Analysis

  • max time kernel
    1451396s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    19-09-2022 16:04

General

  • Target

    1662038102388.apk

  • Size

    2.4MB

  • MD5

    bf5737d2cc1628fc189f4f6b4087b93a

  • SHA1

    1a6fb8041ceea7f67677bd319135152fdc358eac

  • SHA256

    7b0740a5fbe1837fadfd2859e06867139d99d0e75f684d781ccc8f371cbb9e41

  • SHA512

    a8754011b0b43a6fa87a68453f5c0c9844066c2e6d3035bf3624499a826244173334199c324d4321b68553ff8b097a901c9a9bf866c59c9c61c0fbf327e1b3b8

  • SSDEEP

    49152:ttCOVCKFDuMBHhvzYj0vSiZkceJCg5n3zf/zGdb/yS4OHL:zCOVCKFDuWB4msJJtxzzwcu

Score
8/10

Malware Config

Signatures

  • Makes use of the framework's Accessibility service. 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs

Processes

  • com.sabadel.codigo.app
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    PID:4515

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.sabadel.codigo.app/app_securecache/oat/unrar.jar.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.sabadel.codigo.app/app_securecache/unrar.jar
    Filesize

    113KB

    MD5

    8031ce709efa1bcc362d2df92c174973

    SHA1

    f6574d9cb83bc981fa452c2a5248bd94c56d864a

    SHA256

    6ae59043e3da1afc899c6548a4a301c7bc8ae91695723dc0d9efc223caadc1c2

    SHA512

    aae67a60fb702ab336b589c5a4fcb87ed4eed6a40e9bd606e71a1975dba1a9a6ea2047ac17d9a1db2de9be0288413f884288f7e1077f0ec6098f1b7c426f328d

  • /data/user/0/com.sabadel.codigo.app/app_securecache/unrar.jar
    Filesize

    527KB

    MD5

    ab67d89f3ec1498417391c49d2bec9bf

    SHA1

    0d0861de6a1d7a3273f9f6455d2b9c10f2108534

    SHA256

    1bf58235c5ee396d67adc2e6c57ff63e63266173bc59136383147fc80d59596a

    SHA512

    34be3008548631b3d9d597e5c0d6022ad2c6c428dd87028de6e3c7a1d2a6c3918d1aee81cc4c6b19358a1ef80f9313e5532d257ca2e9b034a3294233f5547130

  • /data/user/0/com.sabadel.codigo.app/app_securecache/unrar_enc.zip
    Filesize

    98KB

    MD5

    3f11cd6842256acb42da1702bfb10285

    SHA1

    ea1a4d5d22bc74e48644279a07961f32b2239770

    SHA256

    8a92f128d98521521496005b2aa5a8bb2f70c114c70fc81584fd86bf47002951

    SHA512

    cf19767cbbb9bf16858256b157a91ad33a53937238515ae6fcd7105d7c5e262d66d5cd189215b357bb74cd52fb53ba4bfa33581d2a1fe04b30250c28bb8e9fdd

  • /data/user/0/com.sabadel.codigo.app/cache/1
    Filesize

    98KB

    MD5

    3f11cd6842256acb42da1702bfb10285

    SHA1

    ea1a4d5d22bc74e48644279a07961f32b2239770

    SHA256

    8a92f128d98521521496005b2aa5a8bb2f70c114c70fc81584fd86bf47002951

    SHA512

    cf19767cbbb9bf16858256b157a91ad33a53937238515ae6fcd7105d7c5e262d66d5cd189215b357bb74cd52fb53ba4bfa33581d2a1fe04b30250c28bb8e9fdd

  • /data/user/0/com.sabadel.codigo.app/cache/2
    Filesize

    302B

    MD5

    9a1ec1864e00afde358007ce4b535564

    SHA1

    d298336c70a2da9d215e241dcced66a333c3f83c

    SHA256

    e33fdb3e414bf9a12fc4f41ea88f5d4c2197409186546243c9d267656f7f538f

    SHA512

    d4c2e1e90ec8c00924584b0d2b8fd5f6d7d0df6f2b6c71cf627ac0977648696fb0aa25093b20fe6d6809fc94fa00ca75fdffb84f7aaf06a6c6c76d11998caf5c

  • /data/user/0/com.sabadel.codigo.app/cache/~test.test
    Filesize

    4B

    MD5

    098f6bcd4621d373cade4e832627b4f6

    SHA1

    a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

    SHA256

    9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

    SHA512

    ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

  • /data/user/0/com.sabadel.codigo.app/files/dbkeys.db
    Filesize

    8KB

    MD5

    9a7f3389cf225c38519f34b1e4fff4e8

    SHA1

    f011af30d5cf5a4cd15b0d82b0c00ff1a4c5952f

    SHA256

    bf1be95566105ea42392d0c06a2bd06e6ca724e9c8a5f5cd818813b178821378

    SHA512

    451936320e988c03a84aa6cbb0d2dc6c738eedc135114690e980908a39a0f86867799881bd09faf8843c5b34d57d7a356992d476ac6858083fe5c74600fdefa8

  • /data/user/0/com.sabadel.codigo.app/files/gvcrfRK.zip
    Filesize

    98KB

    MD5

    3f11cd6842256acb42da1702bfb10285

    SHA1

    ea1a4d5d22bc74e48644279a07961f32b2239770

    SHA256

    8a92f128d98521521496005b2aa5a8bb2f70c114c70fc81584fd86bf47002951

    SHA512

    cf19767cbbb9bf16858256b157a91ad33a53937238515ae6fcd7105d7c5e262d66d5cd189215b357bb74cd52fb53ba4bfa33581d2a1fe04b30250c28bb8e9fdd

  • /data/user/0/com.sabadel.codigo.app/files/localdb.db
    Filesize

    12KB

    MD5

    e7179ba1abb576a1eb3486db34de4037

    SHA1

    4dc87664c9be3d7a94d4886b7f56f4a8d7b983dd

    SHA256

    409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f

    SHA512

    50ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a

  • /data/user/0/com.sabadel.codigo.app/files/localdb.db-journal
    Filesize

    17KB

    MD5

    f5029ed8b5e1894dab7809f3e46d4ec8

    SHA1

    84d62387b71290430a4645953fc036c457e79147

    SHA256

    3cdb52bd8921b81b56dbb241a5ce65c8b4ed73e5374a9886c028b420d51b6fea

    SHA512

    4a8eee564fad89f5d943d539d603d2be74cb2260d40792cc43497dc371b0b2fcc7acec8a5c3abfca4631aab13cc97507b1189ebcb16dbf07dea32e4dd4aa5cdb

  • /data/user/0/com.sabadel.codigo.app/files/messdb.db
    Filesize

    8KB

    MD5

    57a39108426ea4fb8e5bc74accc22a88

    SHA1

    73f83c87418acba44a084cb7055fc5c34f6cf25e

    SHA256

    9d36142e37864417222d54360d821b9a75f31ad31d1f9a45c947edb63ec6b2d2

    SHA512

    f122d601019b7ee6077574897b51d60cf8223780db64e0649a772183c8025ac413d3ce0683c8bf05373e293cb67ebb62d9dfea15d5d16c495bc0628279709b8a