Resubmissions

03-10-2023 04:35

231003-e7w8jaaa94 10

15-06-2022 10:30

220615-mj4xgagdc8 8

Analysis

  • max time kernel
    1726814s
  • max time network
    151s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    15-06-2022 10:30

General

  • Target

    36e0cfd29afaa0b0d6c7e5da433379112514cbe1b03b2c82d32f2fc14d57086b.apk

  • Size

    123KB

  • MD5

    39074c61fffeccf21907cd3dbf3ffffe

  • SHA1

    329c2e94e8c95a0d588fed72ea7e53fe21ea7837

  • SHA256

    36e0cfd29afaa0b0d6c7e5da433379112514cbe1b03b2c82d32f2fc14d57086b

  • SHA512

    119ec034f5286a2f7b5e78ed563ee18cbb6b8f602abb9001e4fa0248f6ae9bb259998591bc2b839bbad9b1e5412b8425a26f0ff45ec6e4beec1cd54084f5de66

Score
8/10

Malware Config

Signatures

  • Makes use of the framework's Accessibility service. 1 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.lineanysl
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:5068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.lineanysl/cache/oat/syxinxxjzdmhf.cur.prof

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.lineanysl/cache/syxinxxjzdmhf

    Filesize

    72KB

    MD5

    9af1044411e312db0bca097cba17b972

    SHA1

    f2de6a855f04a0f5e0999c5b413347adaa1197e2

    SHA256

    b67a102526766779119a6428b4e4ea6b94f7bb31eaec21cb82f96fb49524f604

    SHA512

    75615e48dcdaa67a06e294b991e90f94503553cf2f0708e3d2db227afdd1d408e7f902ec71302882abc198d4511965d2dcb1e42822aa69f990e009e8543f5f6d

  • /data/user/0/com.lineanysl/cache/syxinxxjzdmhf

    Filesize

    72KB

    MD5

    9af1044411e312db0bca097cba17b972

    SHA1

    f2de6a855f04a0f5e0999c5b413347adaa1197e2

    SHA256

    b67a102526766779119a6428b4e4ea6b94f7bb31eaec21cb82f96fb49524f604

    SHA512

    75615e48dcdaa67a06e294b991e90f94503553cf2f0708e3d2db227afdd1d408e7f902ec71302882abc198d4511965d2dcb1e42822aa69f990e009e8543f5f6d

  • /data/user/0/com.lineanysl/cache/syxinxxjzdmhf

    Filesize

    72KB

    MD5

    9af1044411e312db0bca097cba17b972

    SHA1

    f2de6a855f04a0f5e0999c5b413347adaa1197e2

    SHA256

    b67a102526766779119a6428b4e4ea6b94f7bb31eaec21cb82f96fb49524f604

    SHA512

    75615e48dcdaa67a06e294b991e90f94503553cf2f0708e3d2db227afdd1d408e7f902ec71302882abc198d4511965d2dcb1e42822aa69f990e009e8543f5f6d

  • /data/user/0/com.lineanysl/cache/syxinxxjzdmhf.x86.flock

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e