Analysis

  • max time kernel
    3580818s
  • max time network
    158s
  • platform
    android_x86
  • resource
    android-x86-arm-20220621-en
  • submitted
    06-07-2022 21:30

General

  • Target

    sample2.apk

  • Size

    4.6MB

  • MD5

    f418c75d5a0eb0186f5111770180e6dd

  • SHA1

    f098f8a8f7a195e2c16dc2127e74237a65dbf024

  • SHA256

    bfa9a861d953247eea496f4a587f59e9ee847e47a68c67a4946a927c37b042c4

  • SHA512

    eb78728d813583a0b74e3ba1226dea8935cd4659f8a88e273f4dd16466a7449f1b2d9eed58faa90496745eb57644e699d8c332bfb4a632530ea40f9490007fd1

Score
8/10

Malware Config

Signatures

  • Makes use of the framework's Accessibility service. 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Removes a system notification. 1 IoCs

Processes

  • com.vvozewzes.zbggimdsu
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    PID:4600
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/base.apk.w88gItg1.pUU --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/oat/x86/base.apk.w88gItg1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.vvozewzes.zbggimdsu/app_webview/Cookies
    Filesize

    64KB

    MD5

    cb7543c4df600f2af58097cce0e334ba

    SHA1

    83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

    SHA256

    64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

    SHA512

    ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

  • /data/user/0/com.vvozewzes.zbggimdsu/app_webview/Cookies-journal
    Filesize

    1KB

    MD5

    6edbccd92604f215c5d83b67e63dbd97

    SHA1

    3f79505aba3973a7457e25bbd29279c287655ea9

    SHA256

    47de360ff0aa2dbc841ae0dcd2575ea8e5ad7b1833b6028d7a463858b7786e67

    SHA512

    a9446f4a07cb43aadaefcf4537e077e42a5db9f8e22b50717ea0508578d679f6f86c762c0db7830be19034684385393ed75f28c71221e23552cf3533462fb408

  • /data/user/0/com.vvozewzes.zbggimdsu/app_webview/GPUCache/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

  • /data/user/0/com.vvozewzes.zbggimdsu/app_webview/GPUCache/index-dir/temp-index
    Filesize

    48B

    MD5

    ac0ce8374d219b6a87c1e427d0d8e70b

    SHA1

    4273f3e5040833dc6ef7b445e837a1e7166e5593

    SHA256

    6502cd330c282d306086c9db9ba67bdf228061d399eb9917bde39efa3e3b5fbc

    SHA512

    820978c4153559d26064540b1af9aba6629620a028a02e91cab91790d2303e61cc00454d0b72d3150ea1eee670e6d772f76aac26d5946e0422a39ec03842d497

  • /data/user/0/com.vvozewzes.zbggimdsu/app_webview/Web Data
    Filesize

    104KB

    MD5

    dc79f9ce5f3ab5270b33e61119dfc959

    SHA1

    1844bf222a5144b513dcf2fb50a18c011701c647

    SHA256

    47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

    SHA512

    18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

  • /data/user/0/com.vvozewzes.zbggimdsu/app_webview/Web Data-journal
    Filesize

    1KB

    MD5

    29a8fbebf4b3a769d7a132c7eca7f4c4

    SHA1

    edf0366707bd8bc41f7ecb43e7beea50b8481f0e

    SHA256

    0df44454bee4a39301b45dd37beaa91f91e12a463578e2aba3ce1d06abd87206

    SHA512

    903a1b3135310b68ea87e228efbbb73d45dbf30a99d3afccceb714aa767366065e4b8c824f3c78d33118a386bee76b02c093c45f2ef86c4be31f8ebb4ac43abf

  • /data/user/0/com.vvozewzes.zbggimdsu/app_webview/metrics_guid
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.vvozewzes.zbggimdsu/app_webview/metrics_guid
    Filesize

    36B

    MD5

    68fd0a6101d41b4d9a804dcedaa9dc86

    SHA1

    3a878a40d56f50a837155ec9485534102e859bf8

    SHA256

    8487b1691d11034d1e55685a7ebde09e57d791cb6a372347d01ac691915c09af

    SHA512

    ba3e8d3bca4cdeac713307c70bb28677889f562a61aee128f5d56cf3c15ca1219024b66f9368057b5870b94752ebda6f7e16d84c325f9b60f8be5410ffc676e3

  • /data/user/0/com.vvozewzes.zbggimdsu/app_webview/variations_seed_new
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.vvozewzes.zbggimdsu/app_webview/variations_stamp
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.vvozewzes.zbggimdsu/app_webview/webview_data.lock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/01131ca22f15e68b_0
    Filesize

    849B

    MD5

    ee8db95c30f0fb1f94ef72cb324ab8d9

    SHA1

    d09a8094c6aafc3284e09a49a7eff0e8e8237830

    SHA256

    31115a39d37fe015c4e9bba67d382cf624d59938f4d3b0b3dfa2b5ef5d737c91

    SHA512

    c737b2f0cb3908a6f653ab770f3a4edd024a250b0b21cea6198d45b4d2683057a1c78ec728860b294701ac7e6343509316678ad6985295d462309ee9d8f2af00

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/01131ca22f15e68b_0
    Filesize

    849B

    MD5

    09f3d29af63d2d8dfb15cce861017306

    SHA1

    5299ddc395a3897d7e1ee67aa61135e00572825c

    SHA256

    3de7c0a5588b143b86635015deaaead2b3e587e54a9805f188d0f84513ee661b

    SHA512

    d34cdcec39bc73e20123115cdc9d1679c638d3abfdbf37b41a273730741d2b07881f03e0d72a4093d0c71a42d920e4c2992f7dcb8e04a847566670ff189be174

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/01131ca22f15e68b_0
    Filesize

    849B

    MD5

    56f10cfe60f50d8711ce8f3ce7b9fb02

    SHA1

    cc127297b41df8086ef0934d2bf3b2efceb3b3b8

    SHA256

    e89c3b55054d71c13a4133bbf32993c717ebd4807104bbd1cf8507280b0793d0

    SHA512

    67b8f150577482891a8243e174dda77415e9c9f5bd336780efd2506431648bb942a4f9a5423ce254e6d01b14826e8b426ac232589655899894035c121cd131f3

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/01131ca22f15e68b_0
    Filesize

    849B

    MD5

    9f295854c905a2c984dfd09cb45bdb87

    SHA1

    82d5c22d21c6131479571668f018fa4b3a136cbb

    SHA256

    5e9ce0a0605cf19a27e7b67a71bd9c38e8213af67efcfab703e049e8de5fd993

    SHA512

    5fe696f2ebe93472926c19e2f5352f921de9f4016685afb20c5c91e61ce0acd2bd2931747de06e59ef6876cb3852205c8b916908f3059ddf68d81bb879eab5d0

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/36c22c74b8095932_0
    Filesize

    876B

    MD5

    949bcb7b670862554aa800aa11819fdf

    SHA1

    f22a448934ba251b138a1e6aede2856add83c6f8

    SHA256

    f47106342403f0532deff0b00a89361a78c011a85d5d1e42d5fac330af12d27f

    SHA512

    b4643c6da8b64029115ed0f9b172c7c1b508e2190821365ffa675650daf0147d1676965ee33a43cb965191a40d3334c0fa8b1f1a9acc9a42bd53d78959013c97

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/768fc824bebdbcd9_0
    Filesize

    880B

    MD5

    40d84180a4fd9600b774ab577299119c

    SHA1

    4eba5358264a95c732852922790d014b9c8f1586

    SHA256

    e379f27ded9128ddc6b98fcca42f748033491f5fb877a2677a8ba8e64aaa6749

    SHA512

    ca9db9d096cc7e577e1c4eb54e2d8e3a66daf18f7bdc59959fa5e70687e35e46c797023f479fbf209e65af8221a029fa1454d119062ff9b3d2cd4fc332259a32

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/b816e1f40cb2f6c1_0
    Filesize

    875B

    MD5

    9b0caf2caa32288460127e830e1e9111

    SHA1

    b41a7305cd252bd9972c33a708b6fd3bce9f1063

    SHA256

    b936a1e319bef9dbce3f1270035f40685bcca12b6c6bca499eb428a0481bab8b

    SHA512

    9b31cb93aef3334eb08c7aa05be999f5e069aa10f766beef6e1ebb1b5f2ef20f8b11dab649919f83f2c03eb1b2a8dae30e7a14dbf8ac0fc27b109f357498bbe9

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/b816e1f40cb2f6c1_0
    Filesize

    875B

    MD5

    c55855d8cc0c1a91818d7fde16196625

    SHA1

    2a27983dae1b9fde66632286d15dbc3e9ac22ba8

    SHA256

    d59566c074ba6aec3abcbfb4ed63987d99a24efd16cf075d578f456aef47c986

    SHA512

    f64132aae4ae164a035a468ca107e4dd4dfaa89a20ebfacaa387672e59af3df4b7b7c5a2a0f2baf7eae29481a62044f5d6b9aa540e94ed8f88f61396e4ca4c9b

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/index-dir/temp-index
    Filesize

    48B

    MD5

    b40e1d1db082ee61bb72df2c55543e77

    SHA1

    cf6ec380cf6a4daeab0c8ca10e4a593197bab18d

    SHA256

    8c773f7eea8e46d66912ceaa6cb168ed8f01c63f065b4ba9ec56ebbed6a858b4

    SHA512

    8055f7754d2bc788d57fa65a10147119b2d409d85996d55245f94c8f63bb9ac14cf8d8e28750d494381a76f44633d3db54471142a3d34ca9f8faaaaf278d394e

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/index-dir/temp-index
    Filesize

    144B

    MD5

    6fe982917aee4a0e4ffc98f03ccfaafa

    SHA1

    f2b5d319daaaf8b0084a903d29285f6507a16d8e

    SHA256

    9cd25de302e5a4667a56595fe3be8bcde6a18847377af6fea084a5f29e908071

    SHA512

    98a50e3bddcce79692d769be7f9e23e7a62783871655c391062067491dce112f554e08a2b69c6556da0928edef4e177620d4f0e83160ea3342d70fd343301fde

  • /data/user/0/com.vvozewzes.zbggimdsu/cache/org.chromium.android_webview/index-dir/temp-index
    Filesize

    144B

    MD5

    dfb2d210bc1ca21aee924dc80078ff88

    SHA1

    7db03d4de5360394a324a7e5b68fe85cfee73517

    SHA256

    5af9796dce33dee635468863c1f18cd1ebbfa685bcfbbb1ba605414f5ba71bbe

    SHA512

    42a381a1367d2f6e05f79883bb1dda82a73095b9884f2005559f2be6e22c01dd567eabe6014e24c11feba558a2b94a8e0e34c81b033749217a36740c9dcb7ef2

  • /data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/base.apk.w88gItg1.pUU
    Filesize

    1.6MB

    MD5

    66ead0ba8ba7c2bf62bf986952693ccf

    SHA1

    6c2b4441b156184b3ddfdb198533366adf839d03

    SHA256

    f0fdc7446601a01cd48fb323d3c6c23c51c1c862bf29a96dfccce9f894636f0c

    SHA512

    f54cae87006cd9dcf4f69f9ff6efcbfe774f0b759e518488297a6e00c2821c0da46646852d18ce4f009ee3cdd7352133e367a08c0cf9508937938ccea9f5e97c

  • /data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/base.apk.w88gItg1.pUU
    Filesize

    1.6MB

    MD5

    4b3be813c34424efcad30d504494195d

    SHA1

    abeedbd2027a0665d6bd4aa5183c1e6b1cc8eea0

    SHA256

    775f33a8982d6cd926c7caa95c7d11f497e9e7c3b389914f7812a1c2ded58938

    SHA512

    33f42ab3e8286682117a75216bfa34b22371805a8a902caaaf77d73fc3e89347f0a382e3de3c73803978f8ea5830f92b219c95cc553485a3e636c2be8520f2c1

  • /data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/base.apk.w88gItg1.pUU.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/gghydtf8.yotI
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/oat/x86/base.apk.w88gItg1.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/oat/x86/base.apk.w88gItg1.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/tmp-base.apk.w88gItg8881036462307921380.pUU
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.vvozewzes.zbggimdsu/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    21223e9184445fe043476484cd8cb1f9

    SHA1

    2b4813f849121d60ba35eb0889080668bb62c778

    SHA256

    bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

    SHA512

    be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

  • /data/user/0/com.vvozewzes.zbggimdsu/shared_prefs/com.android.launcher3.prefs.xml
    Filesize

    128B

    MD5

    20837fd8daf2a2de8d6c4ccd8e90653a

    SHA1

    7ac08617bd4585151c239325aea243d9eca586f7

    SHA256

    e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

    SHA512

    a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

  • /data/user/0/com.vvozewzes.zbggimdsu/shared_prefs/multidex.version.xml
    Filesize

    305B

    MD5

    54c4cefd4c083bac0816a9f47ff6bd0d

    SHA1

    9d697443ed7b7ba5a02dc307f8ca32a0eddd57a9

    SHA256

    e81e431ca728956f51a8d58738b7d2f773d9094715b386698760b61390d0b806

    SHA512

    214b8ba3a5439e224869e75d7ea047070a301c04065baf1c08f5841e78e8d50a107300de4babb929a4ab54056aa6d2a7ae31cc3ebcacdd858378163d946b9557