Behavioral Report

max time kernel3892954s
max time network155s
platformandroid_x86
resourceandroid-x86-arm-20220310-en
submitted21-05-2022 19:10

Report
Files
Registry
Network
Processes
Mutex
Misc

Target

05406d0b5baff4e5061cc05b55b2b7b713553bde7875ba47787ebd43db267a6d.apk

Filesize

533KB

Completed

21-05-2022 19:13

Task

behavioral1

Score

7^/10

MD5

5ce7ac129781ca322f19c918ff169f1b

SHA1

3392e9ff937ed197b31a01649a7e16ff7ee42ef9

SHA256

05406d0b5baff4e5061cc05b55b2b7b713553bde7875ba47787ebd43db267a6d

SHA256

1e975363b772b7ca27fa9c0e69f7c6fd49a58305cc97a73d9f1a86d050e1d6e5c8605da17bc4ce54c07fef279e61e728ea2ba069aa2deec44ca8665a68198364

evasion ransomware

Acquires the wake lock.
tetkong.com

Reported IOCs

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock tetkong.com

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	tetkong.com

Loads dropped Dex/Jar

tetkong.com/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/data/tetkong.com/b.zip --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/data/tetkong.com/oat/x86/b.odex --compiler-filter=quicken --class-loader-context=&

Description

Runs executable file dropped to the device during analysis.

Reported IOCs

ioc	pid	process
/data/data/tetkong.com/b.zip	5307	tetkong.com
/data/data/tetkong.com/b.zip	5396	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/data/tetkong.com/b.zip --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/data/tetkong.com/oat/x86/b.odex --compiler-filter=quicken --class-loader-context=&
/data/data/tetkong.com/b.zip	5307	tetkong.com

Reads information about phone network operator.
Removes a system notification.
tetkong.com

Tags

evasion

Reported IOCs

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag tetkong.com
Uses Crypto APIs (Might try to encrypt user data).
tetkong.com

Tags

ransomware

Reported IOCs

description ioc process

Framework API call javax.crypto.Cipher.doFinal tetkong.com

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	tetkong.com

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	tetkong.com

tetkong.com

Acquires the wake lock.
Loads dropped Dex/Jar
Removes a system notification.
Uses Crypto APIs (Might try to encrypt user data).

PID:5307

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/data/tetkong.com/b.zip --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/data/tetkong.com/oat/x86/b.odex --compiler-filter=quicken --class-loader-context=&

Loads dropped Dex/Jar

PID:5396

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

00:00 00:00

/data/data/tetkong.com/b.zip
MD5
baf68a28e14eb22f0231d9203f04054f

SHA1
1da7e5115add76700eb2512f7efccbb1149fe939

SHA256
625e8a091952d4c0799eb36910fedc3d335407f9fd32549e275ea8409babc8f1

SHA512
27bacd61d6e5d03e6491af2878e60ed12f07e077745edfceec0f04c2233df54e7b7c602549b2d6522ecae3cf75d0928e9da8b237e6ba9839569d8cc8e2661d37

Download Submit
/data/data/tetkong.com/b.zip
MD5
baf68a28e14eb22f0231d9203f04054f

SHA1
1da7e5115add76700eb2512f7efccbb1149fe939

SHA256
625e8a091952d4c0799eb36910fedc3d335407f9fd32549e275ea8409babc8f1

SHA512
27bacd61d6e5d03e6491af2878e60ed12f07e077745edfceec0f04c2233df54e7b7c602549b2d6522ecae3cf75d0928e9da8b237e6ba9839569d8cc8e2661d37

Download Submit
/data/data/tetkong.com/b.zip
MD5
baf68a28e14eb22f0231d9203f04054f

SHA1
1da7e5115add76700eb2512f7efccbb1149fe939

SHA256
625e8a091952d4c0799eb36910fedc3d335407f9fd32549e275ea8409babc8f1

SHA512
27bacd61d6e5d03e6491af2878e60ed12f07e077745edfceec0f04c2233df54e7b7c602549b2d6522ecae3cf75d0928e9da8b237e6ba9839569d8cc8e2661d37

Download Submit
/data/data/tetkong.com/b.zip
MD5
baf68a28e14eb22f0231d9203f04054f

SHA1
1da7e5115add76700eb2512f7efccbb1149fe939

SHA256
625e8a091952d4c0799eb36910fedc3d335407f9fd32549e275ea8409babc8f1

SHA512
27bacd61d6e5d03e6491af2878e60ed12f07e077745edfceec0f04c2233df54e7b7c602549b2d6522ecae3cf75d0928e9da8b237e6ba9839569d8cc8e2661d37

Download Submit
/data/data/tetkong.com/b.zip.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/data/tetkong.com/oat/x86/b.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/data/tetkong.com/oat/x86/b.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/tetkong.com/files/config
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Filter: none

Reported IOCs

Description

Reported IOCs

Tags

Reported IOCs

Tags

Reported IOCs

Title