1127824498725bf2a688bef75ec3fb56e7dd658295f79017c9ca268b75c96079 | Triage

Resubmissions

22-10-2023 16:12

231022-tng2tsae6v 7

13-10-2023 00:25

231013-aqzj4shg43 7

Sharing

General

Target

inat-box-v13.apk
Size

10.7MB
Sample

231022-tng2tsae6v
MD5

eb1614b8aa7e277b934c33889e6fe758
SHA1

0b6f1fbbf0fe18d017cee9908c9476c704caa856
SHA256

1127824498725bf2a688bef75ec3fb56e7dd658295f79017c9ca268b75c96079
SHA512

c1d1052bf0839584b72f4a82ac55dfb7c5c6b109c881e86dbc8f8f37da9ca450b201efca8b303e33ca78cec670c27a59cd3cc3220893476cfaff6cba7de1ff95
SSDEEP

196608:LraxZVFeCS7QKdsqi09LaTmRKk1SYRhKg2qAkONdgFs9KrkRkaEtXZ:C6ZsX0gTMKkMYRhKv9kONdcXrLp

Score

7^/10

android evasion ransomware

Malware Config

Targets

- Target
  
  inat-box-v13.apk
- Size
  
  10.7MB
- MD5
  
  eb1614b8aa7e277b934c33889e6fe758
- SHA1
  
  0b6f1fbbf0fe18d017cee9908c9476c704caa856
- SHA256
  
  1127824498725bf2a688bef75ec3fb56e7dd658295f79017c9ca268b75c96079
- SHA512
  
  c1d1052bf0839584b72f4a82ac55dfb7c5c6b109c881e86dbc8f8f37da9ca450b201efca8b303e33ca78cec670c27a59cd3cc3220893476cfaff6cba7de1ff95
- SSDEEP
  
  196608:LraxZVFeCS7QKdsqi09LaTmRKk1SYRhKg2qAkONdgFs9KrkRkaEtXZ:C6ZsX0gTMKkMYRhKv9kONdcXrLp
Score

7^/10

ransomware evasion
- Acquires the wake lock.
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Legitimate hosting services abused for malware hosting/C2
- Reads information about phone network operator.
- Removes a system notification.
  evasion
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

evasionransomware