Analysis

  • max time kernel
    4134965s
  • max time network
    15s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    24-05-2022 14:05

General

  • Target

    23e0495b5126aa8d682839f578cb998abb322eaeed70269fb4499acaffc4786d.apk

  • Size

    24.6MB

  • MD5

    0e27ca8cd868432262400ec0f3338cb4

  • SHA1

    1d43a451b3e97bcf175d22193c8df35498d09c41

  • SHA256

    23e0495b5126aa8d682839f578cb998abb322eaeed70269fb4499acaffc4786d

  • SHA512

    bdab610851b290a9055d9942767de872a91c6289338558d8fc76c80a1b38150e4f71f4a6fe227b524394311e57667badd57e8a11a6a05a0469a2a71d207c9fe9

Malware Config

Signatures

  • Agent smith

    Agent smith is a modular adware that installs malicious ADs into legitimate applications.

  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Requests dangerous framework permissions 1 IoCs
  • Reads information about phone network operator.
  • Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs

Processes

  • com.mfkj.fkpkdwy.mi
    1⤵
    • Requests cell location
    • Listens for changes in the sensor environment (might be used to detect emulation).
    PID:5083

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.mfkj.fkpkdwy.mi/app_mimo/mimo_asset.apk

    Filesize

    300KB

    MD5

    b3bc6255feea6cd9398fa0cc9da7a88d

    SHA1

    85924ff9afd7531e191367a1c1c086829161fa19

    SHA256

    8de83f61dbba332ba95cdeefea24114adc08f483b45398a53bf06f5608e4d65e

    SHA512

    0020ec00005ac5127d9425dea6713980881d33b72c767c42d0237fad5cf403c751a6d8d153ce6b4286e227042b36c0909e2a7af55b635963193e6cc99e78a644

  • /data/user/0/com.mfkj.fkpkdwy.mi/app_mimo/mimo_asset.apk.x86.flock

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.mfkj.fkpkdwy.mi/app_mimo/oat/x86/mimo_asset.odex

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.mfkj.fkpkdwy.mi/app_mimo/oat/x86/mimo_asset.vdex

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.mfkj.fkpkdwy.mi/cache/top.zip

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e