7a8262d4ff9ceb4abc2cf1d19c75fd80b6e5ab95ac3bfafb22.apk
-
Size
292KB
-
MD5
62290a75f7c85d6d088f486715712718
-
SHA1
8a7b88e6ad38d46b3acbb5813d2739d739ffdd63
-
SHA256
065b92511fbf9c7a8262d4ff9ceb4abc2cf1d19c75fd80b6e5ab95ac3bfafb22
-
SHA512
d31a19db82a198e4cba67e646d81a01a70da82a122c4addedb163279fe06eaf02456f4f861acc049f83527e23d3b366d7f819be2e10ea7e5e003b1ff794c26ec
Malware Config
Signatures
-
Acquires the wake lock. 1 IoCs
Processes:
com.pqas.xrzmdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.pqas.xrzm -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.pqas.xrzmioc pid process /data/user/0/com.pqas.xrzm/files/dex 5138 com.pqas.xrzm /data/user/0/com.pqas.xrzm/files/dex 5138 com.pqas.xrzm -
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.pqas.xrzmdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.pqas.xrzm
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.pqas.xrzm/files/dexFilesize
484KB
MD5ccb0ba6ba7ba68690c70d59924a595c6
SHA1d8ef45c75fa9e280d957d24c8cf754021708d0f4
SHA256aa2777f1ecc605371ab6b5ad6834e180029524985672ac8f3d4f68aca15a379d
SHA51240a2dde59493b7770f6dc9dae2eef3ea890a5b07b40f07b6f17f7f1db5153a0fe468daaf728b801b5392380d0a62f0168552a5ad54efb8d42c93dda350142618
-
/data/user/0/com.pqas.xrzm/files/dexFilesize
484KB
MD5ccb0ba6ba7ba68690c70d59924a595c6
SHA1d8ef45c75fa9e280d957d24c8cf754021708d0f4
SHA256aa2777f1ecc605371ab6b5ad6834e180029524985672ac8f3d4f68aca15a379d
SHA51240a2dde59493b7770f6dc9dae2eef3ea890a5b07b40f07b6f17f7f1db5153a0fe468daaf728b801b5392380d0a62f0168552a5ad54efb8d42c93dda350142618
-
/data/user/0/com.pqas.xrzm/files/dexFilesize
484KB
MD5ccb0ba6ba7ba68690c70d59924a595c6
SHA1d8ef45c75fa9e280d957d24c8cf754021708d0f4
SHA256aa2777f1ecc605371ab6b5ad6834e180029524985672ac8f3d4f68aca15a379d
SHA51240a2dde59493b7770f6dc9dae2eef3ea890a5b07b40f07b6f17f7f1db5153a0fe468daaf728b801b5392380d0a62f0168552a5ad54efb8d42c93dda350142618
-
/data/user/0/com.pqas.xrzm/files/dex.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.pqas.xrzm/files/oat/dex.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e