Analysis
-
max time kernel
3207578s -
max time network
109s -
platform
android_x64 -
resource
android-x64-arm64-20220823-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system -
submitted
28-11-2022 16:59
Static task
static1
Behavioral task
behavioral1
Sample
AndroidGuncelleme.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
AndroidGuncelleme.apk
Resource
android-x64-20220823-en
General
-
Target
AndroidGuncelleme.apk
-
Size
2.1MB
-
MD5
7cb23390212d9a5359fc2931b414399e
-
SHA1
f9c6b289dfd7aded65d830727944867edbbce1ad
-
SHA256
48eb4aca391bc96a97f080f4534e6bd9abb2f29eafb3d388927009b5a102fc92
-
SHA512
457432eacb2f48d757f40d29b5a99cd65a6e6a535dcfbaae34a853afafc87c7699451a03bf00f6a3c1b6eb5e156f443a700108f6c9f70e7ba6eb053cb29717a3
-
SSDEEP
49152:ijkD8Qbmtu3TqG1PcgYgRspfO5KifO0wnviujng53+mmaIHYoD:ifSqGqGbYWoifOlbjnUOf
Malware Config
Extracted
cerberus
http://135.181.83.2
Signatures
-
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
com.kidney.puppydescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.kidney.puppy Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.kidney.puppy -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.kidney.puppyioc pid process /data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json 4654 com.kidney.puppy [anon:dalvik-classes.dex extracted in memory from /data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json] 4654 com.kidney.puppy [anon:dalvik-classes.dex extracted in memory from /data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json] 4654 com.kidney.puppy -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
com.kidney.puppydescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS com.kidney.puppy -
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
com.kidney.puppydescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.kidney.puppy
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.jsonFilesize
54KB
MD5ed177d1008a10bafcb1da3cb66977b7d
SHA116cea1e6e56cb76c85d7e38be0d3896ba0922eb4
SHA2565f2aef5528a68b79a8dda7e4ed586ae0b9b391de4fc02b0e602a2355d80d9c42
SHA512612c82fe6c0609b2d1c8a1ce7739d2c431fafd23a056dd32217bea84cb35c86799b88eff7ef27db202514a54ce7d07ef8e01415504b790aeb752adcf864c051b
-
/data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.jsonFilesize
103KB
MD5415adb9b4a6c3ec87ebc4b99f19d9524
SHA1433cae511590c95cacfa4e943cf322e01d44c35c
SHA256909bd2b8634ce2e02720ddb765dca59ccfb4f274f96b095dc8440d92c5dc337e
SHA512212b146d5c6c9cace7034ce96c2f519beb5579550a8bdf9579b736303bd3697bf7efeb606ebedd37047f9507dafc3a0f92183931b5628abe76c927a6a785f646
-
/data/user/0/com.kidney.puppy/app_DynamicOptDex/oat/Qiwffm.json.cur.profMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.kidney.puppy/app_webview/.com.google.Chrome.qSoNZ6MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.kidney.puppy/app_webview/Default/CookiesFilesize
64KB
MD5dfb2098ca7b3bf16d6f5f1e7d3839af5
SHA1ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d
SHA256e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224
SHA512fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50
-
/data/user/0/com.kidney.puppy/app_webview/Default/Cookies-journalFilesize
1KB
MD555957d7787866d684397f3deeb7161d4
SHA15f1dee1dc4d43d26302edebc7a63509581eec6b0
SHA256ccf9f9bc490cf23d888b66e5286649635026a6b88b52f596ecc30dc6290f174c
SHA5126f2c7a68479b5ba53af1d439b1e133c8cf93412497ff351db75df1fdb5cbf45d6a64d6af753674eccbdb95fc5997207f1dd4f98992f47b7bfddb1c1e41055305
-
/data/user/0/com.kidney.puppy/app_webview/Default/GPUCache/indexFilesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
/data/user/0/com.kidney.puppy/app_webview/Default/GPUCache/index-dir/temp-indexFilesize
96B
MD533df1042470cb2fd72ef2b96be93c775
SHA1eb8df5d733ee2c77d28c96795397272e5f77f262
SHA25693893de26d1becd26d49ad9eed3b8a64636a4e9cbf6f3e661cef9f587a2b4826
SHA512b4b621c8bbbaa26f9371dfcc8d5de7d01272afe692791c258018fbebf044df86c47d6223fa55d7f5ca8d4179d51965d86417274db9d03e9156bd9da73967e560
-
/data/user/0/com.kidney.puppy/app_webview/Default/Session Storage/000001.dbtmpFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
/data/user/0/com.kidney.puppy/app_webview/Default/Session Storage/000003.logFilesize
61B
MD59f7eadc15e13d0608b4e4d590499ae2e
SHA1afb27f5c20b117031328e12dd3111a7681ff8db5
SHA2565c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923
SHA51288455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f
-
/data/user/0/com.kidney.puppy/app_webview/Default/Session Storage/LOCKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.kidney.puppy/app_webview/Default/Session Storage/LOGFilesize
128B
MD52bafdfac42c72e9a16609c4e70d6892e
SHA1a747c076ba21ef2ce9f8e51d2c957128c777790b
SHA2566c6bb0b852ee663aa7787cc7f0ea89b5c5f2d7f6733e46bdd1a4cf80a991210c
SHA5120c315ac3135ed45fd14357a3fbfc2102b803c75934802561f1a979683db9ba78e87d91e86b4c56e99d6d0bac5d90d67ac51843b6745e648383655a74ff1d3199
-
/data/user/0/com.kidney.puppy/app_webview/Default/Session Storage/MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
/data/user/0/com.kidney.puppy/app_webview/Default/Web DataFilesize
120KB
MD5a48cd9324b1f8754b07f00d863b840f3
SHA111c6614775b35a58f440971dfc87c8aaac6d6173
SHA2568859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420
SHA51235fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1
-
/data/user/0/com.kidney.puppy/app_webview/Default/Web Data-journalFilesize
2KB
MD52dce03773e6698c8ccdc99dcfd5dad5e
SHA15aeaa371adcc95e6f5a95393ff7ee573b413d839
SHA25600d94e438e5d653722a357dc91c053f18bd4898bef0896a9abab76215a58633b
SHA512cd0190a409031c5da4eeed04ef25c1491f449690c649c8386be8fd290525516b199597f0cc82861ccdf2f752efa45df9bb579e4150d281eb43d102dcbb2c0cc3
-
/data/user/0/com.kidney.puppy/app_webview/variations_seed_newMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.kidney.puppy/app_webview/variations_stampMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.kidney.puppy/app_webview/webview_data.lockFilesize
22B
MD5aadcb076ac35b9467d6fe06f7be882af
SHA16ded4c526f351157008d55541502c09c67df1db0
SHA256860cde813deed3c533c25dcf2da13003a079a8c3d9c312215526ef534332e54e
SHA512b13dacbfbd1994afb4ffcb9f06c2e46eba459f939572674ec6b11970e14ddfaba438279b0ad573c603f88689eb3f66c72582df11374de0ae34ccc35ac922ecfe
-
/data/user/0/com.kidney.puppy/cache/WebView/Crashpad/settings.datFilesize
40B
MD5c571c2eef219f67d5bdc0b945054c7e0
SHA18ae97bb2e36357aaac67e286a696838e01e1ec64
SHA2567bfecd368ada73f79d2dbecfcd88c305512db025f0d89241c744c45a732b13bf
SHA51295a2356567f930ea4bfa892d9a7ce6c22c7ae41aa430bc602ec0372357753a0ae3834def62267112c444027bf5476d06dae05d688b44f26c253bac22e16e7ff7
-
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/08a676c78d1b5fe8_0Filesize
29KB
MD5e06d6ea4a4afcf2019e06da97a44795d
SHA1021bcffa255cba0a1d028b03d02127091ece6c12
SHA256442aa3aa02e7af8caa5876f3e05af19bff0fb85d4f41700d2a9e3e43827a6e50
SHA5123b360069d8c29c336d12f853505217e91e43450e29ca783f0812b450125fa24a61db0efbce046cdf0847e66f53030c64805a6dee62cc1da358208ac4d53fe54e
-
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/180574ed5181a14b_0Filesize
38KB
MD57ee474d11031a4c03f75845b97be2d01
SHA1de30b5a86a5723389be70c9733b00f26d37844ef
SHA25696a6b9e9c5946a7cf39df40f4fd5e207e1d0fd60bfa14778d1dd8b36b7ac21f5
SHA51296a2c4da6a6f5624abfdab1a6a5df385e0034876d7520ec8fc0da3b292b795fd6d69474643d0e921082c94e551b22f909d7b5748ad902152b5c667cc0807dbfb
-
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/Code Cache/js/indexFilesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-indexFilesize
96B
MD51a642ac22ff9f0fb908c2eb1a84ea1c9
SHA1d68cc310c3cea9f9968b0e567208eabb664648f8
SHA256b91418de58f97c7f73ea05bd1d51b4ddef38e2eecb528b0cf8834dfb4091cb4b
SHA5124ae8da0736255d70025984797cb227c4218ea999b4aea4e43025f4803231ae2f1f26cfab79014ddf2b350465431bee87ead893e54d1a5a481d479c68bcec640b
-
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/Code Cache/wasm/indexFilesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-indexFilesize
96B
MD53344f01b20b28dad5edf75c2e7d01258
SHA161f2044c498609b11a23ccf460dafe7de9104bcb
SHA256f249a83e4c6d8df64fa5025bc9f8576f55c9ecc476e5e882378ce859af62975b
SHA5123eb3a86aed6c4e5a3fe12f6735bada0104a340c6adf49cb10b122ac6935213676d55eeac02e703466e5d01fa8d1323485c1a48779977c3f26d35acd725e5c31d
-
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/indexFilesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/index-dir/temp-indexFilesize
192B
MD5d3fd7b4918eb0a5d5e46dfe0f9d441e7
SHA1fd38b744fb70ad80d46cb49c08542572fcee6720
SHA2568bde2a65d8b4891c400c6d9518806e49118ddff25c6ae80bb9d18147d9c860c5
SHA5128927392cbb79438d56f178ffbefb4c1781b1f22885879a2efefcd2af5ea57915f647df80b835bf47dedf9a132d50aa6a7fe6226741d2075f8d54b67264cdfc2d
-
/data/user/0/com.kidney.puppy/cache/WebView/Default/HTTP Cache/index-dir/temp-indexFilesize
192B
MD5f6b67a164504a8d7c992fbfcc9f0c364
SHA12a5faa75ea8d47422a892d6516f10c4b40f11a3e
SHA256d5b115b03891efff93dd39f73ea5ba0d919549c14375dc3c7c24f68c1d0607b0
SHA51212fa6ed866bc357f4399b78919ad32c60236689ef08d702eb3438ceb7c3d9c84d37e1d1cd18af2914c3c997af2b03bb0e63fc801236a0797e3d3cb259a9eb47e
-
/data/user/0/com.kidney.puppy/cache/WebView/font_unique_name_table.pbFilesize
57KB
MD5f080fa2a56ab5479d58063e5ea871447
SHA14b3fd57a98916fa5784305b76ba30af26b5253d9
SHA2560aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815
SHA5128aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936
-
/data/user/0/com.kidney.puppy/shared_prefs/WebViewChromiumPrefs.xmlFilesize
127B
MD597ccd9a2b2063143df56b6937f961ca4
SHA15e78a91ae5df289ce83443cb7d5589dd3504fb5d
SHA256248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd
SHA51286c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b
-
/data/user/0/com.kidney.puppy/shared_prefs/settings.xmlFilesize
116B
MD5d238bcaede8d9fc88b09c0e7fa6248f3
SHA17dc3c46230aeff7499e958a777a15ba65d483933
SHA25644b7e05984b2ff4a389f942dd8e2c6c948abb1edb92ad88d124472fb9ff974c1
SHA512ef57d436fa7452f4d7a1e737351eed1a74155b8803ab28f838ae6cf134ca6b4be3a47731d024d2ba3c89bb26bdd24b68fb323f5b7d16c36712df42ac093a1a52
-
/data/user/0/com.kidney.puppy/shared_prefs/settings.xmlFilesize
163B
MD595f6cf275d56aef2102b62828f7034c0
SHA18117a0e4daf60ee6edf88e6992c764680be59890
SHA2565dcaced0b68e0ccc444f98aa2e1eb657c177f808be3d65352b1381eb4c778e96
SHA5126dd12b3f5091eea21604e412748d14e48f77ce03982768cfad754bd581a024b6ccb3e99ed094b4ac27493ac225c99504f6d55b215db2e9e11f1df234d86925fe
-
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json]Filesize
103KB
MD5415adb9b4a6c3ec87ebc4b99f19d9524
SHA1433cae511590c95cacfa4e943cf322e01d44c35c
SHA256909bd2b8634ce2e02720ddb765dca59ccfb4f274f96b095dc8440d92c5dc337e
SHA512212b146d5c6c9cace7034ce96c2f519beb5579550a8bdf9579b736303bd3697bf7efeb606ebedd37047f9507dafc3a0f92183931b5628abe76c927a6a785f646
-
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.kidney.puppy/app_DynamicOptDex/Qiwffm.json]Filesize
103KB
MD5415adb9b4a6c3ec87ebc4b99f19d9524
SHA1433cae511590c95cacfa4e943cf322e01d44c35c
SHA256909bd2b8634ce2e02720ddb765dca59ccfb4f274f96b095dc8440d92c5dc337e
SHA512212b146d5c6c9cace7034ce96c2f519beb5579550a8bdf9579b736303bd3697bf7efeb606ebedd37047f9507dafc3a0f92183931b5628abe76c927a6a785f646