Analysis
-
max time kernel
3164602s -
max time network
11s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
27/11/2022, 10:19
Static task
static1
Behavioral task
behavioral1
Sample
8401b0b6f57b483e784c3afc7a2cced6b00f08f951827f68dc709d74a9e225ef.apk
Resource
android-x86-arm-20220823-en
General
-
Target
8401b0b6f57b483e784c3afc7a2cced6b00f08f951827f68dc709d74a9e225ef.apk
-
Size
2.3MB
-
MD5
033e65a4f8374caa0d58aa96115bc2c9
-
SHA1
f78746fac79a898b43f99f7215a6fc6b1d339b64
-
SHA256
8401b0b6f57b483e784c3afc7a2cced6b00f08f951827f68dc709d74a9e225ef
-
SHA512
14d1735a144ca481391582b2a83943c8f46fd33b221b1e0c436cb7867cd2ef56b4637d7983bc0e9654c9a51431dbaa89ef2f9838772104075778b0ffaecef621
-
SSDEEP
49152:0U9Bsof25J6W131O1DCvx1T0XFXDOA/0vboGpB04JFUhmiti6p:FBsof2CW1FO1DCzT01XiA/0vboG304JY
Malware Config
Signatures
-
Loads dropped Dex/Jar 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/files/336b989fbbe4f5219bf5f682381c6e55.apk 4156 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/files/336b989fbbe4f5219bf5f682381c6e55.apk --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/files/oat/x86/336b989fbbe4f5219bf5f682381c6e55.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/files/336b989fbbe4f5219bf5f682381c6e55.apk 4094 gy.effkso.mtnvryy.b896f7.i3f6bf3ac972 /data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/realshell/ac9d67851e90d5fb6cdc6698cc78f4e3.apk 4211 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/realshell/ac9d67851e90d5fb6cdc6698cc78f4e3.apk --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/realshell/oat/x86/ac9d67851e90d5fb6cdc6698cc78f4e3.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/realshell/ac9d67851e90d5fb6cdc6698cc78f4e3.apk 4094 gy.effkso.mtnvryy.b896f7.i3f6bf3ac972
Processes
-
gy.effkso.mtnvryy.b896f7.i3f6bf3ac9721⤵
- Loads dropped Dex/Jar
PID:4094 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/files/336b989fbbe4f5219bf5f682381c6e55.apk --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/files/oat/x86/336b989fbbe4f5219bf5f682381c6e55.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4156
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/realshell/ac9d67851e90d5fb6cdc6698cc78f4e3.apk --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/gy.effkso.mtnvryy.b896f7.i3f6bf3ac972/realshell/oat/x86/ac9d67851e90d5fb6cdc6698cc78f4e3.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4211
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD58fbab55e36a95ca228302a7f5c42731c
SHA1b00d61d0e87772883dbcc35e1ee19058e4f0bb97
SHA2569c9a11b7c2c887372416fbe75d73e70827b809c0449c6354fef3e374baed2737
SHA512b6d76fac4d5a22bb94a3231b1c768cacd2150f81672094c5b1f493c1ac4e2a9c40788c31a7facb924231086d4da1629d7d37bfb7ee806072119e825ac7872db9
-
Filesize
288KB
MD5822fd66798a9b7e5a1188f16a8cc0e25
SHA11237ebf1664f5b0316bae577da522d78f0edab33
SHA2560cfc468a85a0ef70bc57a043fdef0c96e4d33a5efc9e84e15d59418a45d6459c
SHA5127a868119138857936469f986e84e3bd17d3b51cc935c88bca0b1c2a0214bed1a26fc38bc3a12db10881aaa8d3fda0693158c4f2a9a88b4e4e8881a5664109159
-
Filesize
288KB
MD535b1b9896f83de6f14ae88ee06783429
SHA19f4f011928d79514886fd8ba603037cb7ca8a343
SHA2569342eeb93ae8fad6ce8173264444a5e01681eab36948e85dc4254b442bd58326
SHA512cbf0df1e89794f9bb942404c57b9ece625986a542e4be19e93b6665936d24d52e9b5b202445bbadb52f691d292316c9a0de447b7b6cbda91cf12529664c3d517
-
Filesize
1.2MB
MD53b2a4cf3d86bd43afd2c47155ca1ca5b
SHA1d806c5feeabde9f63ae5a7d49587cfcb43e28028
SHA256c13499bbd952e93f25aea92c0d2602c81e23bcc03c2118fe06de65a602b3d126
SHA5120dd4b652281f7994efabd6aae2510432c8fc816598816e3c425f69b5902193d0b4563e2b314fa2e62787650c71ee4be9d04fee75d432129d2bd31920cf1d7e28
-
Filesize
1.1MB
MD5c8942b85ffa4a9966485e446c4457f3a
SHA1b38aafaa386ca4f4d25dbc9241f1a6f73e5173f5
SHA25628d8a6d03d15b83846472b5612bba1fc5e25719603f57224963e2c46bc2b773b
SHA512aff62c1532006b7f3319fe263dbbd52255e02ae1f367e3993e5bda4a509e676126c1e2f848c3fe1494ad70d535d73aac4eb42cd7c4ee497e747fdc70ff53d53a
-
Filesize
1.1MB
MD57e6756d93146e5d9dfcdcd7e4dd9d003
SHA186813f35eee20152d063b2d519fbe257f9a0edaf
SHA25691a0325fb73be0489804b942adf411e04f235adb24f50c41d0989c371027a866
SHA51204b907f2cf7c6636c007da368bb325b3a105773d35e82b4ebd0f11ed9c7a36427c7365a3d8680e5c59fe905e8d860e54f356c071aac9cabf20fdfa87de11a4f3
-
Filesize
117B
MD50e367eef5907cc5041833f214e809b2f
SHA1bf6efdc920d175621e2ac67fc2cf8a465bf090d6
SHA256695a5be605bc299e805713fcbb25a29b9387af55d06c2ceec02ee4af554b08f4
SHA512cfa9699eb88a789d96e32245c332533ac93b479af8b8a97aac62e4d1769579cc4784946269d4058df11a5bb67b9a6bfa7de59934bc9008725e02a64c7f618c49