0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8

Resubmissions

22-11-2023 16:15

231122-tqbyladf25 10

06-02-2023 11:15

230206-ncz6dadf55 8

01-02-2023 07:34

230201-jd4sqsec2s 8

Analysis

max time kernel
199759s
max time network
161s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
01-02-2023 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8_unpacked.apk
Size

7.2MB
MD5

ec9f857999b4fc3dd007fdb786b7a8d1
SHA1

3fa48a36d22d848ad111b246ca94fa58088dbb7a
SHA256

0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8
SHA512

51d9965e08fa3f5cd8850df3f2dd8503c47ce9f3668b2ae90d3560cc16acd0d4d1b3bbed651d957bc41ea7595a527a00b9c600b3726faa6095af380019e3d1e0
SSDEEP

98304:vDdInEpAOdLl2DfGjOmP34z09nmw3xAZMV8JiDQeZgUGdh0fr33dmh++0oEHi6Pz:5gE7tf3u09nmiOZmDid9h+CFZMXmwfXR

Score

8^/10

banker ransomware

Malware Config

Signatures

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.rduzmauwns.jieliysagr

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.rduzmauwns.jieliysagr
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.rduzmauwns.jieliysagr
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.rduzmauwns.jieliysagr

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.rduzmauwns.jieliysagr

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.rduzmauwns.jieliysagr
Acquires the wake lock. 1 IoCs

Processes:

com.rduzmauwns.jieliysagr

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.rduzmauwns.jieliysagr
Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.rduzmauwns.jieliysagr

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.rduzmauwns.jieliysagr
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.rduzmauwns.jieliysagr

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.rduzmauwns.jieliysagr

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.rduzmauwns.jieliysagr

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.rduzmauwns.jieliysagr

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.rduzmauwns.jieliysagr

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.rduzmauwns.jieliysagr

com.rduzmauwns.jieliysagr
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4404

com.rduzmauwns.jieliysagr:remote
1⤵
PID:4458

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.rduzmauwns.jieliysagr/app_webview/.com.google.Chrome.OcCEed

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
231cba5cda04566d2e86bdac5ed00b36

SHA1
ca66fb969214eb7d755a817aaa702e9b41d1d4eb

SHA256
57031e4e2b0fc052aae87d66fed4a30fa12d906843435d516427e17858c9bf69

SHA512
d2412f7aac3850283119ccd362038e3d1d74cadabc340338faaefe4985863cfa19ea92ad25d3f80e745c15fd927d867812364740dad888ae730bc995f15ce3fe

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/app_webview/webview_data.lock

Filesize
31B

MD5
7cee48b1e00acf643a424d067aec12cb

SHA1
974339b36002e2edf5c41263e282629454095507

SHA256
c8e217b812e6272e702e792f1b79f98dd21ac7f3172ccf764cd4af6b57f7dac4

SHA512
dc06ff2a511da39458081bfd9520b1d242faf4e45f00759f3db1dbdfeeaacab731480bdaf37e9fdcf8a885088d802c40964a43ae327d8664d53cbb09615ef248

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
797ad33bec0c7a5fe341a0fe6fc09366

SHA1
ba7743cd988d0160664ead95897da7fd58eb4b74

SHA256
4ec1287e7ebd8c6a4cad2fdc69164d3b02f416d09bf606fb0a7cf7baf4f8b9e4

SHA512
30333bb3fe8c62c2f3470071210063dcefd0398c7c72c3c3d238a920680b00bf57295d9bcaf68509c97bf994fe4127fae2199702fb76a439bcef743fb3105edd

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
403e27f6987235d49b4731cb920b5226

SHA1
1601ebf2c7f9ee46825df39e2b486575fa0936ac

SHA256
315aa40c0ceff67c162d72d8d8926a39ca32474f106b1ea7f23deab558051436

SHA512
bb827fead17f1da95ce5ca38616648897e2a19b649bc08bdca6b15f2056afa5c47b80222c6b8f07f0f2601106f61841eb3ef4d11ac9f29aeed71a090a226158d

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
dfdcbd56059d6d2267bd2e5d94500a98

SHA1
c09a1eca9073e04cd897b6624958bf49df35090d

SHA256
62c7634d35245ea6f680aede8e6f910307d0034f3c032dea20140f9e478f833d

SHA512
a67bc50c3e65e316483d6212aae7d916830530a60db41602ea4573a89b63417524c03514a97a4e63a0353aea9f987dfcc726e8926ed1c878fe4cead0a580e2a1

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.rduzmauwns.jieliysagr/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit