Resubmissions
03-10-2023 04:57
231003-flel2agd3x 1002-10-2023 04:19
231002-exzwnsgh69 1010-03-2023 06:31
230310-haj4gsdf5t 815-06-2022 10:31
220615-mkec7sdehq 8Analysis
-
max time kernel
3389231s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
10-03-2023 06:31
Static task
static1
Behavioral task
behavioral1
Sample
831346106da21d6edd95d62d22065a705e1c8c3edd29a31fb4ca7431d50d5cb1.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
831346106da21d6edd95d62d22065a705e1c8c3edd29a31fb4ca7431d50d5cb1.apk
Resource
android-x64-20220823-en
General
-
Target
831346106da21d6edd95d62d22065a705e1c8c3edd29a31fb4ca7431d50d5cb1.apk
-
Size
123KB
-
MD5
b08c833107b4fc22289386fe47dd997f
-
SHA1
fe6673b28888d22b1d3181e26b5e708d96d3f602
-
SHA256
831346106da21d6edd95d62d22065a705e1c8c3edd29a31fb4ca7431d50d5cb1
-
SHA512
9b26a007c1c3a107c41992f14df40f094880c045a0586cd67a3fca091fc9937ec513a40733b74950b7c4bdfaffd3a8142be3333f4981e5ff07898d5a1b1bc52f
-
SSDEEP
3072:ZXWaaDA/UsmY9KFdlvg08HHf1yhEZeXGA4FYP8R4V7/I6EPCLps:ZXP/5P6Y1NlepPnV7/pEKLm
Malware Config
Signatures
-
Makes use of the framework's Accessibility service. 1 IoCs
Processes:
com.frontbynpxadescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.frontbynpxa -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
Processes:
com.frontbynpxadescription ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.frontbynpxa -
Acquires the wake lock. 1 IoCs
Processes:
com.frontbynpxadescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.frontbynpxa -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.frontbynpxaioc pid process /data/user/0/com.frontbynpxa/cache/apjorsma 4014 com.frontbynpxa /data/user/0/com.frontbynpxa/cache/apjorsma 4014 com.frontbynpxa -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
com.frontbynpxadescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS com.frontbynpxa -
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes:
com.frontbynpxadescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.frontbynpxa -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
com.frontbynpxadescription ioc process Framework API call javax.crypto.Cipher.doFinal com.frontbynpxa
Processes
-
com.frontbynpxa1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data).
PID:4014
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5d4cd337c961cce8a496a5e6e020e54c7
SHA162d731ab9f40470e649a51b8d7e61af61f23cd8b
SHA256ecc2807e8038a7bf3e899041ed0dcd4e3d970175a0418165db105368f40ecd1a
SHA512531398aaa3661831b881697b2bcb7d9d384d7cebf66f9cd9e8843e931e2eb82914c55081ab3412ed1a434e61e1c7e86d7b53df024e896ffa72d3f47f8c6a4b24
-
Filesize
73KB
MD5d4cd337c961cce8a496a5e6e020e54c7
SHA162d731ab9f40470e649a51b8d7e61af61f23cd8b
SHA256ecc2807e8038a7bf3e899041ed0dcd4e3d970175a0418165db105368f40ecd1a
SHA512531398aaa3661831b881697b2bcb7d9d384d7cebf66f9cd9e8843e931e2eb82914c55081ab3412ed1a434e61e1c7e86d7b53df024e896ffa72d3f47f8c6a4b24
-
Filesize
73KB
MD5d4cd337c961cce8a496a5e6e020e54c7
SHA162d731ab9f40470e649a51b8d7e61af61f23cd8b
SHA256ecc2807e8038a7bf3e899041ed0dcd4e3d970175a0418165db105368f40ecd1a
SHA512531398aaa3661831b881697b2bcb7d9d384d7cebf66f9cd9e8843e931e2eb82914c55081ab3412ed1a434e61e1c7e86d7b53df024e896ffa72d3f47f8c6a4b24
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
3KB
MD537a292b3925d074524eec62fcd50a33b
SHA170d72fb8d51d8c915ea54c2a2964bc8bd04c7018
SHA256193105f6e2d03efc4d71d7abdea642da1013381579bbce2e60e0f115695ccbf9
SHA5122874bc8025efaf5ff8dc4fc2630ecc94ea529ed24f498368892c191ade8a20ae3884812f27c8b3085317bd67fbf6ddbd07e47e8c920d8bfe31ee3e2f16095205