c288ed7987f6116dadd9ebe1a92c9b13b156f010331e8465db2e740299ee3091

Analysis

max time kernel
2705537s
max time network
158s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
02-03-2023 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1677590406642.apk
Size

2.6MB
MD5

3fe1e782cbc444c29664bfe412e6021a
SHA1

9936c2061c8b1e2d4415abfda2148c3edbf6b305
SHA256

c288ed7987f6116dadd9ebe1a92c9b13b156f010331e8465db2e740299ee3091
SHA512

8f9abe32c6b8cb85e314a4f5a77d21d0025346f93b5493df5163991c2d15b10742b2a4d58e02b96837905941be73ed464fa6ed3fca0855f3f19275daffc13b19
SSDEEP

49152:y17+0ZAskvYsdM59CKUjO8ZtZ6FAVYRJCbaBCZrkOusJ4DkrrHrvi:aaekvYMQ93UFLZAgGMRkOuBArrHrK

Score

8^/10

Malware Config

Signatures

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ahora.caixa

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ahora.caixa

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ahora.caixa/app_securecache/unrar.jar	4160	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ahora.caixa/app_securecache/unrar.jar --output-vdex-fd=74 --oat-fd=75 --oat-location=/data/user/0/com.ahora.caixa/app_securecache/oat/x86/unrar.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.ahora.caixa/app_securecache/unrar.jar	4031	com.ahora.caixa

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.ahora.caixa

com.ahora.caixa
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
PID:4031
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ahora.caixa/app_securecache/unrar.jar --output-vdex-fd=74 --oat-fd=75 --oat-location=/data/user/0/com.ahora.caixa/app_securecache/oat/x86/unrar.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ahora.caixa/app_securecache/unrar.jar

Filesize
113KB

MD5
0ed6b8ec70ab22c5f67663e68ce4d98b

SHA1
5f8addc17f5053787d37ad0c54a8d68986d5d1ac

SHA256
914d6856a065ece157253d4f7a1330dabcb0b6a42ed104a4008c63fb870881cd

SHA512
c4fc55221d7df0934f0492299039dca57aaea50f61847735c3a1d339efa046db5b467a207a098fb73f60e6a9eb4f154ab7e5ac4aa4077b4d9bea7466cfd26620

Download Submit
/data/user/0/com.ahora.caixa/app_securecache/unrar.jar

Filesize
528KB

MD5
198cfb1b0fc8bcb9a86ef2ecb064d424

SHA1
563fc534093e7901979c8bd0590ae4e77aa85380

SHA256
36f939426a9cc287bdc673d8f6ae200d5cfe5351c5d1d6a0b85a2af71de7c88e

SHA512
54ecb9e6d577c8b7fcca06920f45b372516db1ca5fbcbfb7b41aa8aa562c918a14167daf31c9c65c2523d2c3dd30291baab74a2c7a53be7b9031e2cf114773a9

Download Submit
/data/user/0/com.ahora.caixa/app_securecache/unrar.jar

Filesize
528KB

MD5
12ef9a9f82df6de45fe745ec6a479836

SHA1
95a8bd8ccfc2e26841db7c2a607104f25a97e007

SHA256
b7932a5d1f91b400fc0a044b4f87684b152d81601596863ef8d61cfdcb09f38c

SHA512
c1c0db060815c6b49c43dc29f596b69b1783b29a9a347f91025879bfa626a698168b817b0c308c8303a9763729c2ddf94119d18a2bc5eb37a49d4ec9a1d60232

Download Submit
/data/user/0/com.ahora.caixa/app_securecache/unrar_enc.zip

Filesize
98KB

MD5
28989be97e2542590a0776ddd4fb9f51

SHA1
2aa3e760aa30dc90e75993a93364ec6199a5beeb

SHA256
7d0794161b09ecf9ab4ace397ae1bf309fef3f54656412dc2742a51ff72c0dc6

SHA512
20e17c7481cf1fb771cafd8f68197a70b9730908f032767d41a9a1b7cf50eaa35f93d6f9f4e4ea83a0e741d5b1606245e26ff263ba6990c13f0ceecebbea595b

Download Submit
/data/user/0/com.ahora.caixa/cache/1

Filesize
98KB

MD5
28989be97e2542590a0776ddd4fb9f51

SHA1
2aa3e760aa30dc90e75993a93364ec6199a5beeb

SHA256
7d0794161b09ecf9ab4ace397ae1bf309fef3f54656412dc2742a51ff72c0dc6

SHA512
20e17c7481cf1fb771cafd8f68197a70b9730908f032767d41a9a1b7cf50eaa35f93d6f9f4e4ea83a0e741d5b1606245e26ff263ba6990c13f0ceecebbea595b

Download Submit
/data/user/0/com.ahora.caixa/cache/2

Filesize
315B

MD5
3c5c1f5ed86596a6f5166fdaf04877c9

SHA1
fd15c0e1fbacd1ea70963f4db97611d3dea9e42d

SHA256
677cff8a6e43d3d6fe29712090dd3b60a631ad5d5a598e36a6a50544504f55be

SHA512
485284c224b7683313568614eb797da62523cc8c71c7f33b131b8dee12987a7df9511b2d9e2712527c8e4f5c79cc0d96d721cca5a9a4fbdae123e9844a6c055c

Download Submit
/data/user/0/com.ahora.caixa/cache/3

Filesize
98KB

MD5
28989be97e2542590a0776ddd4fb9f51

SHA1
2aa3e760aa30dc90e75993a93364ec6199a5beeb

SHA256
7d0794161b09ecf9ab4ace397ae1bf309fef3f54656412dc2742a51ff72c0dc6

SHA512
20e17c7481cf1fb771cafd8f68197a70b9730908f032767d41a9a1b7cf50eaa35f93d6f9f4e4ea83a0e741d5b1606245e26ff263ba6990c13f0ceecebbea595b

Download Submit
/data/user/0/com.ahora.caixa/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/user/0/com.ahora.caixa/files/dbkeys.db

Filesize
8KB

MD5
9a7f3389cf225c38519f34b1e4fff4e8

SHA1
f011af30d5cf5a4cd15b0d82b0c00ff1a4c5952f

SHA256
bf1be95566105ea42392d0c06a2bd06e6ca724e9c8a5f5cd818813b178821378

SHA512
451936320e988c03a84aa6cbb0d2dc6c738eedc135114690e980908a39a0f86867799881bd09faf8843c5b34d57d7a356992d476ac6858083fe5c74600fdefa8

Download Submit
/data/user/0/com.ahora.caixa/files/dbkeys.db

Filesize
8KB

MD5
9a7f3389cf225c38519f34b1e4fff4e8

SHA1
f011af30d5cf5a4cd15b0d82b0c00ff1a4c5952f

SHA256
bf1be95566105ea42392d0c06a2bd06e6ca724e9c8a5f5cd818813b178821378

SHA512
451936320e988c03a84aa6cbb0d2dc6c738eedc135114690e980908a39a0f86867799881bd09faf8843c5b34d57d7a356992d476ac6858083fe5c74600fdefa8

Download Submit
/data/user/0/com.ahora.caixa/files/dbkeys.db-journal

Filesize
4KB

MD5
0e3904b277df31ce63a8d2c53dbd4659

SHA1
b208ed4a77bb5a597c317ab35ba07e77ec041902

SHA256
d2e0ef122fdfdb27585cddc5cde0eeb2b71991715fbd5c016bb13286462f0ea9

SHA512
64be72bb8125d48dbe29e0a4f077ead46e6b6856ff41b475ee38b9f8859e1213133449c305b96970750427b6ea6e4e13cb723f21d45c25c0901c633cfc29260a

Download Submit
/data/user/0/com.ahora.caixa/files/gvcrfRK.zip

Filesize
98KB

MD5
28989be97e2542590a0776ddd4fb9f51

SHA1
2aa3e760aa30dc90e75993a93364ec6199a5beeb

SHA256
7d0794161b09ecf9ab4ace397ae1bf309fef3f54656412dc2742a51ff72c0dc6

SHA512
20e17c7481cf1fb771cafd8f68197a70b9730908f032767d41a9a1b7cf50eaa35f93d6f9f4e4ea83a0e741d5b1606245e26ff263ba6990c13f0ceecebbea595b

Download Submit
/data/user/0/com.ahora.caixa/files/gvcrfRK.zip

Filesize
98KB

MD5
28989be97e2542590a0776ddd4fb9f51

SHA1
2aa3e760aa30dc90e75993a93364ec6199a5beeb

SHA256
7d0794161b09ecf9ab4ace397ae1bf309fef3f54656412dc2742a51ff72c0dc6

SHA512
20e17c7481cf1fb771cafd8f68197a70b9730908f032767d41a9a1b7cf50eaa35f93d6f9f4e4ea83a0e741d5b1606245e26ff263ba6990c13f0ceecebbea595b

Download Submit
/data/user/0/com.ahora.caixa/files/localdb.db

Filesize
12KB

MD5
e7179ba1abb576a1eb3486db34de4037

SHA1
4dc87664c9be3d7a94d4886b7f56f4a8d7b983dd

SHA256
409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f

SHA512
50ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a

Download Submit
/data/user/0/com.ahora.caixa/files/localdb.db-journal

Filesize
4KB

MD5
e93060dad8e9187eed330d83e2adf1dc

SHA1
7b8e041cfb637ca8f1d9e72d73d2363c6976c3e4

SHA256
461f01c2a52f18283361f8eadb03c5f902e0af080f319b57dfd06001581c398f

SHA512
a72f7f2c323b51585af5c1a01f4f9d15d6fad023d5f3a0a40dea23d2c5da7a6c94bf0735dda70fd02f0e3b319ff6166062be0422aca82c716fb8abbfb7ad5dd0

Download Submit
/data/user/0/com.ahora.caixa/files/localdb.db-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.ahora.caixa/files/localdb.db-wal

Filesize
4KB

MD5
5b1b3c44c21c1fac356512d910a61031

SHA1
5a2301df050fce26f7fc379f3e649a1f1b127bdc

SHA256
880ae9a5719770fd4a85f28fc3dd5dbe0679a45409276034c6398b38c16ce840

SHA512
b5751331f9fe71b474ff6158cefd91e9da2cc89e74313fce543d677e754f2ada40bed6b2fcd45664f077b1632128584478f28852aaa0465746e3d684c7dad341

Download Submit
/data/user/0/com.ahora.caixa/files/messdb.db

Filesize
8KB

MD5
57a39108426ea4fb8e5bc74accc22a88

SHA1
73f83c87418acba44a084cb7055fc5c34f6cf25e

SHA256
9d36142e37864417222d54360d821b9a75f31ad31d1f9a45c947edb63ec6b2d2

SHA512
f122d601019b7ee6077574897b51d60cf8223780db64e0649a772183c8025ac413d3ce0683c8bf05373e293cb67ebb62d9dfea15d5d16c495bc0628279709b8a

Download Submit