Overview
overview
10Static
static
7849d6e9430...e5.apk
android-9-x86
10849d6e9430...e5.apk
android-10-x64
10849d6e9430...e5.apk
android-11-x64
10noconnection.html
android-9-x86
noconnection.html
android-10-x64
noconnection.html
android-11-x64
policy_content.html
android-9-x86
policy_content.html
android-10-x64
policy_content.html
android-11-x64
slardar_bridge.js
android-9-x86
slardar_bridge.js
android-10-x64
slardar_bridge.js
android-11-x64
slardar_sdk.js
android-9-x86
slardar_sdk.js
android-10-x64
slardar_sdk.js
android-11-x64
terms_of_service.html
android-9-x86
terms_of_service.html
android-10-x64
terms_of_service.html
android-11-x64
Analysis
-
max time kernel
3789833s -
max time network
38s -
platform
android_x64 -
resource
android-x64-20230621-en -
resource tags
androidarch:x64arch:x86image:android-x64-20230621-enlocale:en-usos:android-10-x64system -
submitted
22-06-2023 06:56
Static task
static1
Behavioral task
behavioral1
Sample
849d6e94305a096826f95d313f799c7acc95aee57dc1163b7654f0c92b6f5de5.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
849d6e94305a096826f95d313f799c7acc95aee57dc1163b7654f0c92b6f5de5.apk
Resource
android-x64-20230621-en
Behavioral task
behavioral3
Sample
849d6e94305a096826f95d313f799c7acc95aee57dc1163b7654f0c92b6f5de5.apk
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral4
Sample
noconnection.html
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral5
Sample
noconnection.html
Resource
android-x64-20230621-en
Behavioral task
behavioral6
Sample
noconnection.html
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral7
Sample
policy_content.html
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral8
Sample
policy_content.html
Resource
android-x64-20230621-en
Behavioral task
behavioral9
Sample
policy_content.html
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral10
Sample
slardar_bridge.js
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral11
Sample
slardar_bridge.js
Resource
android-x64-20230621-en
Behavioral task
behavioral12
Sample
slardar_bridge.js
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral13
Sample
slardar_sdk.js
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral14
Sample
slardar_sdk.js
Resource
android-x64-20230621-en
Behavioral task
behavioral15
Sample
slardar_sdk.js
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral16
Sample
terms_of_service.html
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral17
Sample
terms_of_service.html
Resource
android-x64-20230621-en
Behavioral task
behavioral18
Sample
terms_of_service.html
Resource
android-x64-arm64-20230621-en
General
-
Target
849d6e94305a096826f95d313f799c7acc95aee57dc1163b7654f0c92b6f5de5.apk
-
Size
2.9MB
-
MD5
24d1aff4e64ab4975046256cd84f364a
-
SHA1
87eb2a30eeb048e1a061a4c0c1694284ab0e5f79
-
SHA256
849d6e94305a096826f95d313f799c7acc95aee57dc1163b7654f0c92b6f5de5
-
SHA512
8e525f2cb247d73da8e4010e90b9bfac39dccff66a22fd56c893a867bc3aff0c8c937c6fa073c52965a76de3786638503a42ccba97a5c07d463e9f5928d43d3d
-
SSDEEP
49152:3mg6ICINcBQ4nCnzvMSjjajduVSWrqd/+kog2AsjwPVTxVhApUfmL:3mTDJatkP+dvjw99r3fe
Malware Config
Extracted
hook
http://91.215.85.22:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.dekezumepome.deyeciteioc pid process /data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/CHw.json 5152 com.dekezumepome.deyecite -
Reads information about phone network operator.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
705KB
MD521672f1a63abf2641d367d27ae8a2ef3
SHA14d402ab52e8c987bf876a0b8a2e24112032bcc1b
SHA256e71046d6e6c9657a27f483c55c84762daa544f36d2a98acd118d1ffdcf9fffb5
SHA512945c9ec8627e657e15eacf4fc804b8ece90fafee5ac5d3611e82e9e2629f4c8d7476bcf3723747812301ef19ab366e10be1b669074e17226c713dc5b56c4988c
-
Filesize
1.5MB
MD53e37214a8dcb0a66ac8c147b7ab1c0e4
SHA19c777385a33bd871dc1d044985b44e673a7a9633
SHA2568e64678e1b935f9c316d939ba016a1aa6e7b603432ba3b5326c329a2e089ce83
SHA512877a7ea90ee28e0a293c9ba9996bca8c2f667784436e5ef8ac73486041e5e58331a29e293476359142ab5d74896704d59f543d18ae4aa4db1ddf0170f13e9ae7
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
8KB
MD5b6ca8b30661a7844ed292db75a29a953
SHA18e0d397ab1f2ced1f143829084c3f53333743bdd
SHA25663a219c7092be26641907c5f955aa977e7675e3922a8e4ee2af25bfed8c7bbfb
SHA512d21ce3adf13d61369708ea000438f626973f20b08ca05a744c1cccb2d5e7c264a8af9c3ebd18a7a6a464d38e1c64146f8e881d29d71a0484dd94212315f6dceb
-
Filesize
1KB
MD5d9abf11980fcae6cbb77859abd9e513f
SHA16ac56f8a23d1dda83511f87d04fdfa736306e41f
SHA256ecffbcc58e5163ad6ee177b067aca82e540fcfa2a3fb159f0b3464bf96743151
SHA512caeba36a0f849f956c07a13fc2de627116535013e1f8e89ea7f89d94db01eca69db40f69463a1fdd07460c06bdc83e58b4e0e97b2c49040d97a4a83a4542ba72
-
Filesize
16B
MD54ae71336e44bf9bf79d2752e234818a5
SHA1e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA256374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
SHA5120b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27
-
Filesize
346KB
MD5952667380eb3f89680dcd64c96ffce8d
SHA1874c39bba00462a54029726f019f66f00b4eea18
SHA256362742b500ba6f3262cedec90ed83a86afe380fc557bb84509d7dfebe1963b64
SHA5126f74dec6cc7716cb8a88e5cc961c91d6657301e68f30dbf07894db718ae02c37dda481173713586808343504eb63300835e62df78e3807d8e9273d23d0521a9a
-
Filesize
138B
MD5f8bdc04912eb3db8c209c12532aa4591
SHA102a8902131d9156b4ec30974580ad083b7d52a84
SHA256b975dd690c4028dba6fbf2faf0e940d46ea0dc458acbc24eafe74e9d5b75d19a
SHA51208aa271eb341ba240b088f2209c387d3f8796956a6220ddab34824e251fc33c691db70144710146a9e05675e7354d1b070727d4a76aa3f88b71aad233ebb1101