7b0740a5fbe1837fadfd2859e06867139d99d0e75f684d781ccc8f371cbb9e41

Analysis

max time kernel
1451396s
max time network
157s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
19-09-2022 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1662038102388.apk
Size

2.4MB
MD5

bf5737d2cc1628fc189f4f6b4087b93a
SHA1

1a6fb8041ceea7f67677bd319135152fdc358eac
SHA256

7b0740a5fbe1837fadfd2859e06867139d99d0e75f684d781ccc8f371cbb9e41
SHA512

a8754011b0b43a6fa87a68453f5c0c9844066c2e6d3035bf3624499a826244173334199c324d4321b68553ff8b097a901c9a9bf866c59c9c61c0fbf327e1b3b8
SSDEEP

49152:ttCOVCKFDuMBHhvzYj0vSiZkceJCg5n3zf/zGdb/yS4OHL:zCOVCKFDuWB4msJJtxzzwcu

Score

8^/10

Malware Config

Signatures

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.sabadel.codigo.app

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sabadel.codigo.app
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sabadel.codigo.app

Acquires the wake lock. 1 IoCs

Processes:

com.sabadel.codigo.app

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.sabadel.codigo.app

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.sabadel.codigo.app

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sabadel.codigo.app/app_securecache/unrar.jar --output-vdex-fd=74 --oat-fd=75 --oat-location=/data/user/0/com.sabadel.codigo.app/app_securecache/oat/x86/unrar.odex --compiler-filter=quicken --class-loader-context=&com.sabadel.codigo.app

ioc	pid	process
/data/user/0/com.sabadel.codigo.app/app_securecache/unrar.jar	4189	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sabadel.codigo.app/app_securecache/unrar.jar --output-vdex-fd=74 --oat-fd=75 --oat-location=/data/user/0/com.sabadel.codigo.app/app_securecache/oat/x86/unrar.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.sabadel.codigo.app/app_securecache/unrar.jar	4112	com.sabadel.codigo.app

Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.sabadel.codigo.app

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.sabadel.codigo.app

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.sabadel.codigo.app

com.sabadel.codigo.app
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
PID:4112

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sabadel.codigo.app/app_securecache/unrar.jar --output-vdex-fd=74 --oat-fd=75 --oat-location=/data/user/0/com.sabadel.codigo.app/app_securecache/oat/x86/unrar.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4189

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.sabadel.codigo.app/app_securecache/oat/unrar.jar.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.sabadel.codigo.app/app_securecache/oat/x86/unrar.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.sabadel.codigo.app/app_securecache/oat/x86/unrar.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.sabadel.codigo.app/app_securecache/unrar.jar
Filesize
113KB

MD5
8031ce709efa1bcc362d2df92c174973

SHA1
f6574d9cb83bc981fa452c2a5248bd94c56d864a

SHA256
6ae59043e3da1afc899c6548a4a301c7bc8ae91695723dc0d9efc223caadc1c2

SHA512
aae67a60fb702ab336b589c5a4fcb87ed4eed6a40e9bd606e71a1975dba1a9a6ea2047ac17d9a1db2de9be0288413f884288f7e1077f0ec6098f1b7c426f328d

Download Submit
/data/user/0/com.sabadel.codigo.app/app_securecache/unrar.jar
Filesize
527KB

MD5
dcdde49cfca8c5ca3d8896409f737d29

SHA1
31d9f6842c2295cc863f66d8251b0fd1cca715f3

SHA256
7ae5e407548ef13895444c603f51b8301d289e7573c7864b7d1fc7b9597d52c4

SHA512
79891c6c9763243846b178e51253b9b696dad5a4d8ef2480b4c0b665e6071f559ab40fd6f28539b12a3dae5ac6a2120f1ecf43673c2bc67858453406b76e129b

Download Submit
/data/user/0/com.sabadel.codigo.app/app_securecache/unrar.jar
Filesize
527KB

MD5
ab67d89f3ec1498417391c49d2bec9bf

SHA1
0d0861de6a1d7a3273f9f6455d2b9c10f2108534

SHA256
1bf58235c5ee396d67adc2e6c57ff63e63266173bc59136383147fc80d59596a

SHA512
34be3008548631b3d9d597e5c0d6022ad2c6c428dd87028de6e3c7a1d2a6c3918d1aee81cc4c6b19358a1ef80f9313e5532d257ca2e9b034a3294233f5547130

Download Submit
/data/user/0/com.sabadel.codigo.app/app_securecache/unrar.jar.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.sabadel.codigo.app/app_securecache/unrar_enc.zip
Filesize
98KB

MD5
3f11cd6842256acb42da1702bfb10285

SHA1
ea1a4d5d22bc74e48644279a07961f32b2239770

SHA256
8a92f128d98521521496005b2aa5a8bb2f70c114c70fc81584fd86bf47002951

SHA512
cf19767cbbb9bf16858256b157a91ad33a53937238515ae6fcd7105d7c5e262d66d5cd189215b357bb74cd52fb53ba4bfa33581d2a1fe04b30250c28bb8e9fdd

Download Submit
/data/user/0/com.sabadel.codigo.app/cache/1
Filesize
98KB

MD5
3f11cd6842256acb42da1702bfb10285

SHA1
ea1a4d5d22bc74e48644279a07961f32b2239770

SHA256
8a92f128d98521521496005b2aa5a8bb2f70c114c70fc81584fd86bf47002951

SHA512
cf19767cbbb9bf16858256b157a91ad33a53937238515ae6fcd7105d7c5e262d66d5cd189215b357bb74cd52fb53ba4bfa33581d2a1fe04b30250c28bb8e9fdd

Download Submit
/data/user/0/com.sabadel.codigo.app/cache/2
Filesize
300B

MD5
5208be508abc2efbbd090e0a79f9fd6e

SHA1
ab7942db55fa3335420d3eb62a25a5c40ea08f29

SHA256
5ffbd51a35e86f01403a5fc6793b683830c2ada3490567e2555d6d06a5aa9bc7

SHA512
d413d79c807d063e788d8fcdb0b8f39783e1b8499bc08163c83398891d08f5abebd7f48803e29f5a5f7baafd564235160f5722471d8f2317ace6b689a5fbd366

Download Submit
/data/user/0/com.sabadel.codigo.app/cache/~test.test
Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/user/0/com.sabadel.codigo.app/files/dbkeys.db
Filesize
8KB

MD5
9a7f3389cf225c38519f34b1e4fff4e8

SHA1
f011af30d5cf5a4cd15b0d82b0c00ff1a4c5952f

SHA256
bf1be95566105ea42392d0c06a2bd06e6ca724e9c8a5f5cd818813b178821378

SHA512
451936320e988c03a84aa6cbb0d2dc6c738eedc135114690e980908a39a0f86867799881bd09faf8843c5b34d57d7a356992d476ac6858083fe5c74600fdefa8

Download Submit
/data/user/0/com.sabadel.codigo.app/files/dbkeys.db-journal
Filesize
4KB

MD5
b83287420b2fe0de98f2fc78c8a005ca

SHA1
0bf630d2e9575b067760f9d2b66c71ba564bd8ff

SHA256
7b24efe6a5deb749df98ff0399d4be18af45aee8f83875acb098e1ed179d9882

SHA512
b347175e2733c3994e586a9c392630632ff1f673c96ce4aab30d0d0ac2b6834e06aabe8eb410ee8f903f7281fcf528000d8980c682f1b29e6896f743e93a7c6c

Download Submit
/data/user/0/com.sabadel.codigo.app/files/gvcrfRK.zip
Filesize
98KB

MD5
3f11cd6842256acb42da1702bfb10285

SHA1
ea1a4d5d22bc74e48644279a07961f32b2239770

SHA256
8a92f128d98521521496005b2aa5a8bb2f70c114c70fc81584fd86bf47002951

SHA512
cf19767cbbb9bf16858256b157a91ad33a53937238515ae6fcd7105d7c5e262d66d5cd189215b357bb74cd52fb53ba4bfa33581d2a1fe04b30250c28bb8e9fdd

Download Submit
/data/user/0/com.sabadel.codigo.app/files/localdb.db
Filesize
12KB

MD5
e7179ba1abb576a1eb3486db34de4037

SHA1
4dc87664c9be3d7a94d4886b7f56f4a8d7b983dd

SHA256
409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f

SHA512
50ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a

Download Submit
/data/user/0/com.sabadel.codigo.app/files/localdb.db-journal
Filesize
4KB

MD5
5173bdbaa3bdcfbb15e7f516f881ce2d

SHA1
ece2c8ec863889251634ab22cff1e662324944af

SHA256
18d93a755741510f42d6d240403947f6f5ba4f6019375699a7c872c083706dac

SHA512
388d8706ec4382e216f2f19424acb194d17b850c9a96c3d25b1fe17e542070251f2018ca50be22f677f2031d4db4d0e3495d9a285d66f50ee80d35aef15044bb

Download Submit
/data/user/0/com.sabadel.codigo.app/files/localdb.db-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.sabadel.codigo.app/files/localdb.db-wal
Filesize
4KB

MD5
a937d555f780ea51a4d6741b8aefa173

SHA1
aa16610ce53c26fdc54b1c96484660aef346f4bd

SHA256
2c6719736e48bc7a0dfc8080bb986fa816eb82fb6ccd9dac7c7ac16489fc4225

SHA512
3adb929fe5d51bceb5bc190a3511f8476ee7b3481157f09454fecf54c8c49ef7c7827849061f4022e87d8788dc26ca4e158e409ee944161ce91a60e73e34400f

Download Submit
/data/user/0/com.sabadel.codigo.app/files/messdb.db
Filesize
8KB

MD5
57a39108426ea4fb8e5bc74accc22a88

SHA1
73f83c87418acba44a084cb7055fc5c34f6cf25e

SHA256
9d36142e37864417222d54360d821b9a75f31ad31d1f9a45c947edb63ec6b2d2

SHA512
f122d601019b7ee6077574897b51d60cf8223780db64e0649a772183c8025ac413d3ce0683c8bf05373e293cb67ebb62d9dfea15d5d16c495bc0628279709b8a

Download Submit