Analysis
-
max time kernel
2709152s -
max time network
161s -
platform
android_x64 -
resource
android-x64-20220823-en -
resource tags
androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system -
submitted
02-03-2023 08:37
Behavioral task
behavioral1
Sample
1677590406642.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
1677590406642.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
1677590406642.apk
Resource
android-x64-arm64-20220823-en
General
-
Target
1677590406642.apk
-
Size
2.6MB
-
MD5
3fe1e782cbc444c29664bfe412e6021a
-
SHA1
9936c2061c8b1e2d4415abfda2148c3edbf6b305
-
SHA256
c288ed7987f6116dadd9ebe1a92c9b13b156f010331e8465db2e740299ee3091
-
SHA512
8f9abe32c6b8cb85e314a4f5a77d21d0025346f93b5493df5163991c2d15b10742b2a4d58e02b96837905941be73ed464fa6ed3fca0855f3f19275daffc13b19
-
SSDEEP
49152:y17+0ZAskvYsdM59CKUjO8ZtZ6FAVYRJCbaBCZrkOusJ4DkrrHrvi:aaekvYMQ93UFLZAgGMRkOuBArrHrK
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.ahora.caixa/app_securecache/unrar.jar 4707 com.ahora.caixa
Network
-
Remote address:1.1.1.1:53Requestg.tenor.comIN A
-
Remote address:45.86.229.22:8881RequestGET /gvcrfRKnew4.zip HTTP/1.1
Host: 45.86.229.22:8881
Connection: Keep-Alive
Accept-Encoding: gzip
User-Agent: okhttp/4.9.0
ResponseHTTP/1.1 200 OK
Last-Modified: Tue, 21 Feb 2023 18:05:14 GMT
Content-Type: application/zip
Accept-Ranges: bytes
Content-Length: 101031
Server: Jetty(9.4.z-SNAPSHOT)
-
Remote address:37.143.130.80:8881RequestPOST /rdc?method=query2 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 202
Host: 37.143.130.80:8881
Connection: Keep-Alive
Accept-Encoding: gzip
User-Agent: okhttp/4.9.0
ResponseHTTP/1.1 200 OK
Content-Length: 317
Server: Jetty(9.4.z-SNAPSHOT)
-
Remote address:1.1.1.1:53Requestssl.google-analytics.comIN A
-
Remote address:1.1.1.1:53Requestssl.google-analytics.comIN A
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A216.58.208.110
-
Remote address:1.1.1.1:53Requestssl.google-analytics.comIN A
-
Remote address:1.1.1.1:53Requestssl.google-analytics.comIN A
-
Remote address:1.1.1.1:53Requestssl.google-analytics.comIN A
-
2.3kB 103.6kB 41 46
HTTP Request
GET http://45.86.229.22:8881/gvcrfRKnew4.zipHTTP Response
200 -
675 B 641 B 5 4
HTTP Request
POST http://37.143.130.80:8881/rdc?method=query2HTTP Response
200 -
4.1kB 8.3kB 16 16
-
2.9kB 2.9kB 12 12
-
3.7kB 11
-
57 B 1
DNS Request
g.tenor.com
-
833 B 10
-
140 B 2
DNS Request
ssl.google-analytics.com
DNS Request
ssl.google-analytics.com
-
69 B 109 B 1 1
DNS Request
android.apis.google.com
DNS Response
216.58.208.110
-
140 B 2
DNS Request
ssl.google-analytics.com
DNS Request
ssl.google-analytics.com
-
70 B 1
DNS Request
ssl.google-analytics.com
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD50ed6b8ec70ab22c5f67663e68ce4d98b
SHA15f8addc17f5053787d37ad0c54a8d68986d5d1ac
SHA256914d6856a065ece157253d4f7a1330dabcb0b6a42ed104a4008c63fb870881cd
SHA512c4fc55221d7df0934f0492299039dca57aaea50f61847735c3a1d339efa046db5b467a207a098fb73f60e6a9eb4f154ab7e5ac4aa4077b4d9bea7466cfd26620
-
Filesize
528KB
MD512ef9a9f82df6de45fe745ec6a479836
SHA195a8bd8ccfc2e26841db7c2a607104f25a97e007
SHA256b7932a5d1f91b400fc0a044b4f87684b152d81601596863ef8d61cfdcb09f38c
SHA512c1c0db060815c6b49c43dc29f596b69b1783b29a9a347f91025879bfa626a698168b817b0c308c8303a9763729c2ddf94119d18a2bc5eb37a49d4ec9a1d60232
-
Filesize
98KB
MD528989be97e2542590a0776ddd4fb9f51
SHA12aa3e760aa30dc90e75993a93364ec6199a5beeb
SHA2567d0794161b09ecf9ab4ace397ae1bf309fef3f54656412dc2742a51ff72c0dc6
SHA51220e17c7481cf1fb771cafd8f68197a70b9730908f032767d41a9a1b7cf50eaa35f93d6f9f4e4ea83a0e741d5b1606245e26ff263ba6990c13f0ceecebbea595b
-
Filesize
98KB
MD528989be97e2542590a0776ddd4fb9f51
SHA12aa3e760aa30dc90e75993a93364ec6199a5beeb
SHA2567d0794161b09ecf9ab4ace397ae1bf309fef3f54656412dc2742a51ff72c0dc6
SHA51220e17c7481cf1fb771cafd8f68197a70b9730908f032767d41a9a1b7cf50eaa35f93d6f9f4e4ea83a0e741d5b1606245e26ff263ba6990c13f0ceecebbea595b
-
Filesize
317B
MD55112d71db0f2db11ff2820745278aae7
SHA1e2ccf9de49a70c0ab95c1e5895da8bea7f74c00b
SHA2561b5ca7ea825e932a5b89ec2e63af36cb367257edcef70e1936bcd9702da763c9
SHA512c258c3e9d462e110e111f07cecafa8b5ab5e92b6c480ce91af5b25dc984b4e44f2bff358a6c9401652d7578b374c43f7fd365a6abb5b5fec860d1d675cb7b76c
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
-
Filesize
8KB
MD59a7f3389cf225c38519f34b1e4fff4e8
SHA1f011af30d5cf5a4cd15b0d82b0c00ff1a4c5952f
SHA256bf1be95566105ea42392d0c06a2bd06e6ca724e9c8a5f5cd818813b178821378
SHA512451936320e988c03a84aa6cbb0d2dc6c738eedc135114690e980908a39a0f86867799881bd09faf8843c5b34d57d7a356992d476ac6858083fe5c74600fdefa8
-
Filesize
98KB
MD528989be97e2542590a0776ddd4fb9f51
SHA12aa3e760aa30dc90e75993a93364ec6199a5beeb
SHA2567d0794161b09ecf9ab4ace397ae1bf309fef3f54656412dc2742a51ff72c0dc6
SHA51220e17c7481cf1fb771cafd8f68197a70b9730908f032767d41a9a1b7cf50eaa35f93d6f9f4e4ea83a0e741d5b1606245e26ff263ba6990c13f0ceecebbea595b
-
Filesize
12KB
MD5e7179ba1abb576a1eb3486db34de4037
SHA14dc87664c9be3d7a94d4886b7f56f4a8d7b983dd
SHA256409f05ab16c6f1f0897959456d72f94a870b03581569f7c4970b22e541db827f
SHA51250ee847527ad249dcb43d3d95dca9d8bb5bfdc459f6e5d639db4a31895e4f2ad75355451846cb732e380a576f41f1c3af19387cdc9ee7c5e46464c61613e458a
-
Filesize
17KB
MD515bc615fbb5f34f4caaee7609c97f43f
SHA129180cefebc927097a2757cae3ba7c588f60b46e
SHA256a2ebe02fe94d93596e9ceec16a95dc6b1c45efd541accc248f6ffba9b54298a7
SHA512d5d2f06144fd0fc8a93ae7b09ffe2a80f1a46d37a0eb030a50c6a3c10252a7e53373804d4fc926c3cb1f36b585c28357910979b4d0cdfa910cb824f5b3885597
-
Filesize
8KB
MD557a39108426ea4fb8e5bc74accc22a88
SHA173f83c87418acba44a084cb7055fc5c34f6cf25e
SHA2569d36142e37864417222d54360d821b9a75f31ad31d1f9a45c947edb63ec6b2d2
SHA512f122d601019b7ee6077574897b51d60cf8223780db64e0649a772183c8025ac413d3ce0683c8bf05373e293cb67ebb62d9dfea15d5d16c495bc0628279709b8a