c6c781767025d3ea7b014765ad64fe1b0df0b68cd7d658f4eda5b12b1acfcb4d

Analysis

max time kernel
3356371s
max time network
148s
platform
android_x86
resource
android-x86-arm-20220621-en
submitted
04-07-2022 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

appp.apk
Size

11.8MB
MD5

daf7b2b74314b84f346e03d651d8db82
SHA1

9b613ef5633ab448740f653a7514b1178ebd3baf
SHA256

c6c781767025d3ea7b014765ad64fe1b0df0b68cd7d658f4eda5b12b1acfcb4d
SHA512

65f63d71d1bb7c42b089b9d36732c53c16e43509cb8cf0a9cb34a0b38e98e2c379b2511f4d13d41f3940518737586a2aa5e5fec2e0f5bb4611c9a1a7038d8bd0

Score

8^/10

Malware Config

Signatures

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.com.sdadsaa

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.com.sdadsaa

Acquires the wake lock. 1 IoCs

Processes:

com.com.sdadsaa

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.com.sdadsaa

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.com.sdadsaa

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.com.sdadsaa/app_securecache/unrar.jar --output-vdex-fd=72 --oat-fd=73 --oat-location=/data/user/0/com.com.sdadsaa/app_securecache/oat/x86/unrar.odex --compiler-filter=quicken --class-loader-context=&com.com.sdadsaa

ioc	pid	process
/data/user/0/com.com.sdadsaa/app_securecache/unrar.jar	4937	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.com.sdadsaa/app_securecache/unrar.jar --output-vdex-fd=72 --oat-fd=73 --oat-location=/data/user/0/com.com.sdadsaa/app_securecache/oat/x86/unrar.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.com.sdadsaa/app_securecache/unrar.jar	4810	com.com.sdadsaa

Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.com.sdadsaa

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.com.sdadsaa

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.com.sdadsaa

com.com.sdadsaa
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
PID:4810

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.com.sdadsaa/app_securecache/unrar.jar --output-vdex-fd=72 --oat-fd=73 --oat-location=/data/user/0/com.com.sdadsaa/app_securecache/oat/x86/unrar.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4937

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.com.sdadsaa/app_securecache/oat/unrar.jar.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.com.sdadsaa/app_securecache/oat/x86/unrar.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.com.sdadsaa/app_securecache/oat/x86/unrar.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.com.sdadsaa/app_securecache/unrar.jar
Filesize
113KB

MD5
81726a7d05edcb5289f205e3baedc663

SHA1
57ecc7e08bb16aab1f3e7afa1c4cf1de8a9639cc

SHA256
8bf5f8774f590ede2152b000aa6b830856c83da5870fc7284eb702d388df114e

SHA512
b9df9e3b7fa9e2ad0ae2c844a7914aef8f49c06cfea94680e635521b0e769b0f75c9c30a07a282fad18225e2d0e81230f94537c5e807044dacc0ed0617257ad9

Download Submit
/data/user/0/com.com.sdadsaa/app_securecache/unrar.jar
Filesize
527KB

MD5
000e46135b79a1cc808e00b3d2097519

SHA1
437be3b44e35eb08d81d82a375b12a4c689ad11c

SHA256
d08cca27a75a6ac3b86057c925bd97c224f1b1ea496c954f31a5bd8965a6cc34

SHA512
ec951bea1c0f62acfdd484211d513eaa8c5f221051ef226e5500e4b74c1d19789c9177a1ca891563f9ebd797fab9981e2949e854a8cd7ecbb662a6ffc5b0ba8c

Download Submit
/data/user/0/com.com.sdadsaa/app_securecache/unrar.jar
Filesize
527KB

MD5
fe24e947ca9791d788ef462868aecbd3

SHA1
46a682637382d09a7e2d71f93c466eed14f0f9b2

SHA256
b11e0b6f5b20aeb60db12053ef249a4aa1894b82227b62316020da4dc7a8ea56

SHA512
65ffe4b08c66bf9f5d5a0a8931ed9e99ef2f4189af2632c4f6363eb0e9b9ed275674002f288c992f8566b66c313a690a906be0ee6aaee5744a40a057837ad8c6

Download Submit
/data/user/0/com.com.sdadsaa/app_securecache/unrar.jar.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.com.sdadsaa/app_securecache/unrar_enc.zip
Filesize
98KB

MD5
ae453d5baf28a9db2633dd7a404dfd45

SHA1
f0c879d39431477b68de685c1d5b153d5e0440b1

SHA256
b00851d5556e92848143307b278237a3bc75e33e0371711e10f448f700ececdf

SHA512
33ea7eded01f243fd3f165b19ff466dcd919d7a53e344bbaad71c7727e354b83b6504aae8ce23fd0ed4a299d48be2d6e6827c298be58511cb48098ffab535098

Download Submit
/data/user/0/com.com.sdadsaa/cache/1
Filesize
98KB

MD5
ae453d5baf28a9db2633dd7a404dfd45

SHA1
f0c879d39431477b68de685c1d5b153d5e0440b1

SHA256
b00851d5556e92848143307b278237a3bc75e33e0371711e10f448f700ececdf

SHA512
33ea7eded01f243fd3f165b19ff466dcd919d7a53e344bbaad71c7727e354b83b6504aae8ce23fd0ed4a299d48be2d6e6827c298be58511cb48098ffab535098

Download Submit
/data/user/0/com.com.sdadsaa/cache/2
Filesize
271B

MD5
789e265ee35f47dbd261d252121c7c25

SHA1
f84f5f7d7c65775be0bdb7e82382097ae46814b2

SHA256
bc00f32d4b1ab9e13999738e5e8bb54d671c78e2f4c11bbb168923469e1daff5

SHA512
3d8904dd9293b1b41972452a9ad9b15b8ef2e4f0640f9a28bc62195fcdf6922ed57c4c7a7d14342b98e85572a30861f208741ddd0c0f1f17ea90c3ab09fad532

Download Submit
/data/user/0/com.com.sdadsaa/cache/~test.test
Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/user/0/com.com.sdadsaa/files/dbkeys.db
Filesize
8KB

MD5
9a7f3389cf225c38519f34b1e4fff4e8

SHA1
f011af30d5cf5a4cd15b0d82b0c00ff1a4c5952f

SHA256
bf1be95566105ea42392d0c06a2bd06e6ca724e9c8a5f5cd818813b178821378

SHA512
451936320e988c03a84aa6cbb0d2dc6c738eedc135114690e980908a39a0f86867799881bd09faf8843c5b34d57d7a356992d476ac6858083fe5c74600fdefa8

Download Submit
/data/user/0/com.com.sdadsaa/files/dbkeys.db-journal
Filesize
4KB

MD5
eff575e110f45f3a1e14232a2beed6aa

SHA1
7bde7ae8b3c4938d17b3f9f023db7c4e36d13a26

SHA256
ba1491e1a3176b16095261c9649f5acb0d329a1818b1d8c3c0ee45923f1f5a86

SHA512
c13e64f1e6b93f4d93c16d72757bf33e7061855a49432f8505174106b8d2bc04496152820ff5165859b7a87e053d286016e532a5042e1221536339fa69f7ac31

Download Submit
/data/user/0/com.com.sdadsaa/files/gvcrfRK.zip
Filesize
98KB

MD5
ae453d5baf28a9db2633dd7a404dfd45

SHA1
f0c879d39431477b68de685c1d5b153d5e0440b1

SHA256
b00851d5556e92848143307b278237a3bc75e33e0371711e10f448f700ececdf

SHA512
33ea7eded01f243fd3f165b19ff466dcd919d7a53e344bbaad71c7727e354b83b6504aae8ce23fd0ed4a299d48be2d6e6827c298be58511cb48098ffab535098

Download Submit
/data/user/0/com.com.sdadsaa/files/localdb.db
Filesize
12KB

MD5
e7179ba1abb576a1eb3486db34de4037

SHA1
4dc87664c9be3d7a94d4886b7f56f4a8d7b983dd

SHA256
409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f

SHA512
50ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a

Download Submit
/data/user/0/com.com.sdadsaa/files/localdb.db-journal
Filesize
4KB

MD5
11d6293be6ddbc573fb1695880829db4

SHA1
8ae24c127a2c0c3877e5cb3c713ccff136f51068

SHA256
3697644698a36f2a19bf1b84ed46a255028805a3736f2667ec856fcce329bbac

SHA512
c62e5cebed9c62ceb7aba3df5bd2f73ef0d378e492f70132e98deb40a842261023d879d67c8f168db0f63e3539de5df9c07d945db21743b2f3fda8e2d77586ad

Download Submit
/data/user/0/com.com.sdadsaa/files/localdb.db-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.com.sdadsaa/files/localdb.db-wal
Filesize
4KB

MD5
37c7ae0c69bd26247be8632e78416f82

SHA1
3aeb99897bdf9bf63568050f4b79af0b8373c831

SHA256
217b82ee4dc288ed3988d481aa366fe9b85823dd290b5e5b5b65223c255c62ce

SHA512
6486393a0562d71aa97bc4c19a5fe836aec3f2141ae90aecd04d87255c1de610118db1d2cb150f2ff2f3a619bf879d91651475e20e4659d059981b6655be34a9

Download Submit
/data/user/0/com.com.sdadsaa/files/messdb.db
Filesize
8KB

MD5
57a39108426ea4fb8e5bc74accc22a88

SHA1
73f83c87418acba44a084cb7055fc5c34f6cf25e

SHA256
9d36142e37864417222d54360d821b9a75f31ad31d1f9a45c947edb63ec6b2d2

SHA512
f122d601019b7ee6077574897b51d60cf8223780db64e0649a772183c8025ac413d3ce0683c8bf05373e293cb67ebb62d9dfea15d5d16c495bc0628279709b8a

Download Submit