30e1aac3d0d0a7ddbaa19ad7d032b58d58ed709ab2dcb456e11355c6d4606ba0

Analysis

max time kernel
2823002s
max time network
16s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
24-11-2022 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30e1aac3d0d0a7ddbaa19ad7d032b58d58ed709ab2dcb456e11355c6d4606ba0.apk
Size

2.4MB
MD5

cdb60d2bd0dbe469bc4821d545f64238
SHA1

3ce677f3a118aa4217f2206e06bd4d0ffe52a27e
SHA256

30e1aac3d0d0a7ddbaa19ad7d032b58d58ed709ab2dcb456e11355c6d4606ba0
SHA512

2d1a78e66c0070ffe6a1e1f253feb4c1eca39910703a0110674b87bf78a2d062b4b35c4a70536810649ddc4232be797d3b67e89117481fd8109b91e857047350
SSDEEP

49152:el6s2B6AExSLWMtd/8YtRaG5duYtRaG5jmSrdKLBYtRaG5QYtRaG58YtRaG5bhr:u6vBlWSLWwdUmRatmRaIbrQBmRarmRaI

Score

7^/10

ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/data/com.rim.kookkey/x.zip --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/data/com.rim.kookkey/oat/x86/x.odex --compiler-filter=quicken --class-loader-context=&com.rim.kookkey

ioc	pid	process
/data/data/com.rim.kookkey/x.zip	4184	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/data/com.rim.kookkey/x.zip --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/data/com.rim.kookkey/oat/x86/x.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.rim.kookkey/x.zip	4090	com.rim.kookkey

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.rim.kookkey

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.rim.kookkey

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.rim.kookkey

com.rim.kookkey
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4090

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/data/com.rim.kookkey/x.zip --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/data/com.rim.kookkey/oat/x86/x.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.rim.kookkey/oat/x86/x.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/data/com.rim.kookkey/oat/x86/x.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/data/com.rim.kookkey/x.zip

Filesize
388KB

MD5
a91e1a270d7e54bf0bce0cb4c7d225b6

SHA1
dc858fdcd201bcf821f3fe50839690f5e167523c

SHA256
500753e118c6c69da3a02f3be7be7a047a0d0ea54a52add8c135ee9953f8355d

SHA512
07650cf627e23d6e8d2e70f5c2c4d8d73b113de3346b49fb765e56037362e0f430321677a415492d0420302b531663e9587d5b3f4502b4babc612f742c64e43f

Download Submit
/data/data/com.rim.kookkey/x.zip

Filesize
954KB

MD5
02a8b687e4d2abbadcfc4ecf8f86e1ac

SHA1
7890687c5f942ca3768aa4338197028eec0f7e90

SHA256
753855afda8b025c12c7cf83a39f31514bafb2c0ad21dcc131a19faaa3bee876

SHA512
7188009f9c4ae1d32a4e13ed73bd9cb6fb7a4349fd052073159cf862e5d2ee65f66d898df06eea75cd61e57f94652e8c233c6914893bb9ea11af0ca0301efd89

Download Submit
/data/data/com.rim.kookkey/x.zip

Filesize
954KB

MD5
02a8b687e4d2abbadcfc4ecf8f86e1ac

SHA1
7890687c5f942ca3768aa4338197028eec0f7e90

SHA256
753855afda8b025c12c7cf83a39f31514bafb2c0ad21dcc131a19faaa3bee876

SHA512
7188009f9c4ae1d32a4e13ed73bd9cb6fb7a4349fd052073159cf862e5d2ee65f66d898df06eea75cd61e57f94652e8c233c6914893bb9ea11af0ca0301efd89

Download Submit
/data/data/com.rim.kookkey/x.zip.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit