Analysis

  • max time kernel
    3228027s
  • max time network
    166s
  • platform
    android_x64
  • resource
    android-x64-20231023.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system
  • submitted
    11/11/2023, 22:00

General

  • Target

    4331245918b49928bf4ade317d67d2d4bb266f8317cf0d4cd79830fc0fd3e422.apk

  • Size

    4.7MB

  • MD5

    0421da1c5365179719ec718dc535a991

  • SHA1

    350fe24cc298877f767733f0254eb18a734ba01e

  • SHA256

    4331245918b49928bf4ade317d67d2d4bb266f8317cf0d4cd79830fc0fd3e422

  • SHA512

    23b6f21f2631653e8d9cec7092aefd027b196ff2fccdec56a386b288f8cdf56eb9a7c527b87b691a6adaea2650cbc19ac10197d36aeb718333968ba46a5df6c8

  • SSDEEP

    49152:PwfnjOgbT3HAQZa6bw6zfr2x2qZzmx5dOBV6Eu9/h4+aHSw8BgUiM58FqrK9:PUNbT3lzfr2xri5cBE/48GUiFqW9

Score
8/10

Malware Config

Signatures

  • Makes use of the framework's Accessibility service. 3 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs

Processes

  • com.nsokcuvzy.ntapoxlsvkivm
    1⤵
    • Makes use of the framework's Accessibility service.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    PID:5049

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nsokcuvzy.ntapoxlsvkivm/app_DynamicOptDex/Ysh.json

    Filesize

    706KB

    MD5

    29257f99a0383111effd18c11911e153

    SHA1

    202881452499dff8c23c66df6d0c901e1a55bff7

    SHA256

    492cd5703253a99a725634c7d51e43fe3b05754e2e45ba69aa70f8d803ea505b

    SHA512

    e215d5b3103280b6182d711c34a39019764facf7c93bab44b1a5838b83ceb73c1a4be93d49cff813332d9fab33ebc6ea89c8599b8c339c1e29f81e49ad677109

  • /data/data/com.nsokcuvzy.ntapoxlsvkivm/app_DynamicOptDex/Ysh.json

    Filesize

    706KB

    MD5

    5fe2adee0207cf8139e46b2f7baef1ed

    SHA1

    476ea5673b3af6ffec4daeaa9245f381a8fb74ce

    SHA256

    d4ab74fbec7846f6c9510b88b2c8368df24f5bdf52d49feb1fc96e51c2d16de1

    SHA512

    95884cb752a8ed5be85915b9a940ce390d0445d95eebfee36e6c6a24b599b5108dabd847e9c807243bc52596a7af012a76e4628219a067c36077188d9261718a

  • /data/user/0/com.nsokcuvzy.ntapoxlsvkivm/app_DynamicOptDex/Ysh.json

    Filesize

    1.5MB

    MD5

    672c9f25f46449c27b53e82ad72adb36

    SHA1

    68aa3994dba556ce00ba2427ba9b7b0c4e9efce6

    SHA256

    d50a707c1f2651bcdc75246ce67301b8f48a9448d2e1bef2c79ef474de5c2a54

    SHA512

    070d45a9f7a8a55f7bac40ad413227939efc25a0e84ad48939503bbf27c0c90b92c6d045d961b3c8a135c1f7bf543ef9386044b014f6da1bad6169a312a9eeec