Resubmissions
28-03-2023 11:47
230328-nx3r1acd8v 7Analysis
-
max time kernel
672170s -
max time network
591s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
28-03-2023 11:47
Static task
static1
Behavioral task
behavioral1
Sample
jiomart_signed-avlp7d2x3gcjqjbw-3-AVLPayb12yTGl80D.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
jiomart_signed-avlp7d2x3gcjqjbw-3-AVLPayb12yTGl80D.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
jiomart_signed-avlp7d2x3gcjqjbw-3-AVLPayb12yTGl80D.apk
Resource
android-x64-arm64-20220823-en
General
-
Target
jiomart_signed-avlp7d2x3gcjqjbw-3-AVLPayb12yTGl80D.apk
-
Size
10.3MB
-
MD5
4d1767da11cc44c3caffc6f7f7b42d91
-
SHA1
9265e4e0f7888fa3a8112744fdf4fdcdbd186aa4
-
SHA256
203171d39a081c7a2f3bd25b6b6e5ea69550292a75cc042d6daf35f02de98dc9
-
SHA512
cb18ffb61280ef1a44cbd3ac582add4dcd177378a12d33b75e22ec6bb712fac7906925b19d4c0816cee2aefaf367448fb7955e65972135ed255c7574835fdfb6
-
SSDEEP
196608:eI32MZzdBpoqlvSOwswAZcZmmlW53dSouO6JHHaMR8gUAPw3tuhIJ:pPqbOwrVng3oouhLRZUBtF
Malware Config
Signatures
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
abyssalarmy.smseye/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/abyssalarmy.smseye/app_ded/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/abyssalarmy.smseye/app_ded/oat/x86/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/abyssalarmy.smseye/app_ded/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.dex 4088 abyssalarmy.smseye /data/user/0/abyssalarmy.smseye/app_ded/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.dex 4353 /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/abyssalarmy.smseye/app_ded/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/abyssalarmy.smseye/app_ded/oat/x86/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/abyssalarmy.smseye/app_ded/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.dex 4088 abyssalarmy.smseye -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes:
abyssalarmy.smseyedescription ioc process Framework API call javax.crypto.Cipher.doFinal abyssalarmy.smseye
Processes
-
abyssalarmy.smseye1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/abyssalarmy.smseye/app_ded/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/abyssalarmy.smseye/app_ded/oat/x86/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/abyssalarmy.smseye/app_ded/oat/x86/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.odexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/abyssalarmy.smseye/app_ded/oat/x86/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.vdexMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/abyssalarmy.smseye/app_ded/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.dexFilesize
12.6MB
MD5ea55233e252f605728e979e1ba461eb2
SHA19c1ee76e174b72f7c3da1294f27c37c141528dd0
SHA256831c6fe2683bd179fa383ef8d3034ae330d30920fa3558a320f1873e80cda56f
SHA51280dc82efcb7e70e5353088f71583bea96e45924d7d7f2613a88bc5c283f81199147fc602d507e5465d93b18bbb9b25033414714a997696eef1219072127a01bc
-
/data/user/0/abyssalarmy.smseye/app_ded/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.dexFilesize
12.6MB
MD5ea55233e252f605728e979e1ba461eb2
SHA19c1ee76e174b72f7c3da1294f27c37c141528dd0
SHA256831c6fe2683bd179fa383ef8d3034ae330d30920fa3558a320f1873e80cda56f
SHA51280dc82efcb7e70e5353088f71583bea96e45924d7d7f2613a88bc5c283f81199147fc602d507e5465d93b18bbb9b25033414714a997696eef1219072127a01bc
-
/data/user/0/abyssalarmy.smseye/app_ded/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.dexFilesize
12.6MB
MD5ea55233e252f605728e979e1ba461eb2
SHA19c1ee76e174b72f7c3da1294f27c37c141528dd0
SHA256831c6fe2683bd179fa383ef8d3034ae330d30920fa3558a320f1873e80cda56f
SHA51280dc82efcb7e70e5353088f71583bea96e45924d7d7f2613a88bc5c283f81199147fc602d507e5465d93b18bbb9b25033414714a997696eef1219072127a01bc
-
/data/user/0/abyssalarmy.smseye/app_ded/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.dexFilesize
12.6MB
MD5ea55233e252f605728e979e1ba461eb2
SHA19c1ee76e174b72f7c3da1294f27c37c141528dd0
SHA256831c6fe2683bd179fa383ef8d3034ae330d30920fa3558a320f1873e80cda56f
SHA51280dc82efcb7e70e5353088f71583bea96e45924d7d7f2613a88bc5c283f81199147fc602d507e5465d93b18bbb9b25033414714a997696eef1219072127a01bc
-
/data/user/0/abyssalarmy.smseye/app_ded/tgLUGeokizfDEJ4utaZ8NqqIFqSPttEx.dex.x86.flockMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e