Analysis
-
max time kernel
3115762s -
max time network
12s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
26-11-2022 23:15
Static task
static1
Behavioral task
behavioral1
Sample
4de47cb27ad3216d5f3741d49d1d2ce04170233a6fe44ec1ea4a446f2b985e14.apk
Resource
android-x86-arm-20220823-en
General
-
Target
4de47cb27ad3216d5f3741d49d1d2ce04170233a6fe44ec1ea4a446f2b985e14.apk
-
Size
2.3MB
-
MD5
12048db130f0b90c8ba5c76d29c466cd
-
SHA1
aca258637999e727197aa375016a27c3c49b046e
-
SHA256
4de47cb27ad3216d5f3741d49d1d2ce04170233a6fe44ec1ea4a446f2b985e14
-
SHA512
615f1d96b587cc41012c5eae7b206010a00832d7a3b9cd4264dcbd9c00968cd4c142108ce5acd39a930b555ecffac018c6db2366ce1b7309d871c16422c207c8
-
SSDEEP
49152:6Sl616nFcKi+wDLPsm856CKhmDpfpS0MDDUhmyRuT2:0663+wDzxCKhmDpfQ0MDYh/RuT2
Malware Config
Signatures
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/files/3dfc6c9557146915a1237ab2fd3f9e64.apk 4157 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/files/3dfc6c9557146915a1237ab2fd3f9e64.apk --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/files/oat/x86/3dfc6c9557146915a1237ab2fd3f9e64.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/files/3dfc6c9557146915a1237ab2fd3f9e64.apk 4107 pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c /data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/realshell/35e6ac0c48af9fc337c06187144f8fbd.apk 4188 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/realshell/35e6ac0c48af9fc337c06187144f8fbd.apk --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/realshell/oat/x86/35e6ac0c48af9fc337c06187144f8fbd.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/realshell/35e6ac0c48af9fc337c06187144f8fbd.apk 4107 pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c
Processes
-
pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c1⤵
- Loads dropped Dex/Jar
PID:4107 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/files/3dfc6c9557146915a1237ab2fd3f9e64.apk --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/files/oat/x86/3dfc6c9557146915a1237ab2fd3f9e64.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4157
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/realshell/35e6ac0c48af9fc337c06187144f8fbd.apk --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/pt.hztoriismzs.bvl.e0ac7a35efb8.n5ad3c/realshell/oat/x86/35e6ac0c48af9fc337c06187144f8fbd.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4188
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD5865e35d4ec0751e4fe9fb972ac488a94
SHA1dedd2dc088145f04a432f678b2c0f6f0c259cd77
SHA2564c032dbccf23887afdf1a20a8c55e234811074c2b3c4d54de9eb4e2c46317ad1
SHA512bdb6cc3502a8c6c0d97815ffcd016be2cfb20c6247b3abd4d6a0bf88015ed3c98b037cd69862a72ba5faa6bde2fe2bd79b22a462ffc930ec9acc073640234052
-
Filesize
288KB
MD53641edf05192d0182bc719297f19c10d
SHA1d545e31be30124ad6fb7f91b1c4c55fe23cb732d
SHA25611d03b36692644a21b7ef4e6aa88579565513f0d10a9be09ae3aa6e45936ac5d
SHA5126ff0b864e2b86e4e9ad2755592e0991aa32d6a0bfbd70b92b7493567425f1af2069b8effe5a3058773edc97c79fd7919de8802c40e8cf305e7508310381e851e
-
Filesize
288KB
MD59629bd67ece7e91de9db71da74675902
SHA110e149d2c03ce7c99d09188519641846ed82bd1a
SHA2562984400175d356bbdbb3a484ecb8359146baa93bca6af4c947a1193d1baa3f40
SHA5121d4bfe44b1290fd2add88f97317b5c98a0d7deb8ca12afc055a78656d353b7061d0e50c755736cca20f2711d1c91f84882e1ccd278e653b14563bac223e5ec74
-
Filesize
1.2MB
MD5c91fa44818c13b98063a799e32d35e99
SHA13bcfa2c5f5d1718883f8dacd634531e1de74e01b
SHA256dd310d71cafd964cf0210ac2f47df613a8a820df3951154b0ed47b39bb00b328
SHA5128e0e05a8b91c54bfc28966be197fa1873e779a861b6d23d8b52179add83246c82c156606cd972f06f2beb8df048eab831c82064a5acc883953a830beeb625d2f
-
Filesize
1.1MB
MD5c8942b85ffa4a9966485e446c4457f3a
SHA1b38aafaa386ca4f4d25dbc9241f1a6f73e5173f5
SHA25628d8a6d03d15b83846472b5612bba1fc5e25719603f57224963e2c46bc2b773b
SHA512aff62c1532006b7f3319fe263dbbd52255e02ae1f367e3993e5bda4a509e676126c1e2f848c3fe1494ad70d535d73aac4eb42cd7c4ee497e747fdc70ff53d53a
-
Filesize
1.1MB
MD57e6756d93146e5d9dfcdcd7e4dd9d003
SHA186813f35eee20152d063b2d519fbe257f9a0edaf
SHA25691a0325fb73be0489804b942adf411e04f235adb24f50c41d0989c371027a866
SHA51204b907f2cf7c6636c007da368bb325b3a105773d35e82b4ebd0f11ed9c7a36427c7365a3d8680e5c59fe905e8d860e54f356c071aac9cabf20fdfa87de11a4f3
-
Filesize
117B
MD52b668238bed9a30d3f6f10812c0daf68
SHA147b3a91fc2a36934b5b55b06077c5c7bff1f46f1
SHA25624496c2821f5b46aabc4563e307c3ea5ed87f410cda900d546b7eb65e05341fd
SHA512ea234c4b9b80ec20a3988cd78a2e4760f2c9b3f890ce58267c5a2f7e20964c8b9598aea5ee9bf8a021c55768924bd6df114fbc0e240f7e7d5eb273200975103b