Resubmissions

27/10/2022, 16:01

221027-tgem5acff610

21/10/2022, 10:54

221021-mzjlgagdd27

Analysis

  • max time kernel
    439337s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    27/10/2022, 16:01

General

  • Target
    68a1452172636b081873b9f7c1ae3794035c4ff50d5538b656caf07016b74d07.apk
  • Size 6.7MB
  • Sample221027-tgem5acff6
  • SHA256 68a1452172636b081873b9f7c1ae3794035c4ff50d5538b656caf07016b74d07
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Acquires the wake lock. 1 IoCs
  • Checks Android system properties for emulator presence. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.clem.isisnews
    1⤵
    • Acquires the wake lock.
    • Checks Android system properties for emulator presence.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4145
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.clem.isisnews/cache/1582435991586.jar --output-vdex-fd=75 --oat-fd=76 --oat-location=/data/user/0/com.clem.isisnews/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4402

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Cookies

        • Path /data/user/0/com.clem.isisnews/app_webview/Cookies
        • Size 64KB
        • SHA256 64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233
        • MD5 SHA1 SHA512 SSDEEP

        Cookies-journal

        • Path /data/user/0/com.clem.isisnews/app_webview/Cookies-journal
        • Size 1KB
        • SHA256 5de5e2f0cae174d639d54f90afcdae330b4cf13dc4d8bf935b0fd8f0bd17eee2
        • MD5 SHA1 SHA512

        index

        • Path /data/user/0/com.clem.isisnews/app_webview/GPUCache/index
        • Size 20B
        • SHA256 3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
        • MD5 SHA1 SHA512

        temp-index

        • Path /data/user/0/com.clem.isisnews/app_webview/GPUCache/index-dir/temp-index
        • Size 48B
        • SHA256 654ade0c9636d47778f4ed02f57c59ad26fea69a73e6444de67d257a3d045a35
        • MD5 SHA1 SHA512

        000001.dbtmp

        • Path /data/user/0/com.clem.isisnews/app_webview/Local Storage/leveldb/000001.dbtmp
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512

        000003.log

        • Path /data/user/0/com.clem.isisnews/app_webview/Local Storage/leveldb/000003.log
        • Size 831B
        • SHA256 be6bc67cc7460431ef7e9f7042a31964a73254442c315bd889d01a9c3e873afb
        • MD5 SHA1 SHA512

        LOG

        • Path /data/user/0/com.clem.isisnews/app_webview/Local Storage/leveldb/LOG
        • Size 70B
        • SHA256 5acb2a988a1eb696dc21b2ce5edc62dceba00d24cb7d8e596f182b9494ac0dc8
        • MD5 SHA1 SHA512

        MANIFEST-000001

        • Path /data/user/0/com.clem.isisnews/app_webview/Local Storage/leveldb/MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512

        Web Data

        • Path /data/user/0/com.clem.isisnews/app_webview/Web Data
        • Size 104KB
        • SHA256 47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
        • MD5 SHA1 SHA512 SSDEEP

        Web Data-journal

        • Path /data/user/0/com.clem.isisnews/app_webview/Web Data-journal
        • Size 1KB
        • SHA256 a5b744011a43150377f1090d090fd7121538eb361bbba8ba9ac0b74ebb515b1a
        • MD5 SHA1 SHA512

        metrics_guid

        • Path /data/user/0/com.clem.isisnews/app_webview/metrics_guid
        • Size 36B
        • SHA256 3ed1cca0b1795cf2cb4f4a7d0d5af6451deb80288c692ccfe9c9d57985bdc722
        • MD5 SHA1 SHA512

        1582435991586.jar

        • Path /data/user/0/com.clem.isisnews/cache/1582435991586.jar
        • Size 20KB
        • SHA256 105c54b6fe3f25350e92187467761598e4c21d62b1091b77d091f65f3bd98864
        • MD5 SHA1 SHA512 SSDEEP

        1582435991586.jar

        • Path /data/user/0/com.clem.isisnews/cache/1582435991586.jar
        • Size 20KB
        • SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
        • MD5 SHA1 SHA512 SSDEEP

        1a9f149b1f7f35b1_0

        • Path /data/user/0/com.clem.isisnews/cache/org.chromium.android_webview/1a9f149b1f7f35b1_0
        • Size 6KB
        • SHA256 dfe7da84a645cd819e3f14add907293800d2a1324925c2b52c0e70df1ac0536e
        • MD5 SHA1 SHA512 SSDEEP

        dfe6b2497a7513ba_0

        • Path /data/user/0/com.clem.isisnews/cache/org.chromium.android_webview/dfe6b2497a7513ba_0
        • Size 6KB
        • SHA256 04baf0f31755acea51bf4798321be01f038e57e93f962c58f21ccf7e4992d30e
        • MD5 SHA1 SHA512 SSDEEP

        f038e94cb33282ab_0

        • Path /data/user/0/com.clem.isisnews/cache/org.chromium.android_webview/f038e94cb33282ab_0
        • Size 123KB
        • SHA256 d9fd2b7194f3c4c1a8247f6bd7925234d22e1a892361d9fd0500c175201c91d4
        • MD5 SHA1 SHA512 SSDEEP

        index

        • Path /data/user/0/com.clem.isisnews/cache/org.chromium.android_webview/index
        • Size 20B
        • SHA256 3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
        • MD5 SHA1 SHA512

        temp-index

        • Path /data/user/0/com.clem.isisnews/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 96B
        • SHA256 ebe419622cab647e5bd33be620d8d5196809df56fd581132450ace5c9bac47fb
        • MD5 SHA1 SHA512

        temp-index

        • Path /data/user/0/com.clem.isisnews/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 48B
        • SHA256 e9d8ee109c720417096a660bd84c65d9bbace860831dcd6368edc46d2650ab72
        • MD5 SHA1 SHA512

        favorites.db

        • Path /data/user/0/com.clem.isisnews/databases/favorites.db
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512

        favorites.db-journal

        • Path /data/user/0/com.clem.isisnews/databases/favorites.db-journal
        • Size 524B
        • SHA256 3767a6f861ef76f66006c28f6ff9d6e5f390782f53fbf6214233b68e3c53d8ae
        • MD5 SHA1 SHA512

        favorites.db-shm

        • Path /data/user/0/com.clem.isisnews/databases/favorites.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512

        favorites.db-wal

        • Path /data/user/0/com.clem.isisnews/databases/favorites.db-wal
        • Size 32KB
        • SHA256 c26bb68a311bfab94fb3ea026adefce19277da11f672fe2f3568b3b5ca32e673
        • MD5 SHA1 SHA512 SSDEEP

        221027_180148126.get

        • Path /data/user/0/com.clem.isisnews/files/221027_180148126.get
        • Size 214B
        • SHA256 377254cd3366c2bfca58951fa9724fd747bcb8ee2d4782f944efae4123e88f53
        • MD5 SHA1 SHA512

        221027_180148438.get

        • Path /data/user/0/com.clem.isisnews/files/221027_180148438.get
        • Size 51B
        • SHA256 1299f76d50d277aaedeb7e40a86db776662b3bc87fc6f8b014ffa9dae1ea50f2
        • MD5 SHA1 SHA512

        221027_180148571.get

        • Path /data/user/0/com.clem.isisnews/files/221027_180148571.get
        • Size 51B
        • SHA256 1736183e1e651f5f168e0ff39708182ddc328a04bc19c5f7bf7d4fcc27ac1d92
        • MD5 SHA1 SHA512

        221027_180148981.get

        • Path /data/user/0/com.clem.isisnews/files/221027_180148981.get
        • Size 51B
        • SHA256 244d25e65ca9dcec051d9b9737c4a914b6c54240793f36d806993130e4951969
        • MD5 SHA1 SHA512

        221027_180149092.get

        • Path /data/user/0/com.clem.isisnews/files/221027_180149092.get
        • Size 51B
        • SHA256 1dc6c228618c17ceb4da032bdfe2ad0214443bd42c940686aa844b89da06c558
        • MD5 SHA1 SHA512

        221027_180154194.get

        • Path /data/user/0/com.clem.isisnews/files/221027_180154194.get
        • Size 51B
        • SHA256 0dccef671cb705d64e17ed64e622d75cdefe708f56525a88fa8b97ec2cd30428
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180148141.log

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180148141.log
        • Size 368B
        • SHA256 2c3916f5e681884e82c68ea3b53f109bc4c61c94f1a060201970e5a445db5e2b
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180148141.zip

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180148141.zip
        • Size 353B
        • SHA256 ec7140d5f03db287d5ac16f47c42d9ab52c2ea886035ba1767a2d29e116812d1
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180148461.log

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180148461.log
        • Size 256B
        • SHA256 8448b8b5518b32b7a8c7e05389ee247edc7b30df4f59d3f123b354f681385c0d
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180148461.zip

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180148461.zip
        • Size 241B
        • SHA256 8b091704bb03a99202741e2095a9b9aed873624c50c348311c87bc8f7f86d395
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180148578.log

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180148578.log
        • Size 256B
        • SHA256 1f344705b9b2186c627dbdcb498acf39f319086bbdc83480acefbab6d2f202e0
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180148578.zip

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180148578.zip
        • Size 241B
        • SHA256 f279f4fc81a45c360272734f9226d7735019e7deaaaadbe7fd450619317b6b49
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180148988.log

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180148988.log
        • Size 256B
        • SHA256 24b0a4a2aaf1830a7fa90c86cb82eb29020331bee2600bc8c739ed4c09426445
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180148988.zip

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180148988.zip
        • Size 241B
        • SHA256 6a1fbf14eee1f45c83338756b4b6fe11569bb612216c7a6360af13aa44f231d8
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180149098.log

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180149098.log
        • Size 256B
        • SHA256 637e02518b14742a0ac2ec7032cbaebef6dd68153a643865d3089ab06730bbcc
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180149098.zip

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180149098.zip
        • Size 241B
        • SHA256 9e370943e02165ff1a32f762c513887fd761c59634c6a297df740abaf1fed7d5
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180154350.log

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180154350.log
        • Size 256B
        • SHA256 e8eb56ac068053e8a106e92162888fab0ad619723fa2af65b1d704177f25b9d3
        • MD5 SHA1 SHA512

        25bcdf6401de672f_221027_180154350.zip

        • Path /data/user/0/com.clem.isisnews/files/25bcdf6401de672f_221027_180154350.zip
        • Size 241B
        • SHA256 9b72be0891635673a22ec025657dd07d0a73f94cefb7c953b00b2521d4b6a2a2
        • MD5 SHA1 SHA512

        app-version-1

        • Path /data/user/0/com.clem.isisnews/files/storage/clementhoh/IsisNews/sync/app-version-1
        • Size 10KB
        • SHA256 8fd3bc3c2c5c056377599ed6dd47cc41c0798b193d939138d0e492e85167c9fd
        • MD5 SHA1 SHA512 SSDEEP

        filelist.obj

        • Path /data/user/0/com.clem.isisnews/files/storage/clementhoh/IsisNews/sync/filelist.obj
        • Size 1KB
        • SHA256 8871bc4b32c08ca81718a678afbf2c168d96036cf1447e2b4c3ebe201c88763f
        • MD5 SHA1 SHA512

        WebViewChromiumPrefs.xml

        • Path /data/user/0/com.clem.isisnews/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
        • MD5 SHA1 SHA512

        admob.xml

        • Path /data/user/0/com.clem.isisnews/shared_prefs/admob.xml
        • Size 133B
        • SHA256 a66bc0deb63d3bd1d7ece4bcc3788655252e062685dc72f2ccac4178659e1ca1
        • MD5 SHA1 SHA512