Overview

overview

8

Static

static

1

09bdcd05d4...20.apk

android-9-x86

8

09bdcd05d4...20.apk

android-11-x64

8

__xadsdk__...__.apk

android-9-x86

__xadsdk__...__.apk

android-10-x64

__xadsdk__...__.apk

android-11-x64

gift_catch.html

windows7-x64

1

gift_catch.html

windows10-2004-x64

1

github_mraid.js

windows7-x64

1

github_mraid.js

windows10-2004-x64

1

libwbsafeedit

debian-9-armhf

1

mraid.js

windows7-x64

1

mraid.js

windows10-2004-x64

1

Analysis

  • max time kernel
    2857455s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
  • submitted
    18/09/2023, 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    09bdcd05d4e2fe3976208ecddb33e49459fd4e207ddc3544737225d7c6554320.apk

  • Size

    5.0MB

  • MD5

    81073216f595f2e0eb8161b5ae43c089

  • SHA1

    5e7766582f9d0ec8cab13dbbb6be798f19d762b5

  • SHA256

    09bdcd05d4e2fe3976208ecddb33e49459fd4e207ddc3544737225d7c6554320

  • SHA512

    167d1a1ac740a6db232ca5074c855a754f4733720544ff27b0d82561bf51d3c1784d7af4b9f33e9416712e20b6728f930109e0cbfcad100a5fd66bbdde27539d

  • SSDEEP

    98304:yaQT7OiV3NgMyO5CUjZZOThI6GBFEFF54xpno+C/3/RUBcCZtrgIDyl726:xQfNV9gM6Z1I7qL4xpnoDqVtUpl7D

Score
8/10
evasionstealthtrojan

Malware Config

Signatures

  • Makes use of the framework's Accessibility service. 3 IoCs
  • Removes its main activity from the application launcher 7 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion

Processes

  • com.journey.app
    1⤵
    • Makes use of the framework's Accessibility service.
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4382
    • getprop ro.miui.ui.version.name
      2⤵
        PID:4822
      • getprop ro.miui.ui.version.name
        2⤵
          PID:4929
        • getprop ro.miui.ui.version.name
          2⤵
            PID:5043
          • getprop ro.miui.ui.version.name
            2⤵
              PID:5081
            • getprop ro.miui.ui.version.name
              2⤵
                PID:5109
              • getprop ro.miui.ui.version.name
                2⤵
                  PID:5146
                • getprop ro.miui.ui.version.name
                  2⤵
                    PID:5172

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /data/user/0/com.journey.app/app_DynamicOptDex/RWjazsQJtSUFgiI.json
                  Filesize

                  572KB

                  MD5

                  291732a04a280cd351eb4ebbc8c2afba

                  SHA1

                  2e1f775953a1351ea6d5abfd260e7ba364214b2c

                  SHA256

                  9aee2968b1a117114af8ee38159bb2b824985d22b3349e7c4fe7bd6cc7cf08d8

                  SHA512

                  edf66013405a43ce7061241271251b6ebb9927a271f051a258d26eb308579a4352efa3537b18c9d687fadf0b1c4f7e6861bd1253f58396ab29778c984a5eff11

                  Download Submit

                • /data/user/0/com.journey.app/app_DynamicOptDex/RWjazsQJtSUFgiI.json
                  Filesize

                  572KB

                  MD5

                  f03039fab8373e51581f71c38094680a

                  SHA1

                  2944e4458c4635e096728edfbbccc6e9b1f16c3b

                  SHA256

                  169644227aeeddb6aae0712316e2d4008c44048cd5e568b77b9dd3facda00fc5

                  SHA512

                  788b8a8a9678428aa2488dd34c691aebcd9bbde7e73576d0c9d2608e1492c2df1845509de2147345630015714aa2ec243a15a6a9aac4e4331b69c181974bf17d

                  Download Submit

                • /data/user/0/com.journey.app/app_DynamicOptDex/RWjazsQJtSUFgiI.json
                  Filesize

                  631KB

                  MD5

                  476727c727219e9a013f4edc04cf7014

                  SHA1

                  bdb92c39134a775f268d6db803426abd388bbd28

                  SHA256

                  86889c1f5b9f3639267a6b7617dc25609c704ed78f30f97c2dd30731a5f99d48

                  SHA512

                  eb6b9e5b692217f8f983faf37ec448423493e882583d533218822e9d41cd301b5b4782ee0dcbe686e03992c6c72cfcc58055e8d535970cbd60f29780e29a34df

                  Download Submit

                • /data/user/0/com.journey.app/app_DynamicOptDex/oat/RWjazsQJtSUFgiI.json.cur.prof
                  Filesize

                  228B

                  MD5

                  4b632c12e1ba9144f9a09f60b3e80a36

                  SHA1

                  1bbf90303a78e4c542db60a3c3496b53cf8eb541

                  SHA256

                  f32cde33be4c2bacc5a1828e1e59801d5e1612c4e323428387e30248f06a58c6

                  SHA512

                  06f66201b71941c928c7994de573ae5474367b3ca9f835f2536d4936c5600a606594f7e76b6d870a514f52b4f4abab82f82fc8ae09ef39bdfa51b642fad54e0e

                  Download Submit