Overview

overview

8

Static

static

7

0b72c22517...ed.apk

android-9-x86

8

0b72c22517...ed.apk

android-10-x64

6

0b72c22517...ed.apk

android-11-x64

8

Resubmissions

22/11/2023, 16:15

231122-tqbyladf2510

06/02/2023, 11:15

230206-ncz6dadf558

01/02/2023, 07:34

230201-jd4sqsec2s8

Analysis

  • max time kernel
    199759s
  • max time network
    161s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    01/02/2023, 07:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8_unpacked.apk
  • Size 7.2MB
  • Sample230201-jd4sqsec2s
  • SHA256 0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bankerransomware

Malware Config

Signatures

  • Makes use of the framework's Accessibility service. 3 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
    banker
  • Acquires the wake lock. 1 IoCs
  • Requests enabling of the accessibility settings. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.rduzmauwns.jieliysagr
    1⤵
    • Makes use of the framework's Accessibility service.
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
    • Acquires the wake lock.
    • Requests enabling of the accessibility settings.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4404
  • com.rduzmauwns.jieliysagr:remote
    1⤵
      PID:4458

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Web Data
          • Path /data/user/0/com.rduzmauwns.jieliysagr/app_webview/Default/Web Data
          • Size 120KB
          • SHA256 8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Web Data-journal
          • Path /data/user/0/com.rduzmauwns.jieliysagr/app_webview/Default/Web Data-journal
          • Size 2KB
          • SHA256 57031e4e2b0fc052aae87d66fed4a30fa12d906843435d516427e17858c9bf69
          • MD5 SHA1 SHA512
          Submit Download

          webview_data.lock
          • Path /data/user/0/com.rduzmauwns.jieliysagr/app_webview/webview_data.lock
          • Size 31B
          • SHA256 c8e217b812e6272e702e792f1b79f98dd21ac7f3172ccf764cd4af6b57f7dac4
          • MD5 SHA1 SHA512
          Submit Download

          settings.dat
          • Path /data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/Crashpad/settings.dat
          • Size 40B
          • SHA256 4ec1287e7ebd8c6a4cad2fdc69164d3b02f416d09bf606fb0a7cf7baf4f8b9e4
          • MD5 SHA1 SHA512
          Submit Download

          index
          • Path /data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/Default/HTTP Cache/Code Cache/js/index
          • Size 48B
          • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
          • MD5 SHA1 SHA512
          Submit Download

          temp-index
          • Path /data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index
          • Size 96B
          • SHA256 315aa40c0ceff67c162d72d8d8926a39ca32474f106b1ea7f23deab558051436
          • MD5 SHA1 SHA512
          Submit Download

          index
          • Path /data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
          • Size 48B
          • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
          • MD5 SHA1 SHA512
          Submit Download

          temp-index
          • Path /data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
          • Size 96B
          • SHA256 62c7634d35245ea6f680aede8e6f910307d0034f3c032dea20140f9e478f833d
          • MD5 SHA1 SHA512
          Submit Download

          font_unique_name_table.pb
          • Path /data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/font_unique_name_table.pb
          • Size 57KB
          • SHA256 0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          WebViewChromiumPrefs.xml
          • Path /data/user/0/com.rduzmauwns.jieliysagr/shared_prefs/WebViewChromiumPrefs.xml
          • Size 127B
          • SHA256 248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd
          • MD5 SHA1 SHA512
          Submit Download