Analysis
-
max time kernel
3228012s -
max time network
145s -
platform
android_x86 -
resource
android-x86-arm-20231023-en -
resource tags
-
submitted
11-11-2023 22:00
General
-
Target
4331245918b49928bf4ade317d67d2d4bb266f8317cf0d4cd79830fc0fd3e422.apk
-
Size
4.7MB
-
MD5
0421da1c5365179719ec718dc535a991
-
SHA1
350fe24cc298877f767733f0254eb18a734ba01e
-
SHA256
4331245918b49928bf4ade317d67d2d4bb266f8317cf0d4cd79830fc0fd3e422
-
SHA512
23b6f21f2631653e8d9cec7092aefd027b196ff2fccdec56a386b288f8cdf56eb9a7c527b87b691a6adaea2650cbc19ac10197d36aeb718333968ba46a5df6c8
-
SSDEEP
49152:PwfnjOgbT3HAQZa6bw6zfr2x2qZzmx5dOBV6Eu9/h4+aHSw8BgUiM58FqrK9:PUNbT3lzfr2xri5cBE/48GUiFqW9
Malware Config
Signatures
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
Processes
-
com.nsokcuvzy.ntapoxlsvkivm1⤵
- Makes use of the framework's Accessibility service.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nsokcuvzy.ntapoxlsvkivm/app_DynamicOptDex/Ysh.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.nsokcuvzy.ntapoxlsvkivm/app_DynamicOptDex/oat/x86/Ysh.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706KB
MD529257f99a0383111effd18c11911e153
SHA1202881452499dff8c23c66df6d0c901e1a55bff7
SHA256492cd5703253a99a725634c7d51e43fe3b05754e2e45ba69aa70f8d803ea505b
SHA512e215d5b3103280b6182d711c34a39019764facf7c93bab44b1a5838b83ceb73c1a4be93d49cff813332d9fab33ebc6ea89c8599b8c339c1e29f81e49ad677109
-
Filesize
706KB
MD55fe2adee0207cf8139e46b2f7baef1ed
SHA1476ea5673b3af6ffec4daeaa9245f381a8fb74ce
SHA256d4ab74fbec7846f6c9510b88b2c8368df24f5bdf52d49feb1fc96e51c2d16de1
SHA51295884cb752a8ed5be85915b9a940ce390d0445d95eebfee36e6c6a24b599b5108dabd847e9c807243bc52596a7af012a76e4628219a067c36077188d9261718a
-
Filesize
1.5MB
MD5aa4922242c7a9b5f47a83ebea54135c2
SHA1e3c852b352ec5c5528dfa7d465ced1af98516726
SHA256e0df97402fb58beca13d592260ba5958c37b3833cfa811425efa33f5940b1454
SHA512f6ec8f06fa94d77f1237152013d628e7d80d2b06b63f8ab5254dc03101a59355a3b88f261c3a9c656246e346a725e17d126229c0fd958a1642f6adacdf669b98
-
Filesize
1.5MB
MD5672c9f25f46449c27b53e82ad72adb36
SHA168aa3994dba556ce00ba2427ba9b7b0c4e9efce6
SHA256d50a707c1f2651bcdc75246ce67301b8f48a9448d2e1bef2c79ef474de5c2a54
SHA512070d45a9f7a8a55f7bac40ad413227939efc25a0e84ad48939503bbf27c0c90b92c6d045d961b3c8a135c1f7bf543ef9386044b014f6da1bad6169a312a9eeec