Analysis

  • max time kernel
    3094294s
  • max time network
    11s
  • platform
    android_x86
  • resource
    android-x86-arm-20220621-en
  • submitted
    01-07-2022 05:27

General

  • Target

    ccae261001d4779dcb7c35c70c13f70c5c79d54ee8911254f6a7205c6b6adfee.apk

  • Size

    1.2MB

  • MD5

    1e12664e5cc5c89083c2b7d47136071f

  • SHA1

    2e5a19ed53cea73524e6d70fdae2422344916cac

  • SHA256

    ccae261001d4779dcb7c35c70c13f70c5c79d54ee8911254f6a7205c6b6adfee

  • SHA512

    862989eee1beb54afe3d2528a3581f02e91e8d010e1efcb4a820fad76951f4d949ffd513e61333f4e159c3f81e7582778fd0d5dad1d68bcc5ed0ca81c4e5be08

Score
7/10

Malware Config

Signatures

  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.example.zcjhly1
    1⤵
    • Loads dropped Dex/Jar
    PID:4247
    • sh -c /system/bin/dexopt --zip 45 49 a-shit-file-nonexist.jar v=n,o=v
      2⤵
        PID:4556
      • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.example.zcjhly1/files/libmobisecy1.zip --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.example.zcjhly1/files/oat/x86/libmobisecy1.odex --compiler-filter=quicken --class-loader-context=&
        2⤵
        • Loads dropped Dex/Jar
        PID:4736

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/user/0/com.example.zcjhly1/files/.timestamp

      Filesize

      112B

      MD5

      6ab845a35ab60ff319a7d7ad912bcffd

      SHA1

      896e5685957e383a0df9da0dac38e837f9ff3aeb

      SHA256

      67815e1d1b289069a24aea0dd47b19d8bd046c18fc5ae94193960aadc723642e

      SHA512

      fc951cb59dcdf504739633fb9973c7e44fc928b4cf1289990314fa8e50e3927b7d8051d126c8bf2ca8d3dbb564fd2c7a449bcbbfa947d47419fcfed95389a8f7

    • /data/user/0/com.example.zcjhly1/files/dencryptShellLock

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.example.zcjhly1/files/libmobisecx1.so

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.example.zcjhly1/files/libmobisecy1.zip

      Filesize

      833KB

      MD5

      aa87051897a4fe6fac62d75abfcc311b

      SHA1

      1b7baa358318666a3adb3f7c7050cef910f666df

      SHA256

      6d0a0bb1b84b30e98626ab1eba6340a5661aedc8e3f7191645804a32996fd2ff

      SHA512

      90c9f26f5dd08cf1f479503d4f94fcafaa069b272ac3fd6a1a394b57ec532ae3a96beea8419edf342e83a6197bd925c32bff5881c5bc1bf56caf61daebab9cb8

    • /data/user/0/com.example.zcjhly1/files/libmobisecy1.zip

      Filesize

      833KB

      MD5

      c4c8bcd1f2fffa7d4a6e9bb99c408b69

      SHA1

      0dee80d93c8370085b48f6861adf10743a1c3712

      SHA256

      ec84432215024e84391d253664c145c5bbd009d683678bc5fd7f7be170f917f9

      SHA512

      019952dfba185d950887d9e75fd379f3ec3778782a892c6c771460d299bfabb7c76c9b3f295e89f23816a6d8a43ee7fb14ed541897185f906fca0f5d3111cb43

    • /data/user/0/com.example.zcjhly1/files/libmobisecy1.zip

      Filesize

      833KB

      MD5

      c4c8bcd1f2fffa7d4a6e9bb99c408b69

      SHA1

      0dee80d93c8370085b48f6861adf10743a1c3712

      SHA256

      ec84432215024e84391d253664c145c5bbd009d683678bc5fd7f7be170f917f9

      SHA512

      019952dfba185d950887d9e75fd379f3ec3778782a892c6c771460d299bfabb7c76c9b3f295e89f23816a6d8a43ee7fb14ed541897185f906fca0f5d3111cb43

    • /data/user/0/com.example.zcjhly1/files/libmobisecy1.zip.x86.flock

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.example.zcjhly1/files/libmobisecz1.so

      Filesize

      139KB

      MD5

      f3bf5f4dde2d7439396715c51e631462

      SHA1

      48d3c5ebbee9de3010731403245dcb77bb9086c4

      SHA256

      61fc67e95e427823d3841cb8357b86d61f97a7025accde73a6c707d82c63adb3

      SHA512

      499d9b5840d4141c15b019ca3aa1608b7f2fa2858ef2e34242b663cf1a26a9699c3041d6b306ec6e3c1cc0916ec53a9408f6258e2c3343e0a79f15c792961116

    • /data/user/0/com.example.zcjhly1/files/oat/x86/libmobisecy1.odex

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • /data/user/0/com.example.zcjhly1/files/oat/x86/libmobisecy1.vdex

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e