Analysis

  • max time kernel
    3186562s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64-arm64-20231023-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231023-enlocale:en-usos:android-11-x64system
  • submitted
    11-11-2023 10:28

General

  • Target

    NEAS.8ef5fde27bfffcf02fb982c5a4d2a791af1156d15ac0dfe3379b9e0b363a869a.apk

  • Size

    2.6MB

  • MD5

    fee597bf57d2f085927511a8df00b503

  • SHA1

    1668ec731191027dce4ca08e76bab25e1e051f43

  • SHA256

    8ef5fde27bfffcf02fb982c5a4d2a791af1156d15ac0dfe3379b9e0b363a869a

  • SHA512

    32c8156231788fe95bd2e5ab0ecbd025fc126a168d545462b46e91de15ec423f89039209aae646812910543d411021d0180e68de274bdf236f8c4927d3f8e828

  • SSDEEP

    49152:QE7/Q767Bd2KFzGu/IVvKUdmfRBYhwn91bkDaglsDMdcO0RlgpSEkWZlEpD:QUQ767B8KFzGqIVvKdffnrkDagy4d8ln

Score
7/10

Malware Config

Signatures

  • Acquires the wake lock. 1 IoCs
  • Reads information about phone network operator.

Processes

  • vip.app.com
    1⤵
    • Acquires the wake lock.
    PID:4362
    • ping -c 2 -W 10 -v google.com
      2⤵
        PID:4496

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/user/0/vip.app.com/cache/1

      Filesize

      345B

      MD5

      589700204247c76bbb6a30f647f25033

      SHA1

      e43ee7b217658fe34035040fa103e6aadabead03

      SHA256

      888e4533e6ea033100159045f82e1ff09ec63574cb0fcfab469f094bb586d6ca

      SHA512

      27ad3e030c9eb1fff780cd3ade74733e764df8e7fff46d3fd53e7e1fb68d93d84d344756d0806930a82dcb20e10214be14090b4c714f99a17f9a75732042b368

    • /data/user/0/vip.app.com/cache/2

      Filesize

      30B

      MD5

      626ef029600238acc2f62f20585dd0a6

      SHA1

      38d7690c98f9d17daa64a8874540dd0d531af41b

      SHA256

      e88ee473cc3cf70c16e19d287bd8055cb9b965074d4e5c2f0d1d0afeb04b418c

      SHA512

      10257a782d15f2e0af71e9bb4bca104893b891ca067577ab4a031f4471c2b37f2f358bffc454926051c91d6d338ebac68905c65831f9d053bc2080323340cdc9

    • /data/user/0/vip.app.com/cache/~test.test

      Filesize

      4B

      MD5

      098f6bcd4621d373cade4e832627b4f6

      SHA1

      a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

      SHA256

      9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

      SHA512

      ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      fab3b7068cd00326f70c8463342f2242

      SHA1

      973e8c566dbdaa9b47ce2222a15ab8b066a83030

      SHA256

      14274fa9f491c2d8f03f64a48efed35e3f8910901b08af3a92c9ebf074de3698

      SHA512

      b4f96694b3ae7f413bd793263b9c674af2a1f01809aa3946660ea63154477d257e58d1ab4e51c9b1669827befc520f55ca149bcfcf98e785e4571a4ebe17db9e

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      1d5c781ec73a70b4f83c9c1cc32c1843

      SHA1

      bcbb8582a73b4a28359bf6e7d5cd6201cdc9a268

      SHA256

      ce2772145f22b8e962539e756cd1f90f6a8d666f55ac578097de33522937bbf6

      SHA512

      234d2af64b055b3f9c06b5d237a85a64b5742979217d5ed09a750caf6509e5b910510ec417b8f521b0022d63ce2b5304983b432f0f4a1a35a7d571cd0a4a0694

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      90f784f98a19f8f5a0c9f828ba46e3fe

      SHA1

      5e68eb821c20de754cdd794cf1e9cc8461973536

      SHA256

      cf68322d28141711e62498dc53dfbb9735e1130482bf636f9b80d3c552c42c1f

      SHA512

      fedb1f5b5f90dc5fd59516d82a7b2a5912c7a19753bee06c4672b86a301b381b2eefaa9ccea0857364b9260d54ad70865eb9b84a0010df3b793060444084f509

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      c1e96379dde9c7d7afa2d55eab3c9199

      SHA1

      2ffbfded2172bf6556e40ea90cc28507dc395fc1

      SHA256

      aa85c59271e76f20051bdc4c4efd80eb73cc143fd50fc84535f974abccf66f0b

      SHA512

      b4ece3745deb70a938f3d98bfe6e69083a70bf1d3abe45483b3237f3df6ceeffd260bf99ccc65ab93da95e61e9a6f456e77ed7713cb344c35511926b81eac23d

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      de82e2c94d2718988804b035a46d17b1

      SHA1

      705f5ff19093ad209f2a666085d6ccaed3bf58a4

      SHA256

      29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39

      SHA512

      68f5f88e638e76cb5036dad6b320896f1735f64067ace152e0baea81e9ea0d153559f53bd5c608b397281369dafd14c5f5965f92f567dc89db157414a699023e

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db

      Filesize

      16KB

      MD5

      d9cf75fdd1c2292d986f6c3d5d60f2c8

      SHA1

      07ecb1d3a26d952ae5fecf54f36699ab498510b1

      SHA256

      2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a

      SHA512

      442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db-journal

      Filesize

      8KB

      MD5

      8d1ad42c600f77fa4c2b108ca44c0f59

      SHA1

      00d11e1896206bd85a5ede2314efd91d0a5d48b1

      SHA256

      e2966b1460565af048ca81eb345be1b80a6a0b9758115b92fd0c75bce6615c40

      SHA512

      d1eb60f1c6291392b6712b55d5bf22c4498128d25e026f4a20a33f118e76207021321d8b8df0dafefc90f06dec99349a471a8a3c5ac4c915dc45bfdeb529d734

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db-journal

      Filesize

      8KB

      MD5

      cb91425509f2b1209777ce0abe030e23

      SHA1

      a087de8665af81bcaf9da35a75036638ca85258d

      SHA256

      7380bd95b70d0329afdfdc479c13916a11885df8afb7fe819b2e87dfa4508412

      SHA512

      211577ca28c25bc5a66ce75f9fb49f7021cfe153e466bb6189e24d64852b4df57258738656d3ac35fea17da75403bfb9a69a0f5e6defbd2055e79d6723df9679

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db-journal

      Filesize

      512B

      MD5

      eed8757277e5ca90b7b1042779d014f8

      SHA1

      811c55062ea3f7c145140c984246f87d3b9f3f0e

      SHA256

      f0efbe2794eaecfd1fe45ebf1e6b98184ce00d40ffa705a0a9cf56318c600133

      SHA512

      d408d98e38ff9272e185f65fd92ca329d537569fa64e927c60bb175f5cefaf514d8995c01fe01c66da2a213273db26a8ecab3c16509109d69e00af997cf37a4a

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db-journal

      Filesize

      8KB

      MD5

      87e9745b2a45709b3861c37998130cc1

      SHA1

      b9f68dce1c5b9b3ba5b193ac213061eeb9e183b0

      SHA256

      8e878603822e52a6b296343f15634a5dac4beeaf70e74e3c14e5f10e27ef5c9a

      SHA512

      c9f288a9b5836061da49bfed735474f3769954d0cc873dac1c1952679f9f2beaa77296003278ff0c75b8209493593d11c91aed8079a9f926e29398ca67b55b0e

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db-journal

      Filesize

      4KB

      MD5

      56837b0865a12bad90833a4e7e7c3e2d

      SHA1

      fe431638c302c4d27946fec275df87de21bd6e6c

      SHA256

      ecb39b7cb09b20573c364e9d45faac46c64f9129527d553eee5cad63b1748127

      SHA512

      07cedcbf8469a00a34fac53e3ac8d81e59b4eeca7ac9bf01ed7de26e194b8ab9c22e37c0f329d8a50ffb64b25d9ea2bd02cf85ef2b5017042424259baff4e4fe

    • /data/user/0/vip.app.com/databases/google_app_measurement_local.db-journal

      Filesize

      8KB

      MD5

      3842d66c1d33a1200830834d95c1477c

      SHA1

      06a23cf777a56923ac80cf68010cb9b3d59171d7

      SHA256

      064d8ca45a0c625f35661e1db26630423b6442891cf6d204150eb340a322f776

      SHA512

      17834a004c96046632d4493bece9917a39bae058354a9b8b8c59132fd9b11383f5fa1f7f7f207c65bfd1efd38831b3413779f6097d7862b0f681e687c23a7cf0

    • /data/user/0/vip.app.com/files/PersistedInstallation4798081422940410565tmp

      Filesize

      90B

      MD5

      53341d520fa173d11ab2d0088eba7d23

      SHA1

      e5c3e0e3edce0d15b375903ca75b3299502fbfc6

      SHA256

      ee9aaf913dfa211933b521323f50ff9854b733547e8561f68d78001c50dd0075

      SHA512

      4e7fd9dbdcbdf0332a8f2317e876bb94b8ff0b1da6f3c6784a3032a1b7576c24dcc5640c94caf7f94139e20a9264eb1505862e03cc47007abc9edbc99a3c89c3

    • /data/user/0/vip.app.com/files/PersistedInstallation6459933172358771804tmp

      Filesize

      569B

      MD5

      808330e9bf195f9cddd90eb1f1ea833a

      SHA1

      36f559f8e1146e52be46e41692caf09e85ee125b

      SHA256

      3c33f0609de60b2a5ca03cca5f69df95db80b22acb44b80b27df016d817f4a54

      SHA512

      54f54bb61da1581fd0147b8997f6a0eab75645c072f9ad3e8338491f6cea5ec09c523b94f7f289117cedfbe62781185ed488ffd814a730072e3f245b8507efee

    • /data/user/0/vip.app.com/files/starter.txt

      Filesize

      4B

      MD5

      b326b5062b2f0e69046810717534cb09

      SHA1

      5ffe533b830f08a0326348a9160afafc8ada44db

      SHA256

      b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

      SHA512

      9120cd5faef07a08e971ff024a3fcbea1e3a6b44142a6d82ca28c6c42e4f852595bcf53d81d776f10541045abdb7c37950629415d0dc66c8d86c64a5606d32de